@ramonclaudio/create-vexpo 0.1.0 → 0.1.1

package/README.md

@@ -10,7 +10,7 @@ Scaffold a new [vexpo](https://github.com/ramonclaudio/vexpo) project: Expo SDK
 ```bash
 npm create @ramonclaudio/vexpo@latest my-app
 # or
-bunx @ramonclaudio/create-vexpo@latest my-app
+npx @ramonclaudio/create-vexpo@latest my-app
 ```
 
 After scaffold:
@@ -18,15 +18,15 @@ After scaffold:
 ```bash
 cd my-app
 
-bunx vexpo lite         # 60 seconds: Convex + Better Auth, simulator-ready
-bunx vexpo lite --new   # same + Convex signup walkthrough for first-time users
-bunx vexpo full         # full provisioning: TestFlight-ready (Convex, Better Auth, Resend, Apple Sign In, EAS, rebrand)
-bunx vexpo full --new   # same + Apple/Convex/Expo/Resend signup walkthrough
+npx vexpo lite         # 60 seconds: Convex + Better Auth, simulator-ready
+npx vexpo lite --new   # same + Convex signup walkthrough for first-time users
+npx vexpo full         # full provisioning: TestFlight-ready (Convex, Better Auth, Resend, Apple Sign In, EAS, rebrand)
+npx vexpo full --new   # same + Apple/Convex/Expo/Resend signup walkthrough
 ```
 
-`bunx vexpo lite` is the dev-mode shortcut. No Apple Developer account, no domain, no EAS, no Resend. Boots in the iOS Simulator in ~60 seconds. Add `--new` if you don't have a Convex account yet.
+`npx vexpo lite` is the dev-mode shortcut. No Apple Developer account, no domain, no EAS, no Resend. Boots in the iOS Simulator in ~60 seconds. Add `--new` if you don't have a Convex account yet.
 
-`bunx vexpo full` walks Apple Developer / Expo / Convex / Resend signups (with `--new`), validates each, provisions everything in order. ~30 minutes hands-on plus Apple-side wait times. Prints the canonical `eas build` command at the end. You run it when ready.
+`npx vexpo full` walks Apple Developer / Expo / Convex / Resend signups (with `--new`), validates each, provisions everything in order. ~30 minutes hands-on plus Apple-side wait times. Prints the canonical `eas build` command at the end. You run it when ready.
 
 ## Options
 
@@ -35,15 +35,15 @@ bunx vexpo full --new   # same + Apple/Convex/Expo/Resend signup walkthrough
 | `[directory]`   | Project directory name (positional). Defaults to `my-vexpo-app` with `-y`, otherwise prompts. |
 | `--no-install`  | Skip running `<pm> install` after copying the template.                                       |
 | `--no-git`      | Skip `git init` after install.                                                                |
-| `--no-setup`    | Skip the post-install `bunx vexpo lite` / `bunx vexpo full` prompt.                           |
+| `--no-setup`    | Skip the post-install `npx vexpo lite` / `npx vexpo full` prompt.                             |
 | `-y, --yes`     | Accept defaults, skip prompts.                                                                |
 | `-v, --version` | Print version, exit.                                                                          |
 
 ## What gets scaffolded
 
-The CLI copies `templates/default/` from the published tarball, restores npm-stripped dotfiles (`.gitignore`, `.env.example`, etc.), rewrites `package.json` (project name, version, drops monorepo metadata, swaps `vexpo` workspace ref for the published version), runs `bun install`, and initializes a fresh git repo with `feat: initial commit`.
+The CLI copies `templates/default/` from the published tarball, restores npm-stripped dotfiles (`.gitignore`, `.env.example`, `.npmrc`, etc.), rewrites `package.json` (project name, version, drops monorepo metadata), installs dependencies via the detected package manager (`npm`, `bun`, `pnpm`, or `yarn`, sniffed from `npm_config_user_agent`; defaults to `npm`), and initializes a fresh git repo with `feat: initial commit`. No lockfile ships in the tarball: the first install resolves the template's ranges fresh (including the latest in-range `vexpo` CLI) and the generated lockfile lands in the initial commit.
 
-After that, the project is standalone. The operational CLI (`vexpo`) is installed as a devDependency, so `bunx vexpo <subcommand>` resolves to the local pinned version. Setup commands aren't in `package.json`. They're one-shot CLI invocations, not runtime scripts.
+After that, the project is standalone. The operational CLI (`vexpo`) is installed as a devDependency, so `npx vexpo <subcommand>` resolves to the local pinned version. Setup commands aren't in `package.json`. They're one-shot CLI invocations, not runtime scripts.
 
 ## Repo
 

package/dist/index.js

@@ -11,7 +11,7 @@ import prompts from 'prompts';
 
 // package.json
 var package_default = {
-  version: "0.1.0"};
+  version: "0.1.1"};
 
 // src/index.ts
 var here = dirname(fileURLToPath(import.meta.url));
@@ -19,7 +19,7 @@ var TEMPLATE_DIR = join(here, "templates", "default");
 async function main() {
   const program = new Command().name("create-vexpo").description(
     "Scaffold a new vexpo project. Expo SDK 56 + Convex + Better Auth + Resend, wired for iOS."
-  ).argument("[directory]", "project directory name").option("--no-install", "skip installing dependencies").option("--no-git", "skip git init").option("--no-setup", "skip the `bunx vexpo lite` / `bunx vexpo full` prompt after install").option("-y, --yes", "accept defaults, skip prompts").version(package_default.version, "-v, --version").parse();
+  ).argument("[directory]", "project directory name").option("--no-install", "skip installing dependencies").option("--no-git", "skip git init").option("--no-setup", "skip the `npx vexpo lite` / `npx vexpo full` prompt after install").option("-y, --yes", "accept defaults, skip prompts").version(package_default.version, "-v, --version").parse();
   const flags = program.opts();
   const argDir = program.args[0];
   intro();
@@ -66,7 +66,7 @@ Target ${target} already exists. Pick a different name.`));
       gitSpin.warn("Git init skipped");
     }
   }
-  nextSteps(target, flags, pm);
+  if (flags.setup) nextSteps(target, flags, pm);
 }
 var NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
 var NAME_HINT = "lowercase letters, numbers, dashes; must start alphanumeric";
@@ -114,7 +114,8 @@ async function restoreStrippedDotfiles(target) {
     ["_gitattributes", ".gitattributes"],
     ["_easignore", ".easignore"],
     ["_fingerprintignore", ".fingerprintignore"],
-    ["_env.convex.local", ".env.convex.local"]
+    ["_env.convex.local", ".env.convex.local"],
+    ["_npmrc", ".npmrc"]
   ];
   for (const [from, to] of renames) {
     const src = join(target, from);
@@ -147,7 +148,7 @@ function detectPackageManager() {
   if (ua.startsWith("pnpm")) return "pnpm";
   if (ua.startsWith("yarn")) return "yarn";
   if (ua.startsWith("npm")) return "npm";
-  return "bun";
+  return "npm";
 }
 function intro() {
   console.log();
@@ -161,12 +162,12 @@ function nextSteps(target, flags, pm) {
   if (!flags.install) console.log(kleur.gray(`  ${pm} install`));
   console.log(
     kleur.gray(
-      `  bunx vexpo lite     ${kleur.dim("# dev mode: Convex + Better Auth, 60s to simulator")}`
+      `  npx vexpo lite     ${kleur.dim("# dev mode: Convex + Better Auth, 60s to simulator")}`
     )
   );
   console.log(
     kleur.gray(
-      `  bunx vexpo full     ${kleur.dim("# real setup: TestFlight-ready (add --new if you're new)")}`
+      `  npx vexpo full     ${kleur.dim("# real setup: TestFlight-ready (add --new if you're new)")}`
     )
   );
   console.log();

package/dist/templates/default/.eas/workflows/asc-events.yml

@@ -41,13 +41,16 @@ jobs:
   # link straight to App Store Connect rather than interpolating fields that
   # may not resolve.
 
+  # All four notify_* jobs ship disabled. Paste your Slack incoming-webhook URL
+  # from https://api.slack.com/messaging/webhooks into the `webhook_url:` field,
+  # then drop `false &&` from the `if:` guard to enable. EAS workflows do not
+  # yet support interpolating `${{ env.* }}` into `webhook_url`.
+
   notify_review_state:
     name: Slack notify on review state change
-    if: ${{ app_store_connect.app_version }}
+    if: ${{ false && app_store_connect.app_version }}
     type: slack
     params:
-      # `webhook_url` only accepts hardcoded strings today; EAS env-stored
-      # interpolation for this field is upcoming. Paste your URL below.
       webhook_url: https://hooks.slack.com/services/REPLACE/ME/HERE
       message: |
         App Store version state changed. App Store Connect → My Apps → App Store tab.
@@ -55,7 +58,7 @@ jobs:
 
   notify_upload_state:
     name: Slack notify on build upload
-    if: ${{ app_store_connect.build_upload }}
+    if: ${{ false && app_store_connect.build_upload }}
     type: slack
     params:
       webhook_url: https://hooks.slack.com/services/REPLACE/ME/HERE
@@ -65,7 +68,7 @@ jobs:
 
   notify_beta_state:
     name: Slack notify on external beta state
-    if: ${{ app_store_connect.external_beta }}
+    if: ${{ false && app_store_connect.external_beta }}
     type: slack
     params:
       webhook_url: https://hooks.slack.com/services/REPLACE/ME/HERE
@@ -75,7 +78,7 @@ jobs:
 
   notify_crash:
     name: Slack notify on TestFlight crash
-    if: ${{ app_store_connect.beta_feedback }}
+    if: ${{ false && app_store_connect.beta_feedback }}
     type: slack
     params:
       webhook_url: https://hooks.slack.com/services/REPLACE/ME/HERE

package/dist/templates/default/.eas/workflows/deploy-production.yml

@@ -1,18 +1,17 @@
 name: Deploy to production
 
 on:
-  push:
-    branches: ["main"]
+  # Manual trigger only. A push:main trigger here deploys Convex prod, builds
+  # iOS, and submits to the App Store on every merge, including docs/CI commits.
+  # Ship intentionally: `eas workflow:run .eas/workflows/deploy-production.yml`.
+  # This is the only workflow that runs `convex deploy`; release.yml's `v*` tag
+  # builds and submits but does NOT deploy Convex, so deploy here first.
   workflow_dispatch: {}
 
 concurrency:
   cancel_in_progress: true
   group: ${{ workflow.filename }}-${{ github.ref }}
 
-defaults:
-  tools:
-    bun: latest
-
 jobs:
   precheck:
     name: Precheck
@@ -22,11 +21,11 @@ jobs:
       - uses: eas/checkout
       - uses: eas/install_node_modules
       - name: Typecheck
-        run: bun run typecheck
+        run: npm run typecheck
       - name: Lint
-        run: bun run lint
+        run: npm run lint
       - name: Test
-        run: bun run test
+        run: npm run test
 
   deploy_convex:
     name: Deploy Convex
@@ -43,7 +42,7 @@ jobs:
       - uses: eas/checkout
       - uses: eas/install_node_modules
       - name: Deploy Convex backend
-        run: bunx convex deploy
+        run: npx convex deploy
 
   fingerprint:
     name: Fingerprint
@@ -85,6 +84,17 @@ jobs:
     params:
       platform: ios
       branch: production
+      # End-to-end code signing for the OTA bundle. `EAS_UPDATE_PRIVATE_KEY`
+      # is the matching private key for `templates/default/certs/certificate.pem`,
+      # stored as a production file-type secret:
+      #   eas env:create --environment production --visibility secret \
+      #     --type file --name EAS_UPDATE_PRIVATE_KEY \
+      #     --value ../keys/private-key.pem
+      # When the env var is unset (no cert generated yet), `eas update`
+      # skips signing without erroring. Run `npm run updates:gen-cert` once
+      # to wire both halves.
+      # https://docs.expo.dev/eas-update/code-signing/
+      private_key_path: "$EAS_UPDATE_PRIVATE_KEY"
 
   # Post-deploy notification with EAS Insights link. `update_ios` exposes
   # `first_update_group_id` (https://docs.expo.dev/eas/workflows/pre-packaged-jobs/#update-outputs);
@@ -110,17 +120,20 @@ jobs:
         run: |
           GROUP="${{ needs.update_ios.outputs.first_update_group_id }}"
           echo "Update group: $GROUP"
-          bunx eas-cli update:insights "$GROUP" --json --non-interactive || true
+          npx eas-cli update:insights "$GROUP" --json --non-interactive || true
 
   notify_update_published:
     name: Notify Slack with insights link
     needs: [update_ios]
-    if: ${{ needs.update_ios.outputs.first_update_group_id }}
+    # Disabled until you paste a real `webhook_url` below. Drop the `false &&`
+    # once configured. EAS workflows do not yet support interpolating
+    # `${{ env.* }}` into `webhook_url`, so the URL has to be hardcoded.
+    if: ${{ false && needs.update_ios.outputs.first_update_group_id }}
     type: slack
     params:
-      # Replace with your Slack incoming-webhook URL. EAS does not yet
-      # support reading this from EAS env (see job comment above). interpolation
-      # of `${{ env.* }}` for `webhook_url` lands in a future EAS release.
+      # Paste your Slack incoming-webhook URL from
+      # https://api.slack.com/messaging/webhooks. Leaving the placeholder will
+      # 404 once you remove the `if: false` gate above.
       webhook_url: https://hooks.slack.com/services/REPLACE/ME/HERE
       message: |
         :rocket: OTA update published to production.

package/dist/templates/default/.eas/workflows/e2e-tests.yml

@@ -12,9 +12,10 @@ name: E2E tests
 # environment (populated by `vexpo full` or `eas env:create`). The flow
 # yaml at .maestro/launch.yaml reads it as `appId: ${MAESTRO_APP_ID}`.
 
+# Auto-run on PRs is OFF by default to conserve EAS build credits (each run
+# builds an iOS Simulator binary). Trigger manually, or restore the
+# `pull_request` trigger below to run it on every PR.
 on:
-  pull_request:
-    branches: ["main"]
   workflow_dispatch: {}
 
 concurrency:

package/dist/templates/default/.eas/workflows/pr-preview.yml

@@ -1,36 +1,27 @@
 name: PR preview
 
-# Builds + auto-posts a comment on the PR with build/update IDs and QR codes
-# via the `github-comment` job. Mirrors the canonical EAS workflow pattern at
+# Mirrors the canonical EAS workflow pattern at
 # https://docs.expo.dev/eas/workflows/pre-packaged-jobs/#github-comment.
 #
-# Flow (canonical fingerprint-gated branch model):
-#   1. fingerprint → compute the iOS fingerprint for the PR's dev env.
-#   2. get_existing_build → check if any development:simulator build with
-#      that fingerprint already exists (returns build_id if so).
-#   3a. Path A (no compatible build): build a fresh dev-client simulator
-#       binary + publish a preview OTA to branch `pr-<n>` so the build
-#       picks it up on launch.
-#   3b. Path B (compatible build exists): publish a preview OTA only.
-#   4. github-comment → post the QR / build / update IDs.
-#
 # Either path publishes an update so a) the PR is always testable via a QR
 # scan and b) `pr-<n>` is a real EAS branch from the first commit, not the
 # second. Uses development:simulator (subscribed to the `development`
 # channel). vexpo doesn't ship a separate `preview` build profile.
 
+# Auto-build on PRs is OFF by default to conserve EAS build credits: a full
+# iOS build + update on every PR adds up fast. Ships manual-only. To restore
+# automatic previews, swap the trigger back to:
+#
+#   on:
+#     pull_request:
+#       branches: ["main"]
 on:
-  pull_request:
-    branches: ["main"]
+  workflow_dispatch: {}
 
 concurrency:
   cancel_in_progress: true
   group: ${{ workflow.filename }}-${{ github.ref }}
 
-defaults:
-  tools:
-    bun: latest
-
 jobs:
   precheck:
     name: Precheck
@@ -40,11 +31,11 @@ jobs:
       - uses: eas/checkout
       - uses: eas/install_node_modules
       - name: Typecheck
-        run: bun run typecheck
+        run: npm run typecheck
       - name: Lint
-        run: bun run lint
+        run: npm run lint
       - name: Test
-        run: bun run test
+        run: npm run test
 
   fingerprint:
     name: Fingerprint

package/dist/templates/default/.eas/workflows/release.yml

@@ -8,10 +8,6 @@ concurrency:
   cancel_in_progress: true
   group: ${{ workflow.filename }}-${{ github.ref }}
 
-defaults:
-  tools:
-    bun: latest
-
 jobs:
   precheck:
     name: Precheck
@@ -21,11 +17,11 @@ jobs:
       - uses: eas/checkout
       - uses: eas/install_node_modules
       - name: Typecheck
-        run: bun run typecheck
+        run: npm run typecheck
       - name: Lint
-        run: bun run lint
+        run: npm run lint
       - name: Test
-        run: bun run test
+        run: npm run test
 
   build_ios:
     name: Build iOS

package/dist/templates/default/.eas/workflows/rollback.yml

@@ -4,17 +4,21 @@ name: Rollback
 # canonical eas-cli surface:
 #
 #   "previous"  → republish an earlier update group on the same branch.
-#                 Picks the most recent successful update before the
-#                 currently-active one. Use this when a recent OTA broke
+#                 Requires the `group` input (the update-group ID): the
+#                 workflow runner has no TTY, and `update:republish --branch`
+#                 only works interactively, so `--group` is mandatory under
+#                 `--non-interactive`. Use this when a recent OTA broke
 #                 something users on previous builds didn't see.
 #                 Maps to `eas update:republish`.
 #                 https://docs.expo.dev/eas-update/rollbacks/
 #
 #   "embedded"  → roll back to the build's embedded bundle (the JS that
-#                 shipped with the .ipa). Effectively makes the next-OTA-check
-#                 ignore the current rollout and serve the binary as-is.
-#                 Use this when a broken OTA shouldn't ship to ANYONE on
-#                 that build. Maps to `eas update:roll-back-to-embedded`.
+#                 shipped with the .ipa). Requires the `runtime_version` input
+#                 (`--runtime-version` is mandatory under `--non-interactive`).
+#                 Effectively makes the next-OTA-check ignore the current
+#                 rollout and serve the binary as-is. Use this when a broken
+#                 OTA shouldn't ship to ANYONE on that build.
+#                 Maps to `eas update:roll-back-to-embedded`.
 #                 https://docs.expo.dev/eas-update/rollbacks/
 #
 # Pair with the asc-events workflow's Slack notify so the team knows.
@@ -28,7 +32,7 @@ on:
         required: true
       type:
         description: Rollback flavor
-        type: select
+        type: choice
         required: true
         default: previous
         options:
@@ -38,45 +42,67 @@ on:
         description: Optional message stored on the update group
         type: string
         required: false
+      group:
+        description: Update group ID to republish (required for the "previous" flavor)
+        type: string
+        required: false
+      runtime_version:
+        description: Build runtimeVersion to roll back to (required for the "embedded" flavor)
+        type: string
+        required: false
 
-concurrency:
-  cancel_in_progress: false
-  group: ${{ workflow.filename }}-${{ inputs.branch }}
-
-defaults:
-  tools:
-    bun: latest
+# No concurrency block on purpose. EAS only accepts `cancel_in_progress: true`
+# (and no custom group yet), but cancelling a half-applied rollback is worse than
+# letting two idempotent runs finish, so the no-block default (don't cancel) is
+# the correct behaviour here.
 
 jobs:
   rollback:
     name: Roll back ${{ inputs.branch }} (${{ inputs.type }})
     environment: ${{ inputs.branch == 'production' && 'production' || 'development' }}
     runs_on: linux-medium
+    # Inputs reach the script ONLY as env vars, never interpolated into the
+    # script body, so a branch/message containing shell metacharacters is treated
+    # as data, not code. argv is built as an array; no eval.
+    env:
+      ROLLBACK_BRANCH: ${{ inputs.branch }}
+      ROLLBACK_TYPE: ${{ inputs.type }}
+      ROLLBACK_MSG: ${{ inputs.message }}
+      ROLLBACK_GROUP: ${{ inputs.group }}
+      ROLLBACK_RUNTIME: ${{ inputs.runtime_version }}
     steps:
       - uses: eas/checkout
       - uses: eas/install_node_modules
       - name: Roll back
         run: |
-          MSG="${{ inputs.message }}"
-          MSG_ARG=""
-          if [ -n "$MSG" ]; then MSG_ARG="--message \"$MSG\""; fi
-          if [ "${{ inputs.type }}" = "embedded" ]; then
-            eval bunx eas-cli update:roll-back-to-embedded \
-              --branch "${{ inputs.branch }}" \
-              --platform ios \
-              --non-interactive \
-              $MSG_ARG
+          if [ "$ROLLBACK_TYPE" = "embedded" ]; then
+            # --runtime-version and --message are both required in non-interactive
+            # mode; the interactive runtime picker never runs on a TTY-less runner.
+            if [ -z "$ROLLBACK_RUNTIME" ]; then
+              echo "embedded rollback requires a 'runtime_version' input (the build's runtimeVersion)" >&2
+              exit 1
+            fi
+            msg="${ROLLBACK_MSG:-roll back to embedded}"
+            args=(--branch "$ROLLBACK_BRANCH" --platform ios --runtime-version "$ROLLBACK_RUNTIME" --message "$msg" --non-interactive)
+            npx eas-cli update:roll-back-to-embedded "${args[@]}"
           else
-            eval bunx eas-cli update:republish \
-              --branch "${{ inputs.branch }}" \
-              --platform ios \
-              --non-interactive \
-              $MSG_ARG
+            # update:republish --branch is interactive-only; a TTY-less runner
+            # must pass the update-group ID via --group.
+            if [ -z "$ROLLBACK_GROUP" ]; then
+              echo "previous rollback requires a 'group' input (the update-group ID to republish)" >&2
+              exit 1
+            fi
+            args=(--group "$ROLLBACK_GROUP" --platform ios --non-interactive)
+            if [ -n "$ROLLBACK_MSG" ]; then args+=(--message "$ROLLBACK_MSG"); fi
+            npx eas-cli update:republish "${args[@]}"
           fi
 
   notify:
     name: Notify Slack
     needs: [rollback]
+    # Paste a real `webhook_url` below and drop `false &&` to enable. EAS does
+    # not yet support interpolating `${{ env.* }}` into `webhook_url`.
+    if: ${{ false }}
     type: slack
     params:
       webhook_url: https://hooks.slack.com/services/REPLACE/ME/HERE

package/dist/templates/default/.eas/workflows/rollout.yml

@@ -1,22 +1,10 @@
 name: Rollout
 
-# Manually run a gradual rollout: publish a fresh OTA at a non-100%
-# percentage, or bump/lower the % of the most recent rollout group on a
-# branch. Mirrors the canonical EAS Update rollout flow:
-#   https://docs.expo.dev/eas-update/rollouts/
-#
-# Two paths, controlled by `action`:
-#
-#   "publish"  → `eas update --branch <b> --rollout-percentage <%>`
-#                Publishes a fresh OTA from the current HEAD at the given %.
-#                Use to start a new rollout (e.g. 5% → 25% → 100%).
-#
-#   "edit"     → `eas update:edit --branch <b> --rollout-percentage <%>`
-#                Bumps the percentage of the currently-active rollout group
-#                on the branch. Use to ramp an existing rollout.
-#
-# After confirming adoption looks healthy on the Insights dashboard, set
-# the rollout to 100. To kill a bad rollout, use the `rollback` workflow.
+# Two paths, controlled by `action`, mirroring the EAS Update rollout flow
+# (https://docs.expo.dev/eas-update/rollouts/):
+#   "publish" → `eas update` publishes a fresh OTA from HEAD at the given %.
+#   "edit"    → `eas update:edit` bumps the % of the active rollout group.
+# To kill a bad rollout, use the `rollback` workflow.
 
 on:
   workflow_dispatch:
@@ -28,7 +16,7 @@ on:
         default: production
       action:
         description: Publish a new rollout, or edit the % of the existing one
-        type: select
+        type: choice
         required: true
         default: edit
         options:
@@ -40,41 +28,47 @@ on:
         required: true
         default: 25
 
-concurrency:
-  cancel_in_progress: false
-  group: ${{ workflow.filename }}-${{ inputs.branch }}
-
-defaults:
-  tools:
-    bun: latest
+# No concurrency block on purpose. EAS only accepts `cancel_in_progress: true`
+# (and no custom group yet), but cancelling an in-flight rollout mid-publish is
+# worse than letting it finish, so the no-block default (don't cancel) is the
+# correct behaviour here.
 
 jobs:
   rollout:
     name: ${{ inputs.action }} → ${{ inputs.percentage }}% on ${{ inputs.branch }}
     environment: ${{ inputs.branch == 'production' && 'production' || 'development' }}
     runs_on: linux-medium
+    # Inputs reach the script only as env vars (never interpolated into the body)
+    # so a branch with shell metacharacters is treated as data, not code.
+    env:
+      ROLLOUT_BRANCH: ${{ inputs.branch }}
+      ROLLOUT_ACTION: ${{ inputs.action }}
+      ROLLOUT_PCT: ${{ inputs.percentage }}
     steps:
       - uses: eas/checkout
       - uses: eas/install_node_modules
       - name: Roll out
         run: |
-          if [ "${{ inputs.action }}" = "publish" ]; then
-            bunx eas-cli update \
-              --branch "${{ inputs.branch }}" \
+          if [ "$ROLLOUT_ACTION" = "publish" ]; then
+            npx eas-cli update \
+              --branch "$ROLLOUT_BRANCH" \
               --platform ios \
-              --rollout-percentage "${{ inputs.percentage }}" \
+              --rollout-percentage "$ROLLOUT_PCT" \
               --non-interactive \
-              --message "Rollout publish @ ${{ inputs.percentage }}%"
+              --message "Rollout publish @ ${ROLLOUT_PCT}%"
           else
-            bunx eas-cli update:edit \
-              --branch "${{ inputs.branch }}" \
-              --rollout-percentage "${{ inputs.percentage }}" \
+            npx eas-cli update:edit \
+              --branch "$ROLLOUT_BRANCH" \
+              --rollout-percentage "$ROLLOUT_PCT" \
               --non-interactive
           fi
 
   notify:
     name: Notify Slack
     needs: [rollout]
+    # Paste a real `webhook_url` below and drop `false &&` to enable. EAS does
+    # not yet support interpolating `${{ env.* }}` into `webhook_url`.
+    if: ${{ false }}
     type: slack
     params:
       webhook_url: https://hooks.slack.com/services/REPLACE/ME/HERE

package/dist/templates/default/.eas/workflows/rotate-apple-jwt.yml

@@ -25,16 +25,12 @@ on:
     - cron: "0 12 1 */3 *" # 12:00 UTC on the 1st, every 3rd month
   workflow_dispatch: {}
 
-defaults:
-  tools:
-    bun: latest
-
 jobs:
   rotate:
     name: Sign + push fresh client_secret
     type: custom
     runs_on: linux-medium
-    environment: production # pulls EAS env vars from production
+    environment: production
     steps:
       - uses: eas/checkout
       - uses: eas/install_node_modules

package/dist/templates/default/.eas/workflows/testflight.yml

@@ -19,10 +19,6 @@ concurrency:
   cancel_in_progress: true
   group: ${{ workflow.filename }}-${{ github.ref }}
 
-defaults:
-  tools:
-    bun: latest
-
 jobs:
   precheck:
     name: Precheck
@@ -32,11 +28,11 @@ jobs:
       - uses: eas/checkout
       - uses: eas/install_node_modules
       - name: Typecheck
-        run: bun run typecheck
+        run: npm run typecheck
       - name: Lint
-        run: bun run lint
+        run: npm run lint
       - name: Test
-        run: bun run test
+        run: npm run test
 
   build_ios:
     name: Build iOS