Merge pull request #1713 from selfxyz/release/staging-2026-02-06

Release to Staging - 2026-02-06

.github/workflows/mobile-ci.yml

@@ -5,7 +5,7 @@ env:
   RUBY_VERSION: 3.2
   JAVA_VERSION: 17
   ANDROID_NDK_VERSION: 27.0.12077973
-  XCODE_VERSION: 16.4
+  XCODE_VERSION: 26
   # Path configuration
   WORKSPACE: ${{ github.workspace }}
   APP_PATH: ${{ github.workspace }}/app

.github/workflows/mobile-deploy.yml

@@ -33,7 +33,7 @@ env:
   JAVA_VERSION: 17
   ANDROID_API_LEVEL: 35
   ANDROID_NDK_VERSION: 27.0.12077973
-  XCODE_VERSION: 16.4
+  XCODE_VERSION: 26
 
   # Cache versioning - increment these to bust caches when needed
   GH_CACHE_VERSION: v1 # Global cache version

.github/workflows/mobile-e2e.yml

@@ -5,7 +5,7 @@ env:
   JAVA_VERSION: 17
   ANDROID_API_LEVEL: 33
   ANDROID_NDK_VERSION: 27.0.12077973
-  XCODE_VERSION: 16.4
+  XCODE_VERSION: 26
   # Cache versions
   GH_CACHE_VERSION: v2 # Global cache version - bumped to invalidate caches
   GH_GEMS_CACHE_VERSION: v1 # Ruby gems cache version

.github/workflows/mobile-sdk-demo-e2e.yml

@@ -5,7 +5,7 @@ env:
   JAVA_VERSION: 17
   ANDROID_API_LEVEL: 33
   ANDROID_NDK_VERSION: 27.0.12077973
-  XCODE_VERSION: 16.4
+  XCODE_VERSION: 26
   # Cache versions
   GH_CACHE_VERSION: v1
   GH_GEMS_CACHE_VERSION: v1
@@ -457,7 +457,7 @@ jobs:
           fi
 
           FORCE_BUNDLING=1 RCT_NO_LAUNCH_PACKAGER=1 \
-            xcodebuild -workspace "$WORKSPACE_PATH" -scheme ${{ env.IOS_PROJECT_SCHEME }} -configuration Debug -destination "id=${{ env.IOS_SIMULATOR_ID }}" -derivedDataPath packages/mobile-sdk-demo/ios/build -jobs "$(sysctl -n hw.ncpu)" -parallelizeTargets -quiet COMPILER_INDEX_STORE_ENABLE=NO ONLY_ACTIVE_ARCH=YES SWIFT_COMPILATION_MODE=wholemodule || { echo "❌ iOS build failed"; exit 1; }
+            xcodebuild -workspace "$WORKSPACE_PATH" -scheme ${{ env.IOS_PROJECT_SCHEME }} -configuration Debug -destination "id=${{ env.IOS_SIMULATOR_ID }}" -derivedDataPath packages/mobile-sdk-demo/ios/build -jobs "$(sysctl -n hw.ncpu)" -parallelizeTargets -quiet COMPILER_INDEX_STORE_ENABLE=NO ONLY_ACTIVE_ARCH=YES SWIFT_COMPILATION_MODE=wholemodule 'SWIFT_ACTIVE_COMPILATION_CONDITIONS=$(inherited) E2E_TESTING' || { echo "❌ iOS build failed"; exit 1; }
           echo "✅ iOS build succeeded"
       - name: Build iOS Release Archive (unsigned)
         run: |

.github/workflows/npm-publish.yml

@@ -12,11 +12,26 @@ on:
       - "sdk/qrcode-angular/package.json"
       - "contracts/package.json"
   workflow_dispatch:
+    inputs:
+      strict_mode:
+        description: "Fail workflow on publish errors (false = continue on error)"
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   id-token: write # Required for OIDC
   contents: read
 
+# Error Handling Strategy:
+# - STRICT_PUBLISH_MODE controls whether publish failures stop the workflow
+# - Current (false): continue-on-error=true, workflow always succeeds
+# - Target (true): continue-on-error=false, fail on real errors (expired tokens, network issues)
+# - Manual override: Use workflow_dispatch with strict_mode input to test
+# TODO: Set STRICT_PUBLISH_MODE=true once NPM token is rotated and verified
+env:
+  STRICT_PUBLISH_MODE: false
+
 jobs:
   detect-changes:
     runs-on: ubuntu-latest
@@ -86,8 +101,21 @@ jobs:
         run: |
           yarn workspace @selfxyz/core build:deps
 
+      - name: Check NPM Token
+        id: check-token
+        run: |
+          if [ -z "${{ secrets.NPM_TOKEN }}" ]; then
+            echo "⚠️ Warning: NPM_TOKEN is not set. Skipping publish."
+            echo "token_available=false" >> $GITHUB_OUTPUT
+          else
+            echo "token_available=true" >> $GITHUB_OUTPUT
+          fi
+
       - name: Publish to npm
+        if: steps.check-token.outputs.token_available == 'true'
         working-directory: sdk/core
+        continue-on-error: ${{ github.event.inputs.strict_mode != 'true' && env.STRICT_PUBLISH_MODE != 'true' }}
+        id: publish
         run: |
           yarn config set npmPublishAccess public
           yarn npm publish --access public
@@ -95,6 +123,17 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
+      - name: Publish result
+        if: always()
+        run: |
+          if [ "${{ steps.check-token.outputs.token_available }}" != "true" ]; then
+            echo "::warning::NPM publish skipped - NPM_TOKEN not configured. Please rotate the token in repository secrets."
+          elif [ "${{ steps.publish.outcome }}" != "success" ]; then
+            echo "::warning::NPM publish failed - This may be due to an expired or invalid NPM_TOKEN. Please check and rotate the token."
+          else
+            echo "✅ Package published successfully"
+          fi
+
   publish-qrcode:
     needs: detect-changes
     if: needs.detect-changes.outputs.qrcode_changed == 'true'
@@ -114,8 +153,21 @@ jobs:
         run: |
           yarn workspace @selfxyz/qrcode build:deps
 
+      - name: Check NPM Token
+        id: check-token
+        run: |
+          if [ -z "${{ secrets.NPM_TOKEN }}" ]; then
+            echo "⚠️ Warning: NPM_TOKEN is not set. Skipping publish."
+            echo "token_available=false" >> $GITHUB_OUTPUT
+          else
+            echo "token_available=true" >> $GITHUB_OUTPUT
+          fi
+
       - name: Publish to npm
+        if: steps.check-token.outputs.token_available == 'true'
         working-directory: sdk/qrcode
+        continue-on-error: ${{ github.event.inputs.strict_mode != 'true' && env.STRICT_PUBLISH_MODE != 'true' }}
+        id: publish
         run: |
           yarn config set npmPublishAccess public
           yarn npm publish --access public
@@ -123,6 +175,17 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
+      - name: Publish result
+        if: always()
+        run: |
+          if [ "${{ steps.check-token.outputs.token_available }}" != "true" ]; then
+            echo "::warning::NPM publish skipped - NPM_TOKEN not configured. Please rotate the token in repository secrets."
+          elif [ "${{ steps.publish.outcome }}" != "success" ]; then
+            echo "::warning::NPM publish failed - This may be due to an expired or invalid NPM_TOKEN. Please check and rotate the token."
+          else
+            echo "✅ Package published successfully"
+          fi
+
   publish-common:
     needs: detect-changes
     if: needs.detect-changes.outputs.common_changed == 'true'
@@ -141,14 +204,38 @@ jobs:
         run: |
           yarn workspace @selfxyz/common build
 
+      - name: Check NPM Token
+        id: check-token
+        run: |
+          if [ -z "${{ secrets.NPM_TOKEN }}" ]; then
+            echo "⚠️ Warning: NPM_TOKEN is not set. Skipping publish."
+            echo "token_available=false" >> $GITHUB_OUTPUT
+          else
+            echo "token_available=true" >> $GITHUB_OUTPUT
+          fi
+
       - name: Publish to npm
+        if: steps.check-token.outputs.token_available == 'true'
         working-directory: common
+        continue-on-error: ${{ github.event.inputs.strict_mode != 'true' && env.STRICT_PUBLISH_MODE != 'true' }}
+        id: publish
         run: |
           yarn config set npmPublishAccess public
           yarn npm publish --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish result
+        if: always()
+        run: |
+          if [ "${{ steps.check-token.outputs.token_available }}" != "true" ]; then
+            echo "::warning::NPM publish skipped - NPM_TOKEN not configured. Please rotate the token in repository secrets."
+          elif [ "${{ steps.publish.outcome }}" != "success" ]; then
+            echo "::warning::NPM publish failed - This may be due to an expired or invalid NPM_TOKEN. Please check and rotate the token."
+          else
+            echo "✅ Package published successfully"
+          fi
   publish-contracts:
     needs: detect-changes
     if: needs.detect-changes.outputs.contracts_changed == 'true'
@@ -165,14 +252,38 @@ jobs:
       - name: Build package
         run: |
           yarn workspace @selfxyz/contracts build
+      - name: Check NPM Token
+        id: check-token
+        run: |
+          if [ -z "${{ secrets.NPM_TOKEN }}" ]; then
+            echo "⚠️ Warning: NPM_TOKEN is not set. Skipping publish."
+            echo "token_available=false" >> $GITHUB_OUTPUT
+          else
+            echo "token_available=true" >> $GITHUB_OUTPUT
+          fi
+
       - name: Publish to npm
+        if: steps.check-token.outputs.token_available == 'true'
         working-directory: contracts
+        continue-on-error: ${{ github.event.inputs.strict_mode != 'true' && env.STRICT_PUBLISH_MODE != 'true' }}
+        id: publish
         run: |
           yarn config set npmPublishAccess public
           yarn npm publish --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish result
+        if: always()
+        run: |
+          if [ "${{ steps.check-token.outputs.token_available }}" != "true" ]; then
+            echo "::warning::NPM publish skipped - NPM_TOKEN not configured. Please rotate the token in repository secrets."
+          elif [ "${{ steps.publish.outcome }}" != "success" ]; then
+            echo "::warning::NPM publish failed - This may be due to an expired or invalid NPM_TOKEN. Please check and rotate the token."
+          else
+            echo "✅ Package published successfully"
+          fi
   publish-qrcode-angular:
     needs: detect-changes
     if: needs.detect-changes.outputs.qrcode_angular_changed == 'true'
@@ -192,8 +303,21 @@ jobs:
         run: |
           yarn workspace @selfxyz/qrcode-angular build:deps
 
+      - name: Check NPM Token
+        id: check-token
+        run: |
+          if [ -z "${{ secrets.NPM_TOKEN }}" ]; then
+            echo "⚠️ Warning: NPM_TOKEN is not set. Skipping publish."
+            echo "token_available=false" >> $GITHUB_OUTPUT
+          else
+            echo "token_available=true" >> $GITHUB_OUTPUT
+          fi
+
       - name: Publish to npm
+        if: steps.check-token.outputs.token_available == 'true'
         working-directory: sdk/qrcode-angular
+        continue-on-error: ${{ github.event.inputs.strict_mode != 'true' && env.STRICT_PUBLISH_MODE != 'true' }}
+        id: publish
         run: |
           yarn config set npmPublishAccess public
           yarn npm publish --access public
@@ -201,6 +325,17 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
+      - name: Publish result
+        if: always()
+        run: |
+          if [ "${{ steps.check-token.outputs.token_available }}" != "true" ]; then
+            echo "::warning::NPM publish skipped - NPM_TOKEN not configured. Please rotate the token in repository secrets."
+          elif [ "${{ steps.publish.outcome }}" != "success" ]; then
+            echo "::warning::NPM publish failed - This may be due to an expired or invalid NPM_TOKEN. Please check and rotate the token."
+          else
+            echo "✅ Package published successfully"
+          fi
+
   publish-msdk:
     needs: detect-changes
     if: needs.detect-changes.outputs.msdk_changed == 'true'
@@ -221,11 +356,35 @@ jobs:
           yarn workspace @selfxyz/common build
           yarn workspace @selfxyz/mobile-sdk-alpha build
 
+      - name: Check NPM Token
+        id: check-token
+        run: |
+          if [ -z "${{ secrets.NPM_TOKEN }}" ]; then
+            echo "⚠️ Warning: NPM_TOKEN is not set. Skipping publish."
+            echo "token_available=false" >> $GITHUB_OUTPUT
+          else
+            echo "token_available=true" >> $GITHUB_OUTPUT
+          fi
+
       - name: Publish to npm
+        if: steps.check-token.outputs.token_available == 'true'
         working-directory: packages/mobile-sdk-alpha
+        continue-on-error: ${{ github.event.inputs.strict_mode != 'true' && env.STRICT_PUBLISH_MODE != 'true' }}
+        id: publish
         run: |
           yarn config set npmPublishAccess restricted
           yarn npm publish --access restricted --tag alpha
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish result
+        if: always()
+        run: |
+          if [ "${{ steps.check-token.outputs.token_available }}" != "true" ]; then
+            echo "::warning::NPM publish skipped - NPM_TOKEN not configured. Please rotate the token in repository secrets."
+          elif [ "${{ steps.publish.outcome }}" != "success" ]; then
+            echo "::warning::NPM publish failed - This may be due to an expired or invalid NPM_TOKEN. Please check and rotate the token."
+          else
+            echo "✅ Package published successfully"
+          fi