Prod Release Sprint 151 — KYC verdict rendering · Solana/Tron/Base withdrawals · profile fixes (2026-07-16)

.coderabbit.yaml

@@ -0,0 +1,9 @@
+# CodeRabbit review scope. Generated native scaffolding (Xcode/Gradle
+# projects, plists, resources) isn't worth AI review and pushes large
+# mobile PRs over the 150-file review limit.
+reviews:
+    path_filters:
+        - '!ios/**'
+        - '!android/**'
+        - '!patches/**'
+        - '!**/*.svg'

.github/workflows/android-release.yml

@@ -0,0 +1,159 @@
+name: Android Release (Play)
+
+# Builds a SIGNED Android App Bundle and uploads it to Google Play.
+# Removes the "release only builds on one laptop" gap: the upload keystore lives
+# as CI secrets, the build is reproducible, and the AAB lands on a Play track.
+#
+# Trigger: push a tag `vX.Y.Z`, or run manually (workflow_dispatch) and pick a track.
+# Prereq: fix/native-build-reliability must be merged (card-comparison static-export
+#         fix) or `native:release` will fail to build.
+#
+# Required repo secrets (see docs/NATIVE-RELEASE.md §Ops):
+#   ANDROID_KEYSTORE_BASE64      base64 of the upload keystore
+#   ANDROID_KEYSTORE_PASSWORD    store password
+#   ANDROID_KEY_ALIAS            key alias (e.g. peanut)
+#   ANDROID_KEY_PASSWORD         key password
+#   PLAY_SERVICE_ACCOUNT_JSON    Google Play Developer API service-account JSON
+#   SUBMODULE_TOKEN              read access to the src/content submodule
+# Plus the production NEXT_PUBLIC_* the static export bakes in (see the env step).
+
+on:
+    push:
+        tags: ['v*']
+    workflow_dispatch:
+        inputs:
+            track:
+                description: 'Play track'
+                required: true
+                default: 'internal'
+                type: choice
+                options: [internal, alpha, beta, production]
+            versionName:
+                description: 'versionName override (optional; defaults to package.json)'
+                required: false
+                type: string
+
+permissions:
+    contents: read
+
+concurrency:
+    group: android-release-${{ github.ref }}
+    cancel-in-progress: false
+
+jobs:
+    release:
+        runs-on: ubuntu-latest
+        # Protect with required reviewers in repo Settings → Environments → Production.
+        environment: Production
+        steps:
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+              with:
+                  submodules: recursive
+                  token: ${{ secrets.SUBMODULE_TOKEN }}
+
+            - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+
+            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+              with:
+                  node-version: '22' # @sentry/profiling-node has no Node 25 binary; project targets 22
+                  cache: 'pnpm'
+
+            - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+              with:
+                  distribution: 'temurin'
+                  java-version: '21' # Capacitor 8's capacitor-android compiles at source 21
+
+            - name: Install dependencies
+              run: pnpm install
+
+            - name: Decode upload keystore
+              env:
+                  ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+                  ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+                  ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+                  ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+              run: |
+                  echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > android/peanut-release.keystore
+                  cat > android/keystore.properties <<EOF
+                  storeFile=../peanut-release.keystore
+                  storePassword=${ANDROID_KEYSTORE_PASSWORD}
+                  keyAlias=${ANDROID_KEY_ALIAS}
+                  keyPassword=${ANDROID_KEY_PASSWORD}
+                  EOF
+
+            - name: Production web env
+              run: |
+                  # NEXT_PUBLIC_* values are baked into the static export at build time.
+                  # rpId MUST be peanut.me (passkeys + assetlinks/AASA).
+                  # Keep this block identical to ios-release.yml. CAPACITOR_BUILD /
+                  # IS_NATIVE_BUILD / GIT_COMMIT_HASH are auto-baked by next.config.native.js.
+                  cat > .env.production.local <<EOF
