revert(ci): restore artifact-based fingerprint comparison

EAS fingerprint API only works with EAS Build, but we build natively
with Gradle/Fastlane. Revert to artifact-based approach with the
original fixes: jq hash extraction and env block for safe shell
interpolation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ignaciosantise

.github/workflows/ota-update-pos.yaml

@@ -4,6 +4,7 @@ run-name: "Mobile POS OTA - production"
 permissions:
   id-token: write
   contents: read
+  actions: read
 
 on:
   workflow_dispatch:
@@ -35,48 +36,88 @@ jobs:
           fi
           echo "${{ secrets.POS_ENV_FILE }}" > dapps/pos-app/.env
 
-      - name: Setup EAS CLI
-        run: npm install -g eas-cli
+      - name: Compute current fingerprints
+        id: fingerprints
+        run: |
+          cd dapps/pos-app
+          ANDROID_FINGERPRINT=$(npx expo-updates fingerprint:generate --platform android 2>/dev/null | tail -1 | jq -r '.hash')
+          IOS_FINGERPRINT=$(npx expo-updates fingerprint:generate --platform ios 2>/dev/null | tail -1 | jq -r '.hash')
+          echo "android=$ANDROID_FINGERPRINT" >> "$GITHUB_OUTPUT"
+          echo "ios=$IOS_FINGERPRINT" >> "$GITHUB_OUTPUT"
+          echo "Current Android fingerprint: $ANDROID_FINGERPRINT"
+          echo "Current iOS fingerprint: $IOS_FINGERPRINT"
+
+      - name: Download last native build fingerprint (Android)
+        id: download-fingerprint-android
+        uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
+        with:
+          name: native-fingerprint-android-production
+          workflow: release-pos.yaml
+          if_no_artifact_found: warn
+          path: /tmp/native-fingerprint/android
+
+      - name: Download last native build fingerprint (iOS)
+        id: download-fingerprint-ios
+        uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
+        with:
+          name: native-fingerprint-ios-production
+          workflow: release-pos.yaml
+          if_no_artifact_found: warn
+          path: /tmp/native-fingerprint/ios
 
       - name: Check for native changes
         id: native-check
-        working-directory: dapps/pos-app
         env:
-          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          CURRENT_ANDROID_FINGERPRINT: ${{ steps.fingerprints.outputs.android }}
+          CURRENT_IOS_FINGERPRINT: ${{ steps.fingerprints.outputs.ios }}
         run: |
           HAS_NATIVE_CHANGES=false
 
-          for PLATFORM in android ios; do
-            echo "--- Checking $PLATFORM ---"
-            BUILD_LIST_OUTPUT=$(eas build:list --platform "$PLATFORM" --channel production --limit 1 --json --non-interactive 2>&1) || true
-            BUILD_ID=$(echo "$BUILD_LIST_OUTPUT" | jq -r '.[0].id' 2>/dev/null)
+          ANDROID_FINGERPRINT_PATH=/tmp/native-fingerprint/android/native-fingerprint.txt
+          IOS_FINGERPRINT_PATH=/tmp/native-fingerprint/ios/native-fingerprint.txt
 
-            if [ -z "$BUILD_ID" ] || [ "$BUILD_ID" = "null" ]; then
-              echo "No previous $PLATFORM build found for channel 'production'. Skipping check."
-              continue
+          if [ -f "$ANDROID_FINGERPRINT_PATH" ]; then
+            LAST_ANDROID_FINGERPRINT=$(cat "$ANDROID_FINGERPRINT_PATH")
+            echo "Last native Android fingerprint: $LAST_ANDROID_FINGERPRINT"
+            echo "Current Android fingerprint: $CURRENT_ANDROID_FINGERPRINT"
+
+            if [ "$LAST_ANDROID_FINGERPRINT" != "$CURRENT_ANDROID_FINGERPRINT" ]; then
+              HAS_NATIVE_CHANGES=true
+              echo "::error::Android native changes detected. Current fingerprint does not match the last native Android build."
             fi
+          else
+            echo "No previous native Android fingerprint found for channel 'production'."
+          fi
 
