ci(example): add Play Store + TestFlight publish workflow, modernize toolchain

[evan-masseau]

Description

Adds an end-to-end "publish example app" workflow that ships the React Native SDK example app to Google Play (internal track) and Apple TestFlight from CI. Bundled with the workflow itself is a round of CI/toolchain modernization that fell out of getting iOS distribution working: Ruby/CocoaPods alignment, Xcode 26 / iOS 26 SDK, Node 24 actions, and a clearer caching strategy on the iOS smoke-test workflow.

Due Diligence

• I have tested this on a simulator/emulator or a physical device, on iOS and Android (if applicable).
• I have added sufficient unit/integration tests of my changes. (Workflow validated end-to-end against the live Play Store and TestFlight; smoke-tested via the existing iOS Build CI on the same toolchain.)
• I am confident these changes are implemented with feature parity across iOS and Android (if applicable).

Release/Versioning Considerations

• Patch Contains internal changes or backwards-compatible bug fixes.

Changelog / Code Overview

New publish workflow — .github/workflows/publish-example.yml

Single workflow with two parallel jobs sharing triggers and shared composite actions:

• deploy-android — Play Store internal track. Preflights the next versionCode via the Play Edits API (no more github.run_number collisions across workflow renames or out-of-CI uploads), builds and signs the AAB with -Pandroid.injected.signing.* so the release lands on the internal track as a single-pass v2/v3-signed bundle.
• deploy-ios — Apple TestFlight. Modern App Store Connect API Key flow only — no .p12 cert, no provisioning profile UUIDs, no ephemeral keychain. Uses xcodebuild -allowProvisioningUpdates for cloud-managed signing against Klaviyo's Distribution Managed cert, JWT-preflights /v1/builds to find the next CFBundleVersion, and uploads via xcrun altool --apiKey.

Triggers

• workflow_dispatch — manual publish (the typical case).
• release: published — keep the example in sync with each SDK release.
• push: branches: [master] — re-publish on merge.
• pull_request: types: [labeled] — adding the deploy-example-app label to a PR builds and publishes that PR's HEAD. A cleanup-label job removes the label after the run completes (success or failure) so re-applying the label re-triggers a fresh publish. Useful for ad-hoc QA builds without merging.

Shared composite actions

• .github/actions/example-publish-prep — verifies KLAVIYO_EXAMPLE_API_KEY is set, writes example/.env for react-native-dotenv. Used by both jobs.
• .github/actions/notify-slack-publish — single Slack notify action with result and platform inputs, replaces four duplicated payload blocks.

Version-bump script — bump-version.sh

Now syncs the example app's user-facing version (example/android/app/build.gradle versionName and example/ios/KlaviyoReactNativeSdkExample.xcodeproj MARKETING_VERSION) with the SDK version. CI-injected build numbers (versionCode / CFBundleVersion) remain per-run via Play / App Store Connect API preflights and aren't touched by the script.

Toolchain modernization

• Ruby + CocoaPods alignment. New example/.ruby-version pins 3.2.1 (rbenv-style, both local and CI honor it). Bump CocoaPods to 1.16.2 in example/Gemfile. setup-ruby with bundler-cache: true runs bundle install --frozen so any Gemfile/Gemfile.lock drift fails the Ruby setup step before pod install.
• Xcode 26 / iOS 26 SDK. Both iOS jobs (ios-build.yml smoke test + publish-example.yml deploy-ios) now run on macos-26 runner with DEVELOPER_DIR=/Applications/Xcode_26.2.app/.... Resolves App Store Connect's ITMS-90725 warning ("must be built with iOS 26 SDK starting 2026-04-28").
• Node 24 actions. All actions/*@v4 references bumped to @v5 (checkout, setup-node, cache, setup-java). Resolves the Node 20 deprecation warning surfaced on every macOS runner.

