chore(runway): cherry-pick ci: add separate Runway OTA and native build workflows (phase 1) cp-7.75.0 (#29352)

runway-github[bot] · metamaskbot · Cal-L · web-flow · commit 5185f5c61e60 · 2026-04-30T12:05:29.000+01:00
- ci: add separate Runway OTA and native build workflows (phase 1) cp-7.75.0 (#29294)  ## **Description** Splits the Runway release flow so that OTA updates and native binary builds are triggered by dedicated entry points rather than being auto-detected inside a shared core workflow. This PR is **phase 1 (additive-only)** — it introduces the new workflows alongside the existing ones without removing or renaming anything. ### Why Today the 4 per-platform Runway entry workflows (`runway-{ios,android}-{production,rc}-workflow.yml`) all go through `runway-ota-build-core.yml`, which compares `OTA_VERSION` in `app/constants/ota.ts` against the release tag to decide whether to dispatch `push-eas-update.yml` (OTA) or `build.yml` (native binary). We want release engineers to make that choice explicitly in Runway, and to combine iOS + Android into a single dispatch so the build-version bump only happens once per release. ### Why two phases Runway dispatches a workflow from the currently-selected release branch (no `source_branch` input is passed). That means the workflow file must exist on whichever branch Runway points at. Runway is a single configuration across all branches. Because this PR can only be cherry-picked to `release/7.75.0` and not to older active branches (`release/7.73.x`, `release/7.74.x`), the cleanup (deleting the 4 old per-platform workflows and renaming the core) has to wait until those older branches are retired — otherwise flipping Runway to the new names would break dispatches against them. To keep this PR safe and reviewable without committing the organisation to the cleanup yet, the work is split into two phases: - **Phase 1 (this PR)** — add the 5 new workflow files only; do not touch or remove anything existing. - **Phase 2 (follow-up PR, later)** — delete the 4 old per-platform workflows, rename `runway-ota-build-core.yml` → `auto-rc-ota-build-core.yml`, and update `build-rc-auto.yml`. This will be opened only after `release/7.73.x` and `release/7.74.x` are retired and Runway has been flipped to the new workflow names. ### What this PR adds - **`runway-ota-resolve-context.yml`** — reusable workflow that resolves `pr_number`, `base_ref`, `ota_version`, and `ota_bump` from a given ref. Consumed by the new OTA workflows and designed to be consumed by the renamed core in phase 2. - **`runway-production-builds.yml`** — bumps the build version once, then runs `build.yml` with `platform: both` for `main-prod`, and uploads the iOS IPA to TestFlight. No OTA, no Slack (matches today's production behaviour). - **`runway-rc-builds.yml`** — same shape as above for `main-rc`, plus the existing Slack RC notification (matches today's RC behaviour). - **`runway-ota-production.yml`** — pushes OTA to the `production` channel for both platforms via `push-eas-update.yml` (`platform: all`), then creates the `v<OTA_VERSION>` release tag via the existing `runway-create-ota-production-tag.yml`. - **`runway-ota-rc.yml`** — pushes OTA to the `rc` channel for both platforms, plus the existing Slack RC notification. ### What this PR does NOT change - `runway-ios-production-workflow.yml`, `runway-android-production-workflow.yml`, `runway-ios-rc-workflow.yml`, `runway-android-rc-workflow.yml` — untouched; Runway can keep dispatching these as today. - `runway-ota-build-core.yml` — untouched. - `build-rc-auto.yml` — untouched; keeps calling `runway-ota-build-core.yml` as today. ### Rollout notes - Merge this PR to `main`, then cherry-pick to `release/7.75.0` so