How to reliably trigger EAS builds via GitHub Actions using EXPO_TOKEN

·1 views

Developers using Expo's EAS Build service can automate builds through GitHub Actions, but only after completing a successful local build that sets up credentials, project IDs, and build profiles. The local EAS CLI run is a mandatory prerequisite, as it creates the Android keystore, iOS certificates, and provisioning profiles that CI jobs depend on in non-interactive mode. Authentication on CI requires a personal Expo access token stored as the repository secret EXPO_TOKEN, which must be passed to the expo/expo-github-action step so all subsequent commands inherit authorization. The official workflow uses Actions checkout v5, Node 24, and the eas build --platform all --non-interactive --no-wait command to dispatch remote builds without blocking the runner. Build-time environment variables should be managed through EAS server-side profiles rather than GitHub Actions env entries, since those variables never reach the remote EAS builder.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds 3.3MB Windows AI desktop app using WebView2, ditching Electron bloat

A developer has created LeadHunter AI Desk, a native Windows desktop application for AI-powered B2B cold email outreach that weighs just 3.3MB and launches in under 0.2 seconds. The app was built using VisualNEO Win, a RAD environment that compiles to native Win32 executables, and leverages Microsoft Edge WebView2 — already bundled with Windows 10 and 11 — to render a Tailwind CSS dark-mode interface without shipping a Chromium runtime. This approach cuts idle RAM usage to approximately 35MB, compared to 500–600MB for a typical Electron-based equivalent. The app follows a bring-your-own-key model via OpenRouter, supporting LLMs such as DeepSeek V3 and Claude 3.5 Sonnet, with the developer estimating that generating 1,000 personalized emails costs around $0.04 in API credits. The project is released as free and open-source software, positioning itself as a lightweight alternative to SaaS outreach tools that typically cost $49–$99 per month.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Developer Used CI and a Single Source of Truth to Keep OSS Translations Fresh

A developer working on PSXRecompStudio identified a common problem in multilingual open-source projects: translated documentation quickly falls out of sync with the original, leaving readers and AI tools unsure which version is current. To address this, they designated English documents as the canonical source of truth and stored the mapping between originals and translations in a JSON config file. Continuous integration checks then automatically detect when a translation has not been updated to reflect changes in the canonical file, making staleness a visible build-time failure rather than a manual oversight. Each translated document is also required to include a clear link back to its canonical counterpart, establishing an explicit hierarchy of authority. The approach applies standard software-engineering principles — defined ownership, machine-readable relationships, and automated validation — to documentation maintenance.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

RBAC Misconfiguration in EKS Lets Attackers Hijack Kubernetes Webhooks

A security analysis highlights how overly broad RBAC permissions on Kubernetes admission webhooks can give attackers near-total control over a cluster. Mutating webhooks intercept every API call before it is committed, allowing malicious actors to inject sidecars, alter pod specs, or exfiltrate data silently. The vulnerability typically arises when operators like Argo CD or Cert Manager are granted unrestricted write access to MutatingWebhookConfigurations, rather than being scoped to a specific named resource. An attacker who compromises any workload with access to the operator's ServiceAccount token can inherit these permissions and register their own webhook. Setting failurePolicy to Ignore further conceals the attack, as the webhook remains invisible during downtime while staying silently active during normal cluster operation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Finds AI-Generated Invoice Samples Were Largely Fictional XML Files

A developer building a parser for Vietnamese electronic invoices asked an AI assistant to supply six sample XML files from real providers, but five of the six turned out to be fabricated test fixtures sourced from an unrelated GitHub project. Vietnam's tax authority legally mandates that all e-invoice providers use identical XML tag names since 2022, yet the AI-supplied files used invented English tags that no compliant invoice would ever contain. The parser correctly rejected all five non-compliant files, and the developer chose not to patch it to accept the fictional formats. When real invoice files were later sourced directly from email inboxes and provider portals, three genuine bugs emerged that none of the AI-generated samples had exposed. The episode highlights how AI tools can confidently surface plausible-looking but factually wrong data, and why validating against authoritative real-world sources remains essential.

0 comments Read more at DEV Community