Make Android native deploys update-only and target-frozen

.credo.exs

@@ -2,6 +2,10 @@
   configs: [
     %{
       name: "default",
+      # ex_slop is a credo PLUGIN (registers its whole check bundle), not a
+      # check — listing it under checks.enabled was silently ignored
+      # ("Ignoring an undefined check: ExSlop").
+      plugins: [{ExSlop, []}],
       files: %{
         included: ["lib/", "test/"],
         excluded: [~r"/_build/", ~r"/deps/"]
@@ -22,11 +26,11 @@
           # jump_credo_checks — LiveView specific
           {Jump.CredoChecks.AssertElementSelectorCanNeverFail, []},
           {Jump.CredoChecks.AvoidSocketAssignsInTest, []},
-          {Jump.CredoChecks.LiveViewFormCanBeRehydrated, []},
+          {Jump.CredoChecks.LiveViewFormCanBeRehydrated, []}
         ],
         disabled: [
           # Pipes with single function calls are fine in this codebase
-          {Credo.Check.Readability.SinglePipe, []},
+          {Credo.Check.Readability.SinglePipe, []}
         ]
       }
     }

.formatter.exs

@@ -0,0 +1,3 @@
+[
+  inputs: ["{mix,.formatter}.exs", "{config,lib,test}/**/*.{ex,exs}"]
+]

.githooks/pre-push

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# .githooks/pre-push — Mob repo pre-push gate.
+#
+# Activated per-clone with: git config core.hooksPath .githooks
+# See RELEASE.md for the full release flow + when this hook runs.
+#
+# Two tiers of check:
+#
+#   ALWAYS (cheap, sub-10s):
+#     mix format --check-formatted
+#     mix credo --strict
+#     mix compile --warnings-as-errors
+#
+#   ONLY WHEN mix.exs CHANGED IN THIS PUSH (release preflight):
+#     mix test --exclude macos_only --exclude requires_zig
+#
+# Intentionally NOT in the always-tier: the full test suite. It's a
+# 30-60s wait per push and that's exactly what teaches people to reach
+# for --no-verify. CI runs the suite on every push regardless; this
+# hook is here to catch the 80% of breaks that the fast checks find.
+set -euo pipefail
+
+# Suppress noisy OTP-28 regex warning so the hook output is clean.
+export ELIXIR_ERL_OPTIONS="-elixir ansi_enabled true"
+
+cheap_checks() {
+    echo "[pre-push] format..."
+    mix format --check-formatted
+
+    echo "[pre-push] credo..."
+    mix credo --strict
+
+    echo "[pre-push] compile (--warnings-as-errors)..."
+    mix compile --warnings-as-errors
+}
+
+release_preflight() {
+    echo "[pre-push] mix.exs changed → running release preflight..."
+    mix test --exclude macos_only --exclude requires_zig
+
+    # mix mob.security_scan only exists in mob_dev. Gate on availability
+    # so the same hook script can live unchanged in mob / mob_dev / mob_new.
+    if mix help mob.security_scan >/dev/null 2>&1; then
+        echo "[pre-push] mob.security_scan..."
+        mix mob.security_scan
+    fi
+}
+
+# git invokes pre-push with no args but pipes
+#   <local_ref> <local_sha> <remote_ref> <remote_sha>
+# on stdin, one line per ref being pushed. We diff the local sha
+# against the remote sha to see what mix.exs looks like in this push.
+zero=0000000000000000000000000000000000000000
+mix_exs_changed=false
+
+while read -r local_ref local_sha remote_ref remote_sha; do
+    # Branch deletion (local_sha all zeros) → nothing to diff.
+    [ "$local_sha" = "$zero" ] && continue
+
+    if [ "$remote_sha" = "$zero" ]; then
+        # New branch on the remote — diff against origin/master so we
+        # don't try to scan an open-ended commit range.
+        range="origin/master..$local_sha"
+    else
+        range="$remote_sha..$local_sha"
+    fi
+
+    if git diff --name-only "$range" 2>/dev/null | grep -qx 'mix.exs'; then
+        mix_exs_changed=true
+    fi
+done
+
+cheap_checks
+
+if [ "$mix_exs_changed" = "true" ]; then
+    release_preflight
+fi
+
+echo "[pre-push] ✓ all checks passed"

.github/workflows/release.yml

@@ -0,0 +1,156 @@
+name: release
+
+# Trigger model: mix.exs is the source of truth for the version. Bump the
+# `version: "X.Y.Z"` line, commit, push — the workflow detects the change,
+# tags it, creates the GitHub Release, and publishes to Hex.
+#
+# Re-running manually (e.g. to back-fill a Hex publish that was skipped
+# because the tag pre-existed) is via the Actions tab's "Run workflow"
+# button (workflow_dispatch). Each step is independently idempotent:
+# tag-already-exists, release-already-exists, and version-already-on-Hex
+# are each detected per-step, so re-runs only do work that's actually
+# missing.
+on:
+  push:
+    branches: [master]
+    paths: ['mix.exs']
+  workflow_dispatch:
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write   # required to create the GitHub Release AND push the tag
+
+jobs:
+  release:
+    name: Release from mix.exs
+    runs-on: ubuntu-latest
+    env:
+      # Reads the repo secret. Steps that need it gate on
+      # `env.HEX_API_KEY != ''` so a missing secret skips cleanly instead
+      # of failing with an auth error.
+      HEX_API_KEY: ${{ secrets.HEX_API_KEY }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # full history for changelog generation
+
+      - name: Configure git identity (for the tag push below)
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Extract version from mix.exs
+        id: version
+        run: |
+          # Pull the `version: "X.Y.Z"` from the project/0 keyword list.
+          # Tolerates leading whitespace, expects a literal double-quoted
+          # string (Elixir-mix convention).
+          version=$(grep -E '^\s*version:\s*"' mix.exs | head -1 | sed 's/.*"\([^"]*\)".*/\1/')
+          if [ -z "$version" ]; then
+            # `version: @version` idiom — read the module attribute instead.
+            version=$(grep -E '^\s*@version\s+"' mix.exs | head -1 | sed 's/.*"\([^"]*\)".*/\1/')
+          fi
+          if [ -z "$version" ]; then
+            echo "::error::Could not extract version from mix.exs"
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "Detected version: $version"
+
+      # ── Tag (idempotent: skip if exists) ────────────────────────────
+      - name: Create + push tag (if missing)
+        run: |
+          tag="${{ steps.version.outputs.version }}"
+          if git rev-parse "refs/tags/$tag" >/dev/null 2>&1; then
+            echo "::notice::Tag $tag already exists — skipping tag creation"
+          else
+            git tag "$tag"
+            git push origin "$tag"
+            echo "Created and pushed tag $tag"
+          fi
+
+      # ── GitHub Release (idempotent: skip if exists) ─────────────────
+      - name: Check if GitHub Release exists
+        id: release_check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          tag="${{ steps.version.outputs.version }}"
+          if gh release view "$tag" -R "${{ github.repository }}" >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "::notice::GitHub Release $tag already exists — skipping release creation"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Extract CHANGELOG section
+        if: steps.release_check.outputs.exists == 'false'
+        id: changelog
+        run: |
+          if [ -f CHANGELOG.md ]; then
+            awk -v tag="${{ steps.version.outputs.version }}" '
+              $0 ~ "^## \\[" tag "\\]" || $0 ~ "^## " tag "( |$)" { in_section=1; next }
+              in_section && /^## / { exit }
+              in_section { print }
+            ' CHANGELOG.md > /tmp/release-body.md
+            if [ -s /tmp/release-body.md ]; then
+              echo "has_body=true" >> "$GITHUB_OUTPUT"
+            else
+              echo "has_body=false" >> "$GITHUB_OUTPUT"
+            fi
+          else
+            echo "has_body=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create GitHub Release
+        if: steps.release_check.outputs.exists == 'false'
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.version.outputs.version }}
+          name: ${{ steps.version.outputs.version }}
+          body_path: ${{ steps.changelog.outputs.has_body == 'true' && '/tmp/release-body.md' || '' }}
+          generate_release_notes: ${{ steps.changelog.outputs.has_body != 'true' }}
+
+      # ── Hex publish (idempotent: skip if version already on Hex) ────
+      - name: Set up BEAM
+        if: env.HEX_API_KEY != ''
+        uses: erlef/setup-beam@v1
+        with:
+          elixir-version: '1.19'
+          otp-version: '28'
+
+      - name: Check if version is already on Hex
+        if: env.HEX_API_KEY != ''
+        id: hex_check
+        run: |
+          # `mix hex.info <pkg> <vsn>` exits 0 if the version is published,
+          # non-zero otherwise. The package name is the project's `app:` value
+          # in mix.exs — same heuristic as for the version extract.
+          pkg=$(grep -E '^\s*app:\s*:' mix.exs | head -1 | sed 's/.*:\s*:\([a-z_][a-z0-9_]*\).*/\1/')
+          vsn="${{ steps.version.outputs.version }}"
+          if mix hex.info "$pkg" "$vsn" 2>/dev/null | grep -q "Config:"; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "::notice::Hex package $pkg $vsn already published — skipping mix hex.publish"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "package=$pkg" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: mix hex.publish
+        if: env.HEX_API_KEY != '' && steps.hex_check.outputs.exists == 'false'
+        # `--yes` skips the interactive confirm. `mix hex.publish` (no
+        # subcommand) ships both the package archive AND docs in one call.
+        run: |
+          mix deps.get
+          mix hex.publish --yes
+
+      - name: Skip Hex publish notice (no API key)
+        if: env.HEX_API_KEY == ''
+        run: |
+          echo "::notice::HEX_API_