From e1534d50ab0e1798fc32d92fafddb9f6d634ac93 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Mon, 18 May 2026 14:50:29 -0400
Subject: [PATCH] Add mobile CI job and iOS CD workflow (disabled)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CI: adds mobile typecheck job on PRs.
CD: deploy-mobile.yaml builds and uploads to TestFlight via
Fastlane on a macOS runner with OIDC auth for match S3 access.
Currently workflow_dispatch only — activate for V1 release.
---
 .github/workflows/ci.yaml            | 18 +++++++++
 .github/workflows/deploy-mobile.yaml | 55 ++++++++++++++++++++++++++++
 2 files changed, 73 insertions(+)
 create mode 100644 .github/workflows/deploy-mobile.yaml

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index ddb5e2a..b7c4f16 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -57,6 +57,24 @@ jobs:
       - run: ruff check lambdas/
       - run: ruff format --check lambdas/
 
+  mobile:
+    name: Mobile Typecheck
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: mobile
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: mobile/package-lock.json
+
+      - run: npm ci
+      - run: npx tsc --noEmit
+
   infra:
     name: CDK Synth
     runs-on: ubuntu-latest
diff --git a/.github/workflows/deploy-mobile.yaml b/.github/workflows/deploy-mobile.yaml
new file mode 100644
index 0000000..94fd1eb
--- /dev/null
+++ b/.github/workflows/deploy-mobile.yaml
@@ -0,0 +1,55 @@
+name: Deploy Mobile (iOS)
+
+# Disabled during development. To activate for V1 release, change to:
+#   on:
+#     push:
+#       branches: [main]
+#       paths: ["mobile/**"]
+on:
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  deploy-ios:
+    name: Build & Upload to TestFlight
+    runs-on: macos-latest
+    defaults:
+      run:
+        working-directory: mobile
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+          aws-region: us-east-1
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: mobile/package-lock.json
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.3"
+          bundler-cache: true
+          working-directory: mobile
+
+      - name: Install JS dependencies
+        run: npm ci
+
+      - name: Install CocoaPods
+        run: bundle exec pod install --project-directory=ios
+
+      - name: Build and upload to TestFlight
+        run: bundle exec fastlane ios beta
+        env:
+          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+          ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+          ASC_KEY_CONTENT: ${{ secrets.ASC_KEY_CONTENT }}