the new workflow files exist on the first release branch that will use them. - Runway config is **not** flipped yet. It keeps pointing at the 4 old per-platform workflow names until `release/7.73.x` and `release/7.74.x` are retired. - The phase 2 cleanup PR will flip Runway and delete the now-unused old workflows. ## **Changelog**  CHANGELOG entry:null ## **Related issues** Fixes: ## **Manual testing steps** ```gherkin Feature: my feature name Scenario: user [verb for user action] Given [describe expected initial app state] When user [verb for user action] Then [describe expected outcome] ``` ## **Screenshots/Recordings**  ### **Before**  ### **After**  ## **Pre-merge author checklist**  - [x] I've followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [x] I've completed the PR template to the best of my ability - [x] I've included tests if applicable - [x] I've documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [x] I've applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. #### Performance checks (if applicable) - [ ] I've tested on Android - Ideally on a mid-range device; emulator is acceptable - [ ] I've tested with a power user scenario - Use these [power-user SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93) to import wallets with many accounts and tokens - [ ] I've instrumented key operations with Sentry traces for production performance metrics - See [`trace()`](/app/util/trace.ts) for usage and [`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274) for an example For performance guidelines and tooling, see the [Performance Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers). ## **Pre-merge reviewer checklist**  - [x] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [x] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > **Medium Risk** > Adds new Runway-triggered workflows that publish OTA updates, bump build versions, and create production tags; misconfiguration could impact release automation and tagging but changes are additive and don’t alter existing workflows. > > **Overview** > Introduces new **Runway entrypoint** GitHub Actions workflows to explicitly choose between OTA releases and native binary builds (additive-only). > > Adds `runway-ota-rc.yml` and `runway-ota-production.yml` to publish EAS OTA updates for *both platforms* via `push-eas-update.yml`, with PR-number validation and production tag creation (`v<OTA_VERSION>`). > > Adds `runway-rc-builds.yml` and `runway-production-builds.yml` to bump the build version once via `update-latest-build-version.yml`, build iOS+Android together (`platform: both`), upload iOS to TestFlight, and (for RC) post the existing Slack notification. > > Adds reusable `runway-ota-resolve-context.yml` to resolve `pr_number`, `base_ref` (from `package.json`), `ota_version` (from `app/constants/ota.ts`), and an `ota_bump` flag for future consumers. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4a78c24. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  [764a031](764a031) --------- Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com> Co-authored-by: Cal Leung <cal.leung@consensys.net> Co-authored-by: MetaMask Bot <37885440+metamaskbot@users.noreply.github.com> Co-authored-by: Pedro Pablo Aste Kompen <wachunei@gmail.com> Co-authored-by: abretonc7s <107169956+abretonc7s@users.noreply.github.com> Co-authored-by: Matthew Grainger <46547583+Matt561@users.noreply.github.com> Co-authored-by: Satyajeet Kolhapure <77279246+satyajeetkolhapure@users.noreply.github.com> Co-authored-by: Jean-Baptiste Blanc <jb.blanc@consensys.net> Co-authored-by: Brian August Nguyen <brianacnguyen@gmail.com> Co-authored-by: George Weiler <georgejweiler@gmail.com> Co-authored-by: Caainã Jeronimo <caainaje@gmail.com> Co-authored-by: Luis Taniça <matallui@gmail.com> Co-authored-by: VGR <VanGulckRik@gmail.com> Co-authored-by: George Marshall <george.marshall@consensys.net> Co-authored-by: AxelGes <34173844+AxelGes@users.noreply.github.com> Co-authored-by: Patryk Łucka <patryk.lucka@gmail.com> Co-authored-by: Gustavo Antunes <17601467+gantunesr@users.noreply.github.com> Co-authored-by: Juanmi <95381763+juanmigdr@users.noreply.github.com> Co-authored-by: infiniteflower <139582705+infiniteflower@users.noreply.github.com> Co-authored-by: Davide Brocchetto <davide.brocchetto@consensys.net> Co-authored-by: Curtis David <Curtis.David7@gmail.com> Co-authored-by: Nick Gambino <35090461+gambinish@users.noreply.github.com> Co-authored-by: Monte Lai <monte.lai@consensys.net> Co-authored-by: Jyoti Puri <jyotipuri@gmail.com> Co-authored-by: Bruno Nascimento <brunonascimentodev@gmail.com> Co-authored-by: Maarten Zuidhoorn <maarten@zuidhoorn.com> Co-authored-by: cmd-ob <ola.bale@consensys.net> Co-authored-by: João <castrofjoao@gmail.com> Co-authored-by: sophieqgu <sophieqgu@gmail.com> Co-authored-by: Alejandro Garcia Anglada <aganglada@gmail.com> Co-authored-by: Mathieu Artu <mathieu.artu@consensys.net> Co-authored-by: sophieqgu <37032128+sophieqgu@users.noreply.github.com> Co-authored-by: Charly Chevalier <charlyy.chevalier@gmail.com> Co-authored-by: Bryan Fullam <bryan.fullam@consensys.net> Co-authored-by: Bryan Fullam <8902170+bfullam@users.noreply.github.com> Co-authored-by: SteP-n-s <stylianos.panagakos@consensys.net> Co-authored-by: António Regadas <antonio.regadas@consensys.net> Co-authored-by: Edouard Bougon <15703023+EdouardBougon@users.noreply.github.com> Co-authored-by: Alex Donesky <adonesky@gmail.com> Co-authored-by: Baptiste Marchand <75846779+baptiste-marchand@users.noreply.github.com> Co-authored-by: Fabio Bozzo <fabio.bozzo@gmail.com> Co-authored-by: Owen Craston <owen.craston@consensys.net> Co-authored-by: Pavel Dvorkin <pavel.dvorkin@consensys.net> Co-authored-by: Kevin Bluer <kevin@bluer.com> Co-authored-by: Vince Howard <vincenguyenhoward@gmail.com> Co-authored-by: Nicholas Gambino <nicholas.gambino@consensys.net> Co-authored-by: Nicholas Smith <nick.smith@consensys.net> Co-authored-by: sethkfman <10342624+sethkfman@users.noreply.github.com> Co-authored-by: Nodonisko <suchydan@gmail.com> Co-authored-by: Tamas <soostamas.hu@gmail.com> Co-authored-by: ffmcgee <51971598+ffmcgee725@users.noreply.github.com> Co-authored-by: Alexandre Chappaz <alex@achappaz.fr> Co-authored-by: Harika <153644847+hjetpoluru@users.noreply.github.com> Co-authored-by: Erik Nilsson <eriks@mail.se> Co-authored-by: runway-github[bot] <73448015+runway-github[bot]@users.noreply.github.com> Co-authored-by: Wei Sun <wei.sun@consensys.net> Co-authored-by: Patryk Łucka <5708018+PatrykLucka@users.noreply.github.com> Co-authored-by: Salim TOUBAL <salim.toubal@outlook.com> Co-authored-by: OGPoyraz <omergoktugpoyraz@gmail.com> Co-authored-by: Bernardo Garces Chapero <bernardo.chapero@consensys.net> Co-authored-by: Christian Montoya <christian.montoya@consensys.net> Co-authored-by: Vinicius Stevam <45455812+vinistevam@users.noreply.github.com> Co-authored-by: sethkfman <Seth.Kaufman@consensys.net> Co-authored-by: Gauthier Petetin <gauthierpetetin@hotmail.com> Co-authored-by: Ganesh Suresh Patra <ganesh.patra@consensys.net> Co-authored-by: João Loureiro <175489935+joaoloureirop@users.noreply.github.com> Co-authored-by: ieow <4881057+ieow@users.noreply.github.com> Co-authored-by: tommasini <46944231+tommasini@users.noreply.github.com> Co-authored-by: Xiaoming Wang <7315988+dawnseeker8@users.noreply.github.com> Co-authored-by: himanshuchawla009 <himanshuchawla2014@gmail.com> Co-authored-by: Gaurav Goel <grvgoel19@gmail.com> Co-authored-by: Elliot Winkler <elliot.winkler@gmail.com> Co-authored-by: Frederik Bolding <frederik.bolding@gmail.com> Co-authored-by: Matthew Walsh <matthew.walsh@consensys.net> Co-authored-by: Charly Chevalier <charly.chevalier@consensys.net> Co-authored-by: Micaela <100321200+micaelae@users.noreply.github.com> Co-authored-by: salimtb <salim.toubal@consensys.net> Co-authored-by: Micaela Estabillo <micaela.estabillo@consensys.net> Co-authored-by: jake-perkins <128608287+jake-perkins@users.noreply.github.com> Co-authored-by: Laurel <153323700+i18nlaurel@users.noreply.github.com> Co-authored-by: Kylan Hurt <6249205+smilingkylan@users.noreply.github.com> Co-authored-by: sethkfman <setk.kaufman@consensys.net> Co-authored-by: Prithpal Sooriya <prithpal.sooriya@consensys.net> Co-authored-by: Aslau Mario-Daniel <marioaslau@gmail.com> Co-authored-by: sahar-fehri <sahar.fehri@consensys.net> Co-authored-by: Alexey Kureev <a.g.kureev@gmail.com> Co-authored-by: Matt D. <85914066+geositta@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: saustrie-consensys <shane.austrie@consensys.net> Co-authored-by: Matthew Grainger <matthew.grainger@consensys.net> Co-authored-by: Darius Costolas <dariuscostolas@yahoo.com> Co-authored-by: Darius Costolas <10818970+meltingice1337@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: wachunei <1024246+wachunei@users.noreply.github.com> Co-authored-by: Tyler Chong <tyler.chong@consensys.net> Co-authored-by: chloeYue <chloe.gao@consensys.net> Co-authored-by: geositta <matthew.denton@consensys.net> Co-authored-by: Michal Szorad <michal.szorad@consensys.net> Co-authored-by: Javier Garcia Vera <javier.vera@consensys.net> Co-authored-by: Samir Mehta <12882259+samir-acle@users.noreply.github.com> Co-authored-by: chloeYue <105063779+chloeYue@users.noreply.github.com> Co-authored-by: sleepytanya <104780023+sleepytanya@users.noreply.github.com> Co-authored-by: Remi ARQUEVAUX <r.arquevaux@gmail.com> Co-authored-by: metamaskbotv2[bot] <214045046+metamaskbotv2[bot]@users.noreply.github.com>
diff --git a/.github/workflows/runway-ota-production.yml b/.github/workflows/runway-ota-production.yml
@@ -0,0 +1,70 @@
+##############################################################################################
+#
+# Runway OTA Production
+#
+# Triggered from Runway to push an OTA update to the production channel (iOS + Android) and
+# create the corresponding `v<OTA_VERSION>` release tag.
+#
+# This workflow does not build binaries and does not bump the build version — the release PR is
+# expected to bump OTA_VERSION (app/constants/ota.ts) before dispatch.
+#
+##############################################################################################
+name: Runway OTA Production
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_branch:
+        description: >-
+          Optional branch, tag, or SHA for OTA publish + tag creation.
+          Empty uses the branch selected in the "Use workflow from" UI.
+        required: false
+        type: string
+
+permissions:
+  contents: write # required to push the v<OTA_VERSION> tag
+  pull-requests: read
+  id-token: write # required by push-eas-update.yml
+
+jobs:
+  resolve-context:
+    name: Resolve OTA context
+    uses: ./.github/workflows/runway-ota-resolve-context.yml
+    with:
+      source_branch: ${{ inputs.source_branch }}
+    secrets: inherit
+
+  validate-ota-pr:
+    name: Validate PR for OTA
+    needs: resolve-context
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate PR number
+        run: |
+          if [[ -z "${{ needs.resolve-context.outputs.pr_number }}" ]]; then
+            echo "::error::No PR found for this branch. OTA update requires a PR number."
