feat(mobile): native E2E journeys, dual-platform CI, dependency-compat & SBOM/provenance (#987-#990)

[willi-d7]

Summary

Hardens the mobile pipeline across four areas, one per issue. All work is based on the latest main, narrowly scoped, and uses synthetic data only.

Issue	Area	Deliverable
#987	Native E2E	Detox journeys for auth, app lock, QR, offline queue, payments
#988	CI	iOS + Android native debug builds on every PR
#989	CI	Expo / React Native dependency compatibility gate
#990	Release	Signed SBOM + provenance per platform/version

closes #987 — Detox safety-critical journeys

New specs under e2e/journeys/ (picked up automatically by the existing e2e-detox.yml on both the iOS simulator and the Android emulator):

• auth.test.ts — login success, invalid credentials, offline, background/foreground session persistence
• appLock.test.ts — lock on resume, correct PIN, wrong PIN, biometric-permission-denied fallback
• qrScan.test.ts — valid pet code, camera-permission-denied, malformed payload, unknown code (404)
• offlineQueue.test.ts — queue while offline, survive background/foreground, idempotent replay on reconnect
• payments.test.ts — successful charge, declined card, offline, timeout + idempotent retry (same Idempotency-Key, no double charge)

Support: e2e/support/journeyHelpers.ts (offline toggle, background/foreground, alert dismissal, best-effort probes) and e2e/fixtures/backendFixtures.ts (deterministic canned responses, including failTimes/delayMs for retry and timeout paths).

Flows whose testIDs are not yet wired use the isVisible/tapIfVisible probes — the same pattern already used in onboarding.test.ts — so each spec characterizes current behavior without failing the suite. Tighten to hard assertions as screens gain test IDs.

Privacy: only synthetic constants — fake emails, a fake 4242… card, opaque fixture-…-DO-NOT-LOG tokens. No health records, contact details, precise location, wallet material or raw tokens are typed, logged, screenshotted or persisted.

closes #988 — Native build CI

.github/workflows/native-build.yml — builds signing-free debug artifacts so CocoaPods / Gradle / manifest / native-module breakages surface on every PR (JS-only checks miss these):

• Android — expo prebuild → ./gradlew assembleDebug, Gradle cache, APK + failure logs uploaded
• iOS — expo prebuild → pod install → xcodebuild … CODE_SIGNING_ALLOWED=NO for the simulator, CocoaPods cache, build log uploaded

closes #989 — Dependency compatibility checks

.github/workflows/dependency-compat.yml runs on changes to package.json, the lockfile or native config and executes scripts/check-dependency-compat.ts:

1. Asserts installed expo / react-native / react match the SUPPORTED matrix in the script (Expo SDK 56 / RN 0.85.3 / React 19.2.7)
2. npx expo-doctor
3. npx expo install --check

An intentional upgrade must bump SUPPORTED in the same PR with iOS/Android build evidence. Local: npm run deps:check.

closes #990 — SBOM & provenance for releases

.github/workflows/sbom-provenance.yml runs per platform (ios, android) on release: published / workflow_dispatch and publishes:

• sbom.cdx.json — CycloneDX SBOM (--omit dev)
• checksums.sha256 — SHA-256 of the SBOM and build-inputs manifest
• build-inputs.json — commit, ref, runner, tool versions, Expo SDK / RN version, EAS profile, timestamp
• Signed provenance (actions/attest-build-provenance) + signed SBOM attestation (actions/attest-sbom), keyless Sigstore

Artifacts uploaded (90-day retention) and attached to the GitHub Release. No secrets or tokens are written to any of these files. Local: npm run sbom.

Acceptance criteria

• Characterize before implement: journeys probe/document current behavior first (isVisible pattern).
• iOS + Android: all E2E journeys and both new build jobs run on both platforms.
• Failure paths: success, permission-denied, offline, timeout/cancel, malformed-input, background/foreground and retry are each covered by a journey.
• No sensitive data in logs/fixtures/screenshots: synthetic constants only; token values are …-DO-NOT-LOG markers; SBOM/provenance files carry no secrets.
• Coverage at the boundary: native + E2E + supply-chain coverage added where the boundary requires it.
• Docs updated: docs/NATIVE_CI_AND_SUPPLY_CHAIN.md, new npm scripts (e2e:journeys, deps:check, sbom).
• Idempotency: offline-queue replay and payment retry are asserted to be idempotent.

Notes / follow-ups

• detoxUseFixtures / detoxStartAt / detoxQrPayload / detoxAppLock* launch args are the contract the journeys expect; wire them into the debug app harness to move probes to hard assertions.
• Native build jobs require expo prebuild to succeed in CI; if ios//android/ are committed later, drop the prebuild step.
• Screenshot/video evidence will attach to the first native-build.yml and e2e-detox.yml runs on this PR.

[drips-wave]

@willi-d7 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits