mirror of
https://github.com/Sea-Haven-Industries/proposal-system.git
synced 2026-09-30 19:23:15 +00:00
fcdc46c136
INF-M5: Add enforceSSL: true to all S3 buckets (uploads, generated, library, web site) to require HTTPS-only access via bucket policy. INF-M8: Pin all reusable GitHub Actions workflow references from @main to commit SHA c040bfaa for supply chain security.
30 lines
849 B
YAML
30 lines
849 B
YAML
name: Deploy Mobile (iOS)
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths: ["mobile/**"]
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: deploy-mobile
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
id-token: write
|
|
contents: read
|
|
|
|
jobs:
|
|
deploy-ios:
|
|
name: Build & Upload to TestFlight
|
|
# Fix: INF-M8 — pin to SHA for supply chain security (cd-mobile-ios.yaml@main)
|
|
uses: Sea-Haven-Industries/.github/.github/workflows/cd-mobile-ios.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
|
|
with:
|
|
working-directory: mobile
|
|
cache-dependency-path: mobile/package-lock.json
|
|
secrets:
|
|
deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
|
|
match-password: ${{ secrets.MATCH_PASSWORD }}
|
|
asc-key-id: ${{ secrets.ASC_KEY_ID }}
|
|
asc-issuer-id: ${{ secrets.ASC_ISSUER_ID }}
|
|
asc-key-content: ${{ secrets.ASC_KEY_CONTENT }}
|