+            echo "::error::If you ran the workflow manually (workflow_dispatch), select your release branch in the 'Use workflow from' dropdown (e.g. release/7.71.0), not main."
+            exit 1
+          fi
+          echo "Using PR #${{ needs.resolve-context.outputs.pr_number }}"
+
+  push-ota:
+    name: Push OTA update (production)
+    needs: [resolve-context, validate-ota-pr]
+    uses: ./.github/workflows/push-eas-update.yml
+    with:
+      pr_number: ${{ needs.resolve-context.outputs.pr_number }}
+      base_branch: ${{ needs.resolve-context.outputs.base_ref }}
+      message: ${{ needs.resolve-context.outputs.ota_version }}
+      channel: production
+      platform: all
+    secrets: inherit
+
+  create-ota-production-tag:
+    name: Create OTA production release tag
+    needs: [resolve-context, push-ota]
+    uses: ./.github/workflows/runway-create-ota-production-tag.yml
+    with:
+      tag_name: ${{ needs.resolve-context.outputs.ota_version }}
+      checkout_ref: ${{ inputs.source_branch || github.ref_name }}
+    secrets: inherit
diff --git a/.github/workflows/runway-ota-rc.yml b/.github/workflows/runway-ota-rc.yml
@@ -0,0 +1,70 @@
+##############################################################################################
+#
+# Runway OTA RC
+#
+# Triggered from Runway to push an OTA update to the RC channel (iOS + Android) and post a Slack
+# notification (matching the prior Runway RC behaviour on the OTA path).
+#
+# This workflow does not build binaries and does not bump the build version — the release PR is
+# expected to bump OTA_VERSION (app/constants/ota.ts) before dispatch.
+#
+##############################################################################################
+name: Runway OTA RC
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_branch:
+        description: >-
+          Optional branch, tag, or SHA for OTA publish.
+          Empty uses the branch selected in the "Use workflow from" UI.
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  pull-requests: read
+  id-token: write # required by push-eas-update.yml
+
+jobs:
+  resolve-context:
+    name: Resolve OTA context
+    uses: ./.github/workflows/runway-ota-resolve-context.yml
+    with:
+      source_branch: ${{ inputs.source_branch }}
+    secrets: inherit
+
+  validate-ota-pr:
+    name: Validate PR for OTA
+    needs: resolve-context
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate PR number
+        run: |
+          if [[ -z "${{ needs.resolve-context.outputs.pr_number }}" ]]; then
+            echo "::error::No PR found for this branch. OTA update requires a PR number."
+            echo "::error::If you ran the workflow manually (workflow_dispatch), select your release branch in the 'Use workflow from' dropdown (e.g. release/7.71.0), not main."
+            exit 1
+          fi
+          echo "Using PR #${{ needs.resolve-context.outputs.pr_number }}"
+
+  push-ota:
+    name: Push OTA update (rc)
+    needs: [resolve-context, validate-ota-pr]
+    uses: ./.github/workflows/push-eas-update.yml
+    with:
+      pr_number: ${{ needs.resolve-context.outputs.pr_number }}
+      base_branch: ${{ needs.resolve-context.outputs.base_ref }}
+      message: ${{ needs.resolve-context.outputs.ota_version }}
+      channel: rc
+      platform: all
+    secrets: inherit
+
+  slack-notification:
+    name: Slack RC Notification
+    needs: push-ota
+    if: success()
+    uses: ./.github/workflows/slack-rc-notification.yml
+    with:
+      source_branch: ${{ inputs.source_branch || github.ref_name }}
+    secrets: inherit
diff --git a/.github/workflows/runway-ota-resolve-context.yml b/.github/workflows/runway-ota-resolve-context.yml
@@ -0,0 +1,120 @@
+##############################################################################################
+#
+# Runway OTA Resolve Context (reusable)
+#
+# Resolves OTA-related context for Runway OTA / auto-RC flows:
+#   - pr_number: open PR number for the resolved branch (empty if none)
+#   - base_ref:  semver release tag derived from package.json version (e.g. v7.71.0)
+#   - ota_version: OTA_VERSION string exported from app/constants/ota.ts at the resolved ref
+#   - ota_bump:  "true" if OTA_VERSION differs from base_ref (or origin/main when tag missing)
+#
+# Callers:
+#   - auto-rc-ota-build-core.yml (uses all outputs incl. ota_bump to decide OTA vs build)
+#   - runway-ota-rc.yml / runway-ota-production.yml (OTA-only entry points; ignore ota_bump)
+#
+##############################################################################################
+name: Runway OTA Resolve Context
+
+on:
+  workflow_call:
+    inputs:
+      source_branch:
+        description: >-
+          Optional branch, tag, or SHA to resolve context from.
