chore: enforce tests in CI, fix lint setup, enable React Compiler

- CI never ran the test suite. build-android.yml only fires on release and
  only typechecked, so 275 tests were enforced by nothing. Adds ci.yml
  (typecheck + lint + test on push and PR) and a test step gating the
  release build.
- `bun run lint` was broken: eslint.config.js existed but eslint was not a
  dependency at all. Installs it (pinned to 9.x - eslint 10 breaks
  eslint-plugin-react inside eslint-config-expo), gives electron/ its Node
  globals, and drops the redundant android/ios ignores.
- build:android called `eas build` but there is no eas.json and no EAS
  project configured, so the script could never work. Replaced with the
  gradle path the CI workflow already uses.
- release_tag, a workflow_dispatch input, was interpolated straight into a
  shell script. Passed through the environment instead.
- React Compiler enabled. The one unsafe read it would have frozen (module
  state read during render in SendSheet) was fixed first.
- Android package renamed to in.fairco.walletapp, with google-services
  package_name kept in step or the Google Services plugin fails the build.
  Note this makes it a different app to Android: existing installs of
  in.fairco.wallet do not migrate their wallet data, and the Firebase
  project needs the new package registered before push works again.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: NateIsern

.github/workflows/build-android.yml

@@ -45,6 +45,9 @@ jobs:
       - name: Typecheck
         run: bunx tsc --noEmit
 
+      - name: Test
+        run: bun test src
+
       - name: Prebuild Android project
         run: bunx expo prebuild --platform android --clean
 
@@ -57,8 +60,12 @@ jobs:
             -Dorg.gradle.parallel=true
 
       - name: Collect and rename APKs
+        # `release_tag` is attacker-controllable workflow_dispatch input: pass it
+        # through the environment instead of interpolating it into the script.
+        env:
+          RELEASE_TAG: ${{ github.event.inputs.release_tag }}
         run: |
-          VERSION="${GITHUB_REF_NAME:-${{ github.event.inputs.release_tag || 'dev' }}}"
+          VERSION="${GITHUB_REF_NAME:-${RELEASE_TAG:-dev}}"
           mkdir -p apk-output
           for apk in $(find android/app/build/outputs/apk/release -name "*.apk"); do
             filename=$(basename "$apk")

.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  verify:
+    name: Typecheck, lint and test
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Typecheck
+        run: bun run typecheck
+
+      - name: Lint
+        run: bun run lint
+
+      - name: Test
+        run: bun test src

.gitignore

@@ -7,7 +7,6 @@ ios/
 *.tsbuildinfo
 *.log
 .DS_Store
-bun.lock
 
 # Electron build output
 electron/dist/

app.json

@@ -25,7 +25,7 @@
         "backgroundColor": "#1b1e09"
       },
       "predictiveBackGestureEnabled": true,
-      "package": "in.fairco.wallet",
+      "package": "in.fairco.walletapp",
       "googleServicesFile": "./google-services.json",
       "intentFilters": [
         {
@@ -72,6 +72,13 @@
           "cameraPermission": "FAIRWallet needs camera access to scan QR codes."
         }
       ],
+      [
+        "expo-image-picker",
+        {
+          "photosPermission": "FAIRWallet needs photo access to set a Pocket image.",
+          "cameraPermission": "FAIRWallet needs camera access to take a Pocket photo."
+        }
+      ],
       [
         "expo-location",
         {
@@ -103,7 +110,8 @@
       "expo-asset"
     ],
     "experiments": {
-      "typedRoutes": true
+      "typedRoutes": true,
+      "reactCompiler": true
     }
   }
 }

eslint.config.js

@@ -5,6 +5,21 @@ const expoConfig = require("eslint-config-expo/flat");
 module.exports = defineConfig([
   expoConfig,
   {
-    ignores: ["dist/*"],
-  }
+    ignores: ["dist/*", "android/*", "ios/*"],
+  },
+  {
+    // The Electron main/preload processes are CommonJS Node, not the Expo
+    // bundle: they legitimately use `__dirname`, `Buffer` and friends.
+    files: ["electron/**/*.js"],
+    languageOptions: {
+      globals: {
+        __dirname: "readonly",
+        __filename: "readonly",
+        Buffer: "readonly",
+        process: "readonly",
+        module: "writable",
+        require: "readonly",
+      },
+    },
+  },
 ]);

google-services.json.example

@@ -1,5 +1,5 @@
 {
-  "_comment": "TEMPLATE — copy to google-services.json (gitignored) and replace every REPLACE_WITH_* with the real values from your Firebase project (Android app in.fairco.wallet). See docs/notifications-infra.md.",
+  "_comment": "TEMPLATE — copy to google-services.json (gitignored) and replace every REPLACE_WITH_* with the real values from your Firebase project (Android app in.fairco.walletapp). See docs/notifications-infra.md.",
   "project_info": {
     "project_number": "REPLACE_WITH_PROJECT_NUMBER",
     "project_id": "REPLACE_WITH_PROJECT_ID",
@@ -10,7 +10,7 @@
       "client_info": {
         "mobilesdk_app_id": "REPLACE_WITH_MOBILESDK_APP_ID",
         "android_client_info": {
-          "package_name": "in.fairco.wallet"
+          "package_name": "in.fairco.walletapp"
         }
       },
       "oauth_client": [],