iOS smoke-test workflow — ios-build.yml

• Explicit Install CocoaPods step before the build, with RCT_NEW_ARCH_ENABLED exported in the shell. This is load-bearing on a fresh runner because @react-native-community/cli's automaticPodsInstallation path detects arch by reading Pods/Pods.xcodeproj/project.pbxproj for a -DRCT_NEW_ARCH_ENABLED=1 flag — but that file doesn't exist until after a successful pod install, so on a fresh checkout the CLI mis-detects legacy arch and hard-codes the env var to '0' in its execa subprocess (overriding any shell export). Running pod install ourselves first populates Pods/ correctly so the build's auto-install becomes a fast no-op (~5–10s, Manifest.lock matches Podfile.lock).
• Pods cache. actions/cache@v5 for example/ios/Pods, keyed on Podfile.lock + Gemfile.lock + .ruby-version + *.podspec + ios/**/*.{swift,h,m,mm}. On a hit, pod install completes in ~2s (existing Pods/ matches lockfile) instead of ~30–60s (fresh CDN download).
• Real GoogleService-Info.plist from the GOOGLE_SERVICE_INFO_PLIST_BASE64 secret, replacing the previous stub. Smoke-test build now matches the publish path.
• Re-run lever. A manual workflow rerun bypasses the cache. Implemented via if: github.run_attempt == 1 on the turbo probe step, plus --force passed to turbo on the build step when github.run_attempt > 1. Previous version of this lever skipped the probe but the build still hit the cache, making it a no-op for rerun.

Apple Team ID handling

Klaviyo's Apple Team ID was previously hardcoded in workflow YAML. Now sourced from the new APPLE_TEAM_ID secret and stamped into ExportOptions.plist at build time via PlistBuddy. The checked-in plist uses an APPLE_TEAM_ID_PLACEHOLDER value.

Required Secrets

Wire up in Settings → Secrets and variables → Actions before either job will succeed.

Shared

Secret	Description
KLAVIYO_EXAMPLE_API_KEY	Klaviyo public API key — written into example/.env at build time. Workflow fails with a clear message if unset.
SLACK_WEBHOOK_URL	Incoming webhook URL for Slack notifications.
APPLE_TEAM_ID	Klaviyo's Apple Developer Team ID (stamped into ExportOptions.plist and passed as DEVELOPMENT_TEAM).

Android

Secret	Description
GOOGLE_SERVICES_JSON	Plain-text contents of google-services.json for Firebase.
SIGNING_KEY	Base64-encoded release keystore (Play App Signing upload key).
ALIAS	Key alias in the keystore.
KEY_STORE_PASSWORD	Keystore password.
KEY_PASSWORD	Key password.
SERVICE_ACCOUNT_JSON	Google Play service account JSON (plain text).

iOS

Secret	Description
APP_STORE_CONNECT_API_KEY_ID	10-char alphanumeric Key ID from App Store Connect → Users and Access → Integrations → Team Keys.
APP_STORE_CONNECT_API_KEY_ISSUER_ID	UUID at the top of the same Team Keys page.
APP_STORE_CONNECT_API_KEY_BASE64	Base64-encoded contents of the .p8 private key file. Key must be generated with Admin role so it has "Access to Cloud Managed Distribution Certificate"; App Manager alone fails exportArchive with "Cloud signing permission error".
GOOGLE_SERVICE_INFO_PLIST_BASE64	Base64-encoded GoogleService-Info.plist for the iOS Firebase app for com.klaviyoreactnativesdkexample.

Test Plan

• Trigger workflow_dispatch and confirm the AAB lands on the Play Store internal track in Draft status.
• Confirm a TestFlight build appears in App Store Connect for the iOS bundle ID, signed by the Distribution Managed cert.
• Confirm Slack notifications fire on both success and failure paths.
• iOS Build CI (smoke test) on macos-26 + Xcode 26.2 + Ruby 3.2.1 + CocoaPods 1.16.2 passes for both new and old architecture matrix slices.
• bump-version.sh -v X.Y.Z updates versionName (Android) and MARKETING_VERSION (iOS) in addition to the SDK version files.
• Add the deploy-example-app label to a PR (post-merge) and confirm the workflow fires, both deploys run, and the label is auto-removed when the run finishes.

Related Issues/Tickets

Part of MAGE-464

🤖 Generated with Claude Code

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7f6e898. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 46f7620. Configure here.}