+          Empty uses the calling workflow's triggering ref.
+        required: false
+        type: string
+        default: ''
+    outputs:
+      pr_number:
+        description: 'Open PR number for the resolved branch (empty if none)'
+        value: ${{ jobs.resolve.outputs.pr_number }}
+      base_ref:
+        description: 'Semver release tag derived from package.json (e.g. v7.71.0)'
+        value: ${{ jobs.resolve.outputs.base_ref }}
+      ota_version:
+        description: 'OTA_VERSION exported from app/constants/ota.ts at the resolved ref'
+        value: ${{ jobs.resolve.outputs.ota_version }}
+      ota_bump:
+        description: 'true when OTA_VERSION differs from base_ref (or origin/main when tag missing)'
+        value: ${{ jobs.resolve.outputs.ota_bump }}
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  resolve:
+    name: Resolve OTA context
+    runs-on: ubuntu-latest
+    outputs:
+      pr_number: ${{ steps.resolve-pr.outputs.pr_number }}
+      base_ref: ${{ steps.decide.outputs.base_ref }}
+      ota_version: ${{ steps.decide.outputs.ota_version }}
+      ota_bump: ${{ steps.decide.outputs.ota_bump }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ inputs.source_branch || github.ref }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Resolve PR number for current branch
+        id: resolve-pr
+        run: |
+          BRANCH="${{ inputs.source_branch || github.ref_name }}"
+          # Strip refs/heads/ if present
+          BRANCH="${BRANCH#refs/heads/}"
+          echo "Resolving PR for branch: $BRANCH (repo: $GITHUB_REPOSITORY)"
+
+          # Try same-repo head first, then owner:branch (required by API when listing pulls)
+          # jq '.[0].number' on an empty array outputs the literal string "null", so normalise to empty
+          PR_NUMBER=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$BRANCH" --json number --jq '.[0].number // empty' 2>/dev/null || echo "")
+          if [[ -z "$PR_NUMBER" ]]; then
+            PR_NUMBER=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$GITHUB_REPOSITORY_OWNER:$BRANCH" --json number --jq '.[0].number // empty' 2>/dev/null || echo "")
+          fi
+
+          echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+          echo "Branch: $BRANCH, PR number: ${PR_NUMBER:-none}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Decide OTA context
+        id: decide
+        run: |
+          set -e
+          # Version from package.json (e.g. 7.70.0) → base ref for OTA workflow is always v{VERSION}
+          VERSION=$(node -p "require('./package.json').version")
+          RELEASE_TAG="v${VERSION}"
+          echo "base_ref=${RELEASE_TAG}" >> "$GITHUB_OUTPUT"
+
+          # Parse OTA_VERSION from the export line (do not use a fixed line number — comment block length changes).
+          extract_ota() { grep -E '^export const OTA_VERSION' "$1" | sed -n "s/^export const OTA_VERSION: string = '\\([^']*\\)'.*/\\1/p"; }
+          extract_ota_from_git_show() { grep -E '^export const OTA_VERSION' | sed -n "s/^export const OTA_VERSION: string = '\\([^']*\\)'.*/\\1/p"; }
+
+          # OTA_VERSION from current ref
+          CURRENT_OTA=$(extract_ota app/constants/ota.ts)
+          echo "ota_version=${CURRENT_OTA}" >> "$GITHUB_OUTPUT"
+
+          # Ref to compare against for detecting bump: use release tag if it exists, else main
+          if git rev-parse "$RELEASE_TAG" >/dev/null 2>&1; then
+            COMPARE_REF="$RELEASE_TAG"
+            BASE_OTA=$(git show "${COMPARE_REF}:app/constants/ota.ts" 2>/dev/null | extract_ota_from_git_show || echo "")
+          else
+            COMPARE_REF="main"
+            BASE_OTA=$(git show "origin/main:app/constants/ota.ts" 2>/dev/null | extract_ota_from_git_show || echo "")
+            echo "Release tag ${RELEASE_TAG} not found; comparing OTA_VERSION to ${COMPARE_REF} to detect bump"
+          fi
+
+          if [[ -n "$BASE_OTA" && "$CURRENT_OTA" != "$BASE_OTA" ]]; then
+            echo "ota_bump=true" >> "$GITHUB_OUTPUT"
+            echo "OTA_VERSION changed: $BASE_OTA -> $CURRENT_OTA"
+          else
+            echo "ota_bump=false" >> "$GITHUB_OUTPUT"
+            echo "No OTA version bump (base: $BASE_OTA, current: $CURRENT_OTA)"
+          fi
diff --git a/.github/workflows/runway-production-builds.yml b/.github/workflows/runway-production-builds.yml
@@ -0,0 +1,68 @@
+##############################################################################################
+#
+# Runway Production Builds
+#
+# Triggered from Runway to build the production iOS + Android binaries in one run.
+# Bumps the build version once, then dispatches build.yml with platform: both so iOS and Android
+# build in parallel against the same bumped commit. Finishes by uploading the iOS IPA to
+# TestFlight.
+#
+# This workflow only produces fresh native binaries — OTA updates are handled by the separate
+# runway-ota-production.yml workflow.
+#
+##############################################################################################
+name: Runway Production Builds
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_branch:
+        description: >-
+          Optional branch, tag, or SHA (Build workflow source_branch).
+          Empty uses the branch selected in the "Use workflow from" UI.
+        required: false
+        type: string
+
+permissions:
+  contents: write # required by build.yml (update-build-version job)
+  pull-requests: read
+  actions: write
+  id-token: write # required by build.yml
+
+jobs:
+  update-build-version:
+    name: Bump build version
+    uses: ./.github/workflows/update-latest-build-version.yml
+    permissions:
+      contents: write
+      id-token: write
+    with:
+      base-branch: ${{ inputs.source_branch || github.ref_name }}
+    secrets:
+      PR_TOKEN: ${{ secrets.PR_TOKEN }}
+
+  build:
+    name: Build iOS + Android (main-prod)
+    needs: update-build-version
+    uses: ./.github/workflows/build.yml
+    with:
+      build_name: main-prod
+      platform: both
+      skip_version_bump: true
+      source_branch: ${{ needs.update-build-version.outputs.commit-hash }}
+      upload_to_sentry: true
+    secrets: inherit
+
+  upload-ios-testflight:
+    name: Upload iOS to TestFlight
+    needs: build
+    uses: ./.github/workflows/upload-to-testflight.yml
+    with:
+      environment: prod
+      source_branch: ${{ inputs.source_branch || github.ref_name }}
+      build_branch: ${{ inputs.source_branch || github.ref_name }}
+      build_name: main-prod
+      build_commit_sha: ${{ needs.build.outputs.built_commit_sha }}
+      build_version: ${{ needs.build.outputs.semantic_version }}
+      build_number: ${{ needs.build.outputs.ios_version_code }}
+    secrets: inherit
diff --git a/.github/workflows/runway-rc-builds.yml b/.github/workflows/runway-rc-builds.yml
