build(mobile): align workspace build tooling by iscekic · Pull Request #7979 · Kilo-Org/cloud

iscekic · 2026-10-19T07:56:23Z

Summary

Align mobile build tooling across the workspace scripts, release workflow, EAS configuration, and developer instructions. EAS CLI 24.13.0 is the declared development tool. Dependency installation follows the workspace's frozen-install policy.

A regression test checks that the manifest, eas.json and the release workflow all name that same workspace CLI, and fails when a script or workflow step calls another binary.

The shared CI helper caches pnpm's package store; each job creates its installed dependency layout for its frozen graph.

Verification

pnpm install --frozen-lockfile — passed after merging main and regenerating the dependency graph.
pnpm --filter kilo-app exec eas --version — printed eas-cli/24.13.0.
pnpm --filter kilo-app run build:android --help — displayed the EAS build command help.
pnpm test:kilo-app-release — 82 tests passed, including the tooling checks and their rejection cases.
A fresh package-store-only frozen installation displayed the expected CLI version and resolved React declarations for transitive mobile consumers.

These are CLI and configuration changes. No store build or submission was started; no visual surface changed.

Proxy answers

Question: Which tool version should be used?
Answer: 24.13.0 (confidence 0.90).
Question: Which script invocation form should be used?
Answer: Bare eas (confidence 0.75).
Question: Which developer instructions should be updated?
Answer: Both README command examples (confidence 0.85).
Question: How should merge review tooling handle upstream content?
Answer: Correct merge-aware gate handling (confidence 0.85).
Question: Is a narrowly scoped infrastructure repair authorized?
Answer: Authorize the gate-only repair, test it, reload the corrected gate, and complete this PR normally (confidence 0.88).
Question: Which CI dependency-cache strategy should be used?
Answer: Cache the package store only (confidence 0.55).
Question: Should the branch carry a guard for the tooling agreement, or only reword documentation?
Answer: Add a regression test (confidence 0.68).

socket-security · 2026-10-19T07:57:39Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/eas-cli@24.13.0

View full report

socket-security · 2026-10-19T07:57:41Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	License policy violation: npm `@expo/logger` under BUSL-1.1 License: BUSL-1.1 - The applicable license policy does not permit this license (5) (npm metadata) License: BUSL-1.1 - The applicable license policy does not permit this license (5) (package/package.json) From: pnpm-lock.yaml → `npm/eas-cli@24.13.0` → `npm/@expo/logger@24.13.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@expo/logger@24.13.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@expo/steps` under BUSL-1.1 License: BUSL-1.1 - The applicable license policy does not permit this license (5) (npm metadata) License: BUSL-1.1 - The applicable license policy does not permit this license (5) (package/package.json) From: pnpm-lock.yaml → `npm/eas-cli@24.13.0` → `npm/@expo/steps@24.13.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@expo/steps@24.13.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@expo/turtle-spawn` under BUSL-1.1 License: BUSL-1.1 - The applicable license policy does not permit this license (5) (npm metadata) License: BUSL-1.1 - The applicable license policy does not permit this license (5) (package/package.json) From: pnpm-lock.yaml → `npm/eas-cli@24.13.0` → `npm/@expo/turtle-spawn@24.13.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@expo/turtle-spawn@24.13.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential typosquat (AI signal): npm `ansis` as a typo of ansi Did you mean: ansis From: pnpm-lock.yaml → `npm/eas-cli@24.13.0` → `npm/ansis@3.17.0` ℹ Read more on: This package \| This alert \| What is AI-detected potential typosquatting? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Given the AI system's identification of this package as a potential typosquat, please verify that you did not intend to install a different package. Be cautious, as malicious packages often use names similar to popular ones. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ansis@3.17.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential security risk (AI signal): npm `jks-js` is 66.0% likely risky Notes: No clear malicious/backdoor behavior is evident in this snippet (no network or execution primitives). The dominant security issue is unsafe handling of secrets: it hardcodes a keystore password and logs the converted PEM outputs (which commonly include private keys) to stdout/logs. This can lead to credential/private-key leakage in CI/CD and production logging environments. Review/remove the hardcoded password and avoid logging raw PEM/private key material; ensure secrets are managed via secure configuration and redaction. The local dependency implementation is not shown, so residual risk remains unquantified. Confidence: 0.66 Severity: 0.70 From: pnpm-lock.yaml → `npm/eas-cli@24.13.0` → `npm/jks-js@1.1.0` ℹ Read more on: This package \| This alert \| What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/jks-js@1.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential typosquat (AI signal): npm `safe-json-stringify` as a typo of json-stringify-safe Did you mean: ~~safe-~~json-stringify-safe From: pnpm-lock.yaml → `npm/eas-cli@24.13.0` → `npm/safe-json-stringify@1.2.0` ℹ Read more on: This package \| This alert \| What is AI-detected potential typosquatting? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Given the AI system's identification of this package as a potential typosquat, please verify that you did not intend to install a different package. Be cautious, as malicious packages often use names similar to popular ones. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/safe-json-stringify@1.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

