[juliusmarminge]

Fork PRs can't get an EAS preview: pull_request runs from forks get no secrets, so mobile-eas-preview.yml always skipped. That blocks testing trusted contributors' mobile PRs, such as https://git.cafe/pingdotgg/t3code/pulls/26734.

New mobile-eas-preview-fork.yml runs on pull_request_target when a maintainer applies 🚀 Mobile Continuous Deployment to a fork PR. The label is the maintainer's sign-off on the code they reviewed, so the workflow:

• removes the label first, so one application covers one commit; a later push deploys nothing until the label is applied again
• checks out the head SHA from the label event, not the branch, so a push after labeling can't swap in unreviewed code
• turns off the Vite+ and EAS caches, because pull_request_target saves caches under main's scope where trusted workflows would restore them
• leaves no Git credentials in the checkout
• then runs the same fingerprint deploy as same-repo PRs: an OTA when a build exists for the fingerprint, otherwise a native build, plus the usual preview comment

Same-repo PRs keep deploying on every push while labeled; mobile-eas-preview.yml now skips fork PRs.

Both preview workflows now read the EXPO_PREVIEW_TOKEN secret instead of EXPO_TOKEN (same Developer robot), so the name says what it's for next to EXPO_PRODUCTION_TOKEN. Steps still export it as EXPO_TOKEN for eas-cli. Once this merges, the old EXPO_TOKEN secret is unused and can be deleted.

The reviewed code runs next to EXPO_PREVIEW_TOKEN (a Developer robot) and the preview signing credentials on EAS. Since https://git.cafe/pingdotgg/t3code/pulls/27285 production uses a separate Release Manager token and the production channel is protected, so this token cannot publish OTAs to production users.

Verified: YAML parses and vp fmt is clean. pull_request_target always runs main's copy, so the first real run is labeling a fork PR after merge.

Model: Claude Opus 5.5 in Claude Code (T3 Code).

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — The workflow enables one reviewed fork commit per label, with SHA pinning and cache isolation. Confirm effective Expo token permissions and production-channel protection before allowing fork code access to deployment credentials; those live safeguards are asserted but not demonstrated.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}