-            echo "Latest $PLATFORM build: $BUILD_ID"
-            DIFF=$(eas fingerprint:compare --build-id "$BUILD_ID" --platform "$PLATFORM" --json --non-interactive 2>&1) || true
-            IS_MATCH=$(echo "$DIFF" | jq -r '.isCompatible // .isMatch // empty' 2>/dev/null)
+          if [ -f "$IOS_FINGERPRINT_PATH" ]; then
+            LAST_IOS_FINGERPRINT=$(cat "$IOS_FINGERPRINT_PATH")
+            echo "Last native iOS fingerprint: $LAST_IOS_FINGERPRINT"
+            echo "Current iOS fingerprint: $CURRENT_IOS_FINGERPRINT"
 
-            if [ "$IS_MATCH" = "true" ]; then
-              echo "$PLATFORM fingerprint matches the latest native build."
-            else
+            if [ "$LAST_IOS_FINGERPRINT" != "$CURRENT_IOS_FINGERPRINT" ]; then
               HAS_NATIVE_CHANGES=true
-              echo "::error::$PLATFORM native changes detected. Current fingerprint does not match build $BUILD_ID."
-              echo "$DIFF" | jq . 2>/dev/null || echo "$DIFF"
+              echo "::error::iOS native changes detected. Current fingerprint does not match the last native iOS build."
             fi
-          done
+          else
+            echo "No previous native iOS fingerprint found for channel 'production'."
+          fi
 
           if [ "$HAS_NATIVE_CHANGES" = "true" ]; then
             echo "has_native_changes=true" >> "$GITHUB_OUTPUT"
             echo "::error::Native changes detected. You must create a new native release before publishing an OTA update."
             exit 1
           fi
 
+          if [ ! -f "$ANDROID_FINGERPRINT_PATH" ] || [ ! -f "$IOS_FINGERPRINT_PATH" ]; then
+            echo "At least one platform fingerprint is missing. This can happen after initial OTA setup."
+            echo "Proceeding with OTA publish."
+          fi
+
           echo "has_native_changes=false" >> "$GITHUB_OUTPUT"
-          echo "Fingerprints match — safe to publish OTA update."
+          echo "Fingerprints match for all available platform artifacts — safe to publish OTA update."
+
+      - name: Setup EAS CLI
+        run: npm install -g eas-cli
 
       - name: Publish OTA update
         id: eas-update

.github/workflows/release-android-base.yaml

@@ -93,6 +93,23 @@ jobs:
         env:
           EAS_UPDATE_CHANNEL: ${{ inputs.eas-update-channel }}
 
+      - name: Compute and upload native fingerprint
+        if: ${{ inputs.eas-update-channel != '' }}
+        run: |
+          cd ${{ inputs.root-path }}
+          FINGERPRINT=$(npx expo-updates fingerprint:generate --platform android 2>/dev/null | tail -1 | jq -r '.hash')
+          echo "$FINGERPRINT" > native-fingerprint.txt
+          echo "Native fingerprint: $FINGERPRINT"
+
+      - name: Upload native fingerprint artifact
+        if: ${{ inputs.eas-update-channel != '' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: native-fingerprint-android-${{ inputs.eas-update-channel }}
+          path: ${{ inputs.root-path }}/native-fingerprint.txt
+          retention-days: 90
+          overwrite: true
+
       - name: Install Java 17
         uses: actions/setup-java@v3
         with:

.github/workflows/release-ios-base.yaml

@@ -129,6 +129,23 @@ jobs:
         env:
           EAS_UPDATE_CHANNEL: ${{ inputs.eas-update-channel }}
 
+      - name: Compute and upload native fingerprint
+        if: ${{ inputs.eas-update-channel != '' }}
+        run: |
+          cd ${{ inputs.root-path }}
+          FINGERPRINT=$(npx expo-updates fingerprint:generate --platform ios 2>/dev/null | tail -1 | jq -r '.hash')
+          echo "$FINGERPRINT" > native-fingerprint.txt
+          echo "Native fingerprint: $FINGERPRINT"
+
+      - name: Upload native fingerprint artifact
+        if: ${{ inputs.eas-update-channel != '' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: native-fingerprint-ios-${{ inputs.eas-update-channel }}
+          path: ${{ inputs.root-path }}/native-fingerprint.txt
+          retention-days: 90
+          overwrite: true
+
       - name: Set Xcode paths
         run: |
           # Find the .xcodeproj and .xcworkspace (works for both Expo and non-Expo)