+                  NEXT_PUBLIC_BASE_URL=https://peanut.me
+                  NEXT_PUBLIC_PEANUT_API_URL=${{ vars.NEXT_PUBLIC_PEANUT_API_URL }}
+                  NEXT_PUBLIC_NATIVE_RP_ID=peanut.me
+                  NEXT_PUBLIC_ZERO_DEV_BUNDLER_URL=${{ secrets.NEXT_PUBLIC_ZERO_DEV_BUNDLER_URL }}
+                  NEXT_PUBLIC_ZERO_DEV_PAYMASTER_URL=${{ secrets.NEXT_PUBLIC_ZERO_DEV_PAYMASTER_URL }}
+                  NEXT_PUBLIC_ZERO_DEV_PASSKEY_PROJECT_ID=${{ secrets.NEXT_PUBLIC_ZERO_DEV_PASSKEY_PROJECT_ID }}
+                  NEXT_PUBLIC_ZERO_DEV_RECOVERY_BUNDLER_URL=${{ secrets.NEXT_PUBLIC_ZERO_DEV_RECOVERY_BUNDLER_URL }}
+                  NEXT_PUBLIC_JUSTANAME_ENS_DOMAIN=peanut.me
+                  NEXT_PUBLIC_SENTRY_DSN=${{ secrets.NEXT_PUBLIC_SENTRY_DSN }}
+                  NEXT_PUBLIC_POSTHOG_KEY=${{ secrets.NEXT_PUBLIC_POSTHOG_KEY }}
+                  NEXT_PUBLIC_POSTHOG_HOST=${{ vars.NEXT_PUBLIC_POSTHOG_HOST }}
+                  NEXT_PUBLIC_GA_KEY=${{ vars.NEXT_PUBLIC_GA_KEY }}
+                  NEXT_PUBLIC_ONESIGNAL_APP_ID=${{ secrets.NEXT_PUBLIC_ONESIGNAL_APP_ID }}
+                  NEXT_PUBLIC_SAFARI_WEB_ID=${{ vars.NEXT_PUBLIC_SAFARI_WEB_ID }}
+                  NEXT_PUBLIC_ONESIGNAL_WEBHOOK=${{ vars.NEXT_PUBLIC_ONESIGNAL_WEBHOOK }}
+                  EOF
+
+            - name: Decode google-services.json
+              # FCM credentials for native push. When the secret is unset the file
+              # is skipped and build.gradle simply omits the google-services plugin
+              # (push disabled, build still succeeds).
+              env:
+                  ANDROID_GOOGLE_SERVICES_JSON: ${{ secrets.ANDROID_GOOGLE_SERVICES_JSON }}
+              run: |
+                  if [ -n "$ANDROID_GOOGLE_SERVICES_JSON" ]; then
+                      echo "$ANDROID_GOOGLE_SERVICES_JSON" | base64 -d > android/app/google-services.json
+                      echo "✅ google-services.json written"
+                  else
+                      echo "⚠️  ANDROID_GOOGLE_SERVICES_JSON unset — native push disabled for this build"
+                  fi
+
+            - name: Build signed AAB
+              run: |
+                  # versionName: manual dispatch input wins; else the tag name minus
+                  # its leading 'v' (v1.0.10 -> 1.0.10); else build.gradle's
+                  # package.json fallback. Keeps the Play versionName in lockstep
+                  # with the release tag without a manual package.json bump.
+                  VERSION_NAME="${{ github.event.inputs.versionName }}"
+                  if [ -z "$VERSION_NAME" ] && [ "$GITHUB_REF_TYPE" = "tag" ]; then
+                      VERSION_NAME="${GITHUB_REF_NAME#v}"
+                  fi
+                  export ANDROID_VERSION_NAME="$VERSION_NAME"
+                  # Monotonic (run_number always increases). +10000 clears legacy
+                  # codes already on Play from earlier manual/local uploads (small
+                  # console codes plus git-commit-count builds up to ~8600).
+                  export ANDROID_VERSION_CODE=$((10000 + GITHUB_RUN_NUMBER))
+                  pnpm native:release
+
+            - name: Upload to Google Play
+              uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1
+              with:
+                  serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+                  packageName: me.peanut.wallet
+                  releaseFiles: android/app/build/outputs/bundle/release/app-release.aab
+                  tracks: ${{ github.event.inputs.track || 'internal' }}
+                  status: completed
+                  # First releases have no reviewed base, so Play can't auto-submit
+                  # for review; commit the edit and review from the Console instead.
+                  changesNotSentForReview: true
+                  # Staged production rollout: set status: inProgress + userFraction: 0.1,
+                  # then promote in Play Console once crash/error rates look clean.
+
+            - name: Upload AAB as build artifact
+              if: always()
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+              with:
+                  name: app-release-aab
+                  path: android/app/build/outputs/bundle/release/app-release.aab
+                  if-no-files-found: warn

.github/workflows/capgo-deploy-ios.yml

@@ -0,0 +1,92 @@
+name: Deploy OTA Update — iOS only (Capgo)
+
+# iOS-only OTA for the mobile-release branch. Uploads the JS bundle to a
+# dedicated iOS channel so Android (which lives on the `production`/`staging`
+# channels) is never affected. Devices must be subscribed to this channel to
+# receive it (self-assign enabled below), so this is a testing/preview lane —
+# not a push to all production iOS users.
+
+on:
+    push:
+        branches: [feat/mobile-release]
+    workflow_dispatch:
+        inputs:
+            channel:
+                description: 'iOS Capgo channel to deploy to'
+                required: true
+                default: 'ios-mobile-release'
+                type: string
+
+permissions:
+    contents: read
+
+concurrency:
+    group: capgo-deploy-ios-${{ github.ref }}
+    cancel-in-progress: true
+
+jobs:
+    deploy:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v7
+              with:
+                  submodules: true
+                  token: ${{ secrets.SUBMODULE_TOKEN }}
+
+            - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+
+            - uses: actions/setup-node@v6
+              with:
+                  node-version: '20'
+                  cache: 'pnpm'
+
+            - name: Install dependencies
+              run: pnpm install
+
+            - name: Build native static export
+              run: node scripts/native-build.js
+
+            - name: Verify build output
+              run: |
+                  test -d out && test -f out/index.html || (echo "ERROR: out/ directory missing or incomplete" && exit 1)
+                  echo "Bundle ready. File count: $(find out -type f | wc -l)"
+
+            - name: Resolve channel
+              id: channel
+              run: echo "name=${{ github.event.inputs.channel || 'ios-mobile-release' }}" >> "$GITHUB_OUTPUT"
+
+            # Best-effort: create the channel and lock it to iOS. Idempotent and
+            # non-fatal — if the channel already exists / flags differ, the upload
+            # below still runs and the channel's platform can be set once in the
+            # Capgo dashboard (iOS on, Android off, self-assign on).
+            - name: Ensure iOS-only channel exists
+              continue-on-error: true
+              run: |
+                  npx @capgo/cli@latest channel add ${{ steps.channel.outputs.name }} \
+                    --apikey ${{ secrets.CAPGO_API_KEY }} || true
+                  npx @capgo/cli@latest channel set ${{ steps.channel.outputs.name }} \
+                    --apikey ${{ secrets.CAPGO_API_KEY }} \
+                    --ios --no-android --self-assign
+
+            - name: Upload iOS bundle to Capgo
+              # Pass the commit message via env, never inline — a multi-line message
+              # (or one containing quotes) injected into the run script breaks the
+              # --comment quoting and spills into positional args. Use its first line.
+              env:
+                  CAPGO_API_KEY: ${{ secrets.CAPGO_API_KEY }}
+                  COMMIT_MSG: ${{ github.event.head_commit.message }}
+              run: |
+                  COMMENT="iOS OTA ${GITHUB_SHA:0:7} — $(printf '%s' "${COMMIT_MSG:-manual deploy}" | head -n1)"
+                  npx @capgo/cli@latest bundle upload \
+                    --channel "${{ steps.channel.outputs.name }}" \
+                    --apikey "$CAPGO_API_KEY" \
+                    --path ./out \
+                    --auto-min-update-version \
+                    --comment "$COMMENT"
+
+            - name: Deployment summary
+              run: |
+                  echo "## iOS-only OTA Deployment" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Channel:** ${{ steps.channel.outputs.name }} (iOS only)" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Commit:** ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Branch:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY

.github/workflows/capgo-deploy.yml

@@ -1,8 +1,11 @@
 name: Deploy OTA Update (Capgo)
 
 on:
+    # Only `dev` auto-ships (→ staging channel). Production is workflow_dispatch-only
+    # and gated by the Production environment's required reviewers, so a merge to
+    # `main` can never push OTA JS to devices without an explicit approved run.
     push:
-        branches: [main, dev]
+        branches: [dev]
     workflow_dispatch:
         inputs:
             channel:
@@ -15,26 +18,32 @@ on:
                     - staging
                     - production
 
+permissions:
+    contents: read
+
 concurrency:
     group: capgo-deploy-${{ github.ref }}
     cancel-in-progress: true
 
 jobs:
     deploy:
         runs-on: ubuntu-latest
+        # Gate ONLY the production deploy behind the Production environment (required
+        # reviewers, set in repo Settings → Environments → Production). Resolving to an
+        # empty string means no environment, so the dev→staging auto-push is never
+        # paused for approval. Production is reachable only via workflow_dispatch.
+        environment: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.channel == 'production') && 'Production' || '' }}
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v7
               with:
                   submodules: true
                   token: ${{ secrets.SUBMODULE_TOKEN }}
 
-            - uses: pnpm/action-setup@v4
-              with:
-                  version: 10
+            - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
-            - uses: actions/setup-node@v4
+            - uses: actions/setup-node@v6
               with:
-                  node-version: '21.1.0'
+                  node-version: '20'
                   cache: 'pnpm'
 
             - name: Install dependencies
@@ -60,13 +69,24 @@ jobs:
                   fi
 
             - name: Upload bundle to Capgo
+              # Commit message via env, never inline — a multi-line message (or one
+              # with quotes) injected into the run script breaks --comment quoting.
+              env:
+                  CAPGO_API_KEY: ${{ secrets.CAPGO_API_KEY }}
+                  # Private E2E signing key (PEM contents of .capgo_key_v2). Its
+                  # public half is baked into capacitor.config.ts, so the app only
+                  # accepts bundles signed here.
+                  CAPGO_PRIVATE_KEY: ${{ secrets.CAPGO_PRIVATE_KEY }}
+                  COMMIT_MSG: ${{ github.event.head_commit.message }}
               run: |
+                  COMMENT="${GITHUB_SHA:0:7} — $(printf '%s' "${COMMIT_MSG:-Manual deploy}" | head -n1)"
                   npx @capgo/cli@latest bundle upload \
-                    --channel ${{ steps.channel.outputs.name }} \
-                    --apikey ${{ secrets.CAPGO_API_KEY }} \
+                    --channel "${{ steps.channel.outputs.name }}" \
+                    --apikey "$CAPGO_API_KEY" \
+                    --key-data-v2 "$CAPGO_PRIVATE_KEY" \
                     --path ./out \
                     --auto-min-update-version \
-                    --comment "${{ github.event.head_commit.message || 'Manual deploy' }}"
+                    --comment "$COMMENT"
 
             - name: Deployment summary
               run: |

.github/workflows/code-analysis.yml

@@ -46,8 +46,6 @@ jobs:
                   submodules: false
 
             - uses: pnpm/action-setup@v4
-              with:
-                  version: 10
 
             - uses: actions/setup-node@v4
               with: