From bebeab319139dc22e1ccaff5f284bbb80942138e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 16 Mar 2026 15:55:36 +0000
Subject: [PATCH] ci(mobile): add path filter and auto-submit to Apple for EAS
 workflow

- Add paths filter so builds only trigger when mobile/ files change
- Add submit_ios job to automatically submit iOS builds to App Store Connect
- Update docs/MobileApp.md and mobile/README.md with CI/CD documentation

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 docs/MobileApp.md                       | 10 ++++++++++
 mobile/.eas/workflows/create-builds.yml | 11 ++++++++++-
 mobile/README.md                        | 10 ++++++++++
 3 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/docs/MobileApp.md b/docs/MobileApp.md
index 2d697c98..44b9431c 100644
--- a/docs/MobileApp.md
+++ b/docs/MobileApp.md
@@ -57,6 +57,16 @@ eas build --platform android
 
 See the [EAS Build documentation](https://docs.expo.dev/build/introduction/) for full setup instructions.
 
+## Automated CI/CD
+
+An **EAS Cloud Workflow** (`mobile/.eas/workflows/create-builds.yml`) automates production builds and iOS submission:
+
+- **Path filtering:** The workflow only triggers on pushes to `main` that include changes inside the `mobile/` directory.  Backend-only or documentation-only changes do not trigger a mobile build.
+- **Build:** Both iOS and Android production builds run in parallel on EAS Build.
+- **Auto-submit (iOS):** After a successful iOS build, the workflow automatically submits the binary to **App Store Connect** using the credentials configured in `eas.json` (`submit.production.ios`).  The build then appears in **TestFlight** for internal testing and can be promoted to the App Store from App Store Connect.
+
+> **Prerequisite:** An App Store Connect API Key must be configured in EAS for non-interactive submission.  See [Troubleshooting → "Session expired"](#session-expired-local-session-during-ios-build) below for setup instructions.
+
 ## Authentication
 
 ### SSO Login Flow
diff --git a/mobile/.eas/workflows/create-builds.yml b/mobile/.eas/workflows/create-builds.yml
index e3cbdff6..7ed8ff50 100644
--- a/mobile/.eas/workflows/create-builds.yml
+++ b/mobile/.eas/workflows/create-builds.yml
@@ -1,9 +1,11 @@
-name: Create builds
+name: Build and submit
 
 on:
   push:
     branches:
       - main
+    paths:
+      - mobile/**
 
 jobs:
   build_android:
@@ -27,3 +29,10 @@ jobs:
     params:
       platform: ios
       profile: production
+
+  submit_ios:
+    name: Submit iOS to App Store Connect
+    needs: [build_ios]
+    type: submit
+    params:
+      build_id: ${{ needs.build_ios.outputs.build_id }}
diff --git a/mobile/README.md b/mobile/README.md
index 03ec4b3d..075f9e24 100644
--- a/mobile/README.md
+++ b/mobile/README.md
@@ -78,6 +78,16 @@ eas build --platform all
 - The app runs and bundles correctly without `google-services.json`; only Android push notifications will be unavailable
 - For Play Store submission: create a service account in Google Play Console, download the JSON key as `google-play-service-account.json`, and update `eas.json`
 
+## CI/CD
+
+An EAS Cloud Workflow (`mobile/.eas/workflows/create-builds.yml`) runs automatically when changes inside `mobile/` are pushed to `main`:
+
+1. **Path filtering** — only commits that modify files under `mobile/` trigger a build; backend-only changes are skipped.
+2. **Parallel builds** — iOS and Android production builds run at the same time on EAS Build.
+3. **Auto-submit to Apple** — after the iOS build succeeds, the workflow submits the binary to App Store Connect (TestFlight) using the credentials in `eas.json` → `submit.production.ios`.
+
+> An [App Store Connect API Key](https://docs.expo.dev/app-signing/app-credentials/#app-store-connect-api-key) must be configured in EAS (`eas credentials`) for non-interactive submission.
+
 ## Configuration
 
 No code changes are needed to point the app at a different server.  The server URL is entered by the user on the login screen and stored in the device's secure store.