kilo-code-bot · 2026-10-19T08:00:07Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental change adds a guard test that keeps apps/mobile/package.json, eas.json, and the release workflow on one workspace EAS CLI; the assertions match the current files and the commit correctly mutations, so no issues were found.

Files Reviewed (6 files)

scripts/kilo-app-release-workflow.test.mjs - new validateEasCli assertion and its mutation cases pass against current manifests and workflow lines; no issues
.github/workflows/kilo-app-release.yml - every eas env:/build/submit invocation uses pnpm exec eas from apps/mobile; no issues
apps/mobile/package.json - eas-cli pinned to 24.13.0, scripts invoke bare eas so pnpm resolves the workspace binary; no issues
apps/mobile/eas.json - cli.version is 24.13.0, matching the development dependency; no issues
apps/mobile/README.md - command examples use pnpm exec eas; no image tags added; no issues
pnpm-workspace.yaml - dtrace-provider: false build entry is valid under allowBuilds; no issues

Verification notes: HEAD 99ea8ce5e confirmed against PR headRefOid. The merge of origin/main resolved .github/actions/pnpm-store/action.yml to main's store-only cache action, so that file is no longer part of this PR's diff and needs no further review. The prior apps/mobile/package.json version-alignment finding is fixed at HEAD (eas.json and the dependency both name 24.13.0), and the prior typecheck diagnostic-step finding is removed. Tests were not executed in this read-only review; the new assertions were verified by reading the current workflow, package manifest, and eas.json contents.

Previous Review Summaries (5 snapshots, latest commit 3643650)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `3643650`)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental change mounts only pnpm's package store (instead of the root node_modules) and removes the diagnostic step that previously failed the required typecheck job; the mount path matches pnpm_config_store_dir, and no new issues were found.

Verification Notes

.github/actions/pnpm-store/action.yml: path: ./node_modules/.pnpm-store matches the selected store dir written to GITHUB_ENV, so the sticky disk mounts exactly the directory pnpm writes to. Removing the virtual store from the cache is consistent with the action description's "each install creates the virtual store and workspace links" claim, and the new key avoids reusing a root-node_modules disk.
.github/workflows/kilo-app-ci.yml: the Inspect declaration resolution step is gone and no reference to @types/react / realpathSync / resolveModuleName remains in .github, resolving the prior required-check failure.
Targeted re-check of previously verified alignment at current HEAD (3643650): apps/mobile/eas.json declares cli.version 24.13.0 and apps/mobile/package.json pins eas-cli 24.13.0.

Files Reviewed (2 files)

.github/actions/pnpm-store/action.yml - store-only cache path and key are consistent with the exported store dir; no issues
.github/workflows/kilo-app-ci.yml - diagnostic step removed, resolving the prior finding; no issues

Previous review (commit `d27dce4`)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The new Inspect declaration resolution step in the required typecheck job dereferences a root-level node_modules/@types/react path that does not exist on a clean pnpm install, so it can fail the required check while asserting nothing.

Overview

Severity	Count
CRITICAL	1
WARNING	0
SUGGESTION	0

Issue Details (click to expand)

CRITICAL

File	Line	Issue
`.github/workflows/kilo-app-ci.yml`	121	Diagnostic step calls `fs.realpathSync('node_modules/@types/react')` from the repo root, but `@types/react` is linked under `apps/mobile/node_modules` on a fresh isolated install; the step also asserts nothing and is unrelated to this PR's EAS CLI change.

Files Reviewed (7 files)

.github/workflows/kilo-app-ci.yml - 1 issue
.github/workflows/kilo-app-release.yml - no issues (incremental review; invocation and version alignment verified)
apps/mobile/README.md - no issues
apps/mobile/eas.json - prior cli.version finding re-verified as fixed (24.13.0)
apps/mobile/package.json - prior finding re-verified as fixed
pnpm-workspace.yaml - no issues
pnpm-lock.yaml - generated; consistency spot-checked, no issues

Fix these issues in Kilo Cloud

Previous review (commit `01f65af`)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental change is a short developer-documentation addition explaining how to keep eas-cli and eas.json's cli.version aligned; the earlier version-mismatch finding is confirmed fixed at current HEAD.

Verification Notes

Re-verified the prior finding: apps/mobile/eas.json now declares "cli": { "version": "24.13.0" } and apps/mobile/package.json pins eas-cli at 24.13.0; pnpm-lock.yaml resolves the same version for the apps/mobile importer, so the declaration, manifest, and lockfile agree.
Checked the workflow edit that replaces pnpx eas-cli@24.8.0 with pnpm exec eas: every changed invocation runs with working-directory: apps/mobile after pnpm install --frozen-lockfile, so the local dev dependency resolves; no stale 24.8.0 reference remains.
Checked pnpm-workspace.yaml's added dtrace-provider: false build allowance; it matches the bunyan optional dependency pulled in by eas-cli and no other unlisted build script was introduced.
The merge commit brings base-branch content only; it produces no additional PR-owned diff lines.

Files Reviewed (6 files)

.github/workflows/kilo-app-release.yml - no issues
apps/mobile/README.md - no issues
apps/mobile/eas.json - prior version mismatch resolved
apps/mobile/package.json - no issues
pnpm-workspace.yaml - no issues
pnpm-lock.yaml - generated; checked for consistency with the manifest, no issues

Previous review (commit `88750ad`)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The follow-up commit aligns apps/mobile/eas.json cli.version with the pinned eas-cli 24.13.0, resolving the earlier version-mismatch finding; no new issues were introduced.

Files Reviewed (6 files)

apps/mobile/eas.json - resolves prior mismatch; no issues
.github/workflows/kilo-app-release.yml - no issues
apps/mobile/README.md - no issues
apps/mobile/package.json - no issues
pnpm-workspace.yaml - no issues
pnpm-lock.yaml - generated; checked for consistency with the manifest, no issues

Previous review (commit `9fe5f32`)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The CLI version declared in apps/mobile/eas.json (24.8.0) no longer matches the eas-cli version this PR pins and invokes (24.13.0), which can affect the non-interactive release commands.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
`apps/mobile/package.json`	153	`eas.json` still declares `cli.version` 24.8.0 after the locally installed CLI moves to 24.13.0.

Files Reviewed (5 files)

.github/workflows/kilo-app-release.yml - no issues
apps/mobile/README.md - no issues
apps/mobile/package.json - 1 issue
pnpm-workspace.yaml - no issues
pnpm-lock.yaml - generated; checked for consistency with the manifest, no issues

Fix these issues in Kilo Cloud

_{Reviewed by deepseek-v4.1-flash-1017 · Input: 43.3K · Output: 11.6K · Cached: 599.2K}

_{Review guidance: REVIEW.md from base branch main}

iscekic · 2026-10-19T08:07:10Z

bot: Fixed. The pinned eas-cli devDependency is 24.13.0, so the CLI version declared in eas.json now matches it. Commit pushed.

…e-dep

iscekic · 2026-10-20T16:16:56Z

bot: Reviewed the dependency report. The published @expo/logger, @expo/steps, and @expo/turtle-spawn 24.13.0 archives each include an MIT LICENSE; their package metadata uses a different SPDX label. The ansis and safe-json-stringify archives implement their documented color-formatting and JSON-serialization functions and identify their respective upstream projects. The jks-js diagnostic shown in the report belongs to examples/index.js; its lib entry point accepts caller-supplied data, and the runtime library contains no console calls. No dependency replacement or report suppression is requested.

…e-dep # Conflicts: # pnpm-lock.yaml

iscekic · 2026-10-20T17:39:51Z

bot: Follow-up complete: main is merged, developer instructions include version-maintenance guidance, and the shared CI helper caches the package store. Frozen installation passed locally; EAS reported 24.13.0, the Android build command displayed its help, and 77 release-contract tests passed. A fresh store-only installation also resolved transitive React declarations. Current-head CI is green and the latest code-review summary recommends merge. No store build or submission was started; this change has no visual surface.

…e-dep # Conflicts: # .github/actions/pnpm-store/action.yml

Assert that the mobile manifest, eas.json and the release workflow agree on the workspace CLI, and reject a script or workflow step that calls another binary.

build(mobile): run the EAS CLI from the lockfile

9fe5f32

iscekic added drain Work item from the findings drain janitor:trust Janitor finding: trust boundary hardening labels Oct 19, 2026

kilo-code-bot Bot reviewed Oct 19, 2026

View reviewed changes

Comment thread apps/mobile/package.json

build(mobile): align the EAS CLI version in eas.json with the dependency

88750ad

Merge remote-tracking branch 'origin/main' into drain/eas-cli-lockfil…

4b2dc54

…e-dep

iscekic added the merge:human Substantive functional risk requires human review. label Oct 19, 2026

iscekic enabled auto-merge October 19, 2026 17:46

iscekic disabled auto-merge October 19, 2026 17:55

iscekic changed the title ~~build(mobile): run the EAS CLI from the lockfile~~ build(mobile): align workspace build tooling Oct 20, 2026

iscekic added 3 commits October 20, 2026 16:21

Merge remote-tracking branch 'origin/main' into drain/eas-cli-lockfil…

919e35d

…e-dep # Conflicts: # pnpm-lock.yaml

docs(mobile): describe build tool version maintenance

01f65af

build(mobile): inspect compiler declaration resolution

d27dce4

kilo-code-bot Bot reviewed Oct 20, 2026

View reviewed changes

Comment thread .github/workflows/kilo-app-ci.yml Outdated

build(ci): cache the pnpm package store

3643650

Merge remote-tracking branch 'origin/main' into drain/eas-cli-lockfil…

1e52c2d

…e-dep # Conflicts: # .github/actions/pnpm-store/action.yml

iscekic removed the merge:human Substantive functional risk requires human review. label Oct 20, 2026

test(mobile): check the build tooling names one EAS CLI

99ea8ce

Assert that the mobile manifest, eas.json and the release workflow agree on the workspace CLI, and reject a script or workflow step that calls another binary.

iscekic added the merge:human Substantive functional risk requires human review. label Oct 20, 2026

Conversation

iscekic commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Proxy answers

Uh oh!

socket-security Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

kilo-code-bot Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Executive Summary

Previous review (commit 3643650)

Executive Summary

Verification Notes

Files Reviewed (2 files)

Previous review (commit d27dce4)

Executive Summary

Overview

CRITICAL

Previous review (commit 01f65af)

Executive Summary

Verification Notes

Previous review (commit 88750ad)

Executive Summary

Previous review (commit 9fe5f32)

Executive Summary

Overview

WARNING

Uh oh!

iscekic commented Oct 19, 2026

Uh oh!

iscekic commented Oct 20, 2026

Uh oh!

Uh oh!

iscekic commented Oct 20, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

iscekic commented Oct 19, 2026 •

edited

Loading

socket-security Bot commented Oct 19, 2026 •

edited

Loading

socket-security Bot commented Oct 19, 2026 •

edited

Loading

kilo-code-bot Bot commented Oct 19, 2026 •

edited

Loading

Previous review (commit `3643650`)

Previous review (commit `d27dce4`)

Previous review (commit `01f65af`)

Previous review (commit `88750ad`)

Previous review (commit `9fe5f32`)