Provision GitHub secrets EXPO_TOKEN + ANDROID_GOOGLE_SERVICE_ACCOUNT_KEY

[thefiredev-cloud]

Context

CI workflows for EAS iOS builds and Android release require these secrets. Without them, the Android CI workflow added in 1f0da68 will fail.

Acceptance criteria

• EXPO_TOKEN set in repo secrets (from Expo CLI expo whoami)
• ANDROID_GOOGLE_SERVICE_ACCOUNT_KEY set (base64 of service account JSON)
• Android workflow passes on next push to main
• Document rotation cadence (90 days)

Blocker

Manual action required (access to Expo + Google Play console).

Related planning docs

• docs/EAS_SETUP.md

[thefiredev-cloud]

Partial scope clarification 2026-04-23

Split this into two sub-tasks since the secrets have different blockers:

EXPO_TOKEN — User has this

• Tanner has access to Expo CLI (expo whoami confirms the account).
• Set in GH repo settings → Actions → Secrets → EXPO_TOKEN.
• Value: output of expo login token or from https://expo.dev/accounts/tannero19/settings/access-tokens
• Rotation cadence: 90 days.

ANDROID_GOOGLE_SERVICE_ACCOUNT_KEY — Deferred

• User does not currently have Android Google Play service account key.
• Requires: Google Play Console setup → API access → service account JSON → base64-encode.
• Not needed until Android app is ready to submit. Defer until Android ingestion becomes priority.

Reduced acceptance criteria (partial completion)

• EXPO_TOKEN set in GH repo secrets
• iOS EAS workflow passes on next push to main
• ANDROID_GOOGLE_SERVICE_ACCOUNT_KEY → deferred to a separate issue when Android is ready
• Android workflow (not gating iOS release) — continue to fail until Android SAK is provisioned; acceptable.

Rename this issue to "Provision GitHub secret EXPO_TOKEN (iOS release)" or close partial and open a new Android-specific issue — user decision.