# tbi-copolo-mobile-app - Prod Environment

## Pipeline Overview

CircleCI pipeline for `tbi-copolo-mobile-app` — a React Native mobile app deploying to TestFlight (iOS) and the Google Play Console (Android, Internal Testing track). Modeled on the `tbi-rlv-redtag-app` pipeline.

## Triggered Branches
- `master` / `main` (Production builds)

## Pipeline Stages
1. **lint-and-test** - Install deps, lint, test
2. **build-ios** - Build iOS archive via xcodebuild, export IPA, upload to TestFlight
3. **build-android** - Build Android AAB via Gradle (`bundleProductionRelease`), upload to Google Play Console (Internal Testing track)

## App Identifiers (Copolo)
| Item | Value |
|------|-------|
| iOS workspace | `CopoloMobileApp.xcworkspace` |
| iOS scheme | `CopoloMobileApp` |
| iOS build config | `Release` |
| iOS bundle id | `com.travel.copolo.app` |
| Apple Team ID | `K38857JV5P` |
| Android applicationId | `com.copolomobileapp` (confirm against `android/app/build.gradle`; override via `COPOLO_ANDROID_PACKAGE_NAME`) |
| Android keystore file | `copolo-release.jks` |
| Android key alias | `copolo-android` |
| Play track (Android) | `internal` (Internal Testing) |
| Firebase project number | `1038853153642` (Copolo PROD Firebase project; used by the in-app Firebase SDK) |
| Firebase App ID (Android) | `1:1038853153642:android:2be0b44cb64273bd9c3b13` |
| Firebase App ID (iOS) | `1:1038853153642:ios:f56ab3c7ac1161139c3b13` |

## Required CircleCI Context Variables (`devops-mgt-prod`)

> All Copolo variables are prefixed with `COPOLO_` because this CircleCI context is shared with `tbi-rlv-redtag-app`. This avoids collisions with RedTag's variables (e.g. `ANDROID_KEYSTORE_BASE64`).

### iOS (TestFlight)
Secrets (must live in the CircleCI context `devops-mgt-prod`):
- `COPOLO_IOS_DISTRIBUTION_CERTIFICATE_BASE64` - Base64-encoded .p12 distribution certificate
- `COPOLO_IOS_CERTIFICATE_PASSWORD` - Password for the .p12 certificate (secret)
- `COPOLO_IOS_PROVISIONING_PROFILE_BASE64` - Base64-encoded provisioning profile ("Copolo Prod Appstore" / `709885c9-ba71-4546-b7d4-656a98dec574`)
- `COPOLO_KEYCHAIN_PASSWORD` - Temporary keychain password (any value)
- `COPOLO_APP_STORE_CONNECT_API_KEY_BASE64` - Base64-encoded App Store Connect API key (.p8)

Non-secret identifiers (now hardcoded in `config.yml`, no context var needed):
- App Store Connect API Key ID: `NQF3P88CN8`
- App Store Connect Issuer ID: `0e2f5593-2683-4293-b84f-d87642eae722`
- Apple App ID (`--apple-id`): `6473278994`
- Apple Team ID: `K38857JV5P`

### Android (Google Play Console)
Prod Android distribution uploads an **AAB** to the Google Play Console **Internal Testing** track (matches `tbi-rlv-redtag-app` prod), not Firebase App Distribution.

- `COPOLO_ANDROID_KEYSTORE_BASE64` - Base64-encoded `copolo-release.jks` release keystore
- `COPOLO_MYAPP_UPLOAD_STORE_PASSWORD` - Keystore store password
- `COPOLO_MYAPP_UPLOAD_KEY_PASSWORD` - Key password
- `COPOLO_GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` - **Base64-encoded** Play service-account JSON. The service account must have the **Android Publisher API** enabled and be granted release access in the Google Play Console for this app. Used to upload the AAB via the `androidpublisher` v3 API.
- `COPOLO_ANDROID_PACKAGE_NAME` - *(optional)* Android `applicationId`. Defaults to `com.copolomobileapp` in `config.yml`; set this only if the app's `build.gradle` uses a different id.

> Prerequisites for the Play upload to succeed: the app (`com.copolomobileapp`) must already exist in the Play Console, at least one build must have been uploaded manually first (Play rejects the very first upload via API for a brand-new app), and the service account must be linked with permission to manage releases on the internal track.

> The `COPOLO_FIREBASE_*` vars are no longer used for prod Android distribution. The Firebase App IDs above are still relevant for the in-app Firebase SDK config, not for CI distribution.

### App environment (.env — sourced from context)
`AWS_COGNITO_*`, `AWS_S3_BUCKET_USER_FILES*`, `AWS_STATIC_CONTENT_URL`, `AWS_PINPOINT_APP_ID`,
`COPOLO_*_API_ENDPOINT` / `*_REGION`, `ADYEN_*`, `COPOLO_APPLE_MERCHANT_ID`, `GOOGLE_MAPS_API_KEY`,
`GOOGLE_PLACES_API_KEY`, `GOOGLE_PLACES_API`, `MIXPANNEL_TOKEN`, `TRUSTYOU_API_KEY`,
`APP_ENV`, `APP_NAME`, `ENABLE_ANALYTICS`, `ENABLE_PUSH_NOTIFICATIONS`,
`ANDROID_APP_UPDATE_URL`, `IOS_APP_UPDATE_URL`

## Updating Secrets
Secrets are managed via CircleCI context `devops-mgt-prod`. To update:
1. Go to CircleCI → Organization Settings → Contexts → `devops-mgt-prod`
2. Update the relevant environment variable
3. Re-run the pipeline

> **Security note:** never hardcode keystore passwords, API keys, or endpoints in `config.yml`.
> All such values must live in the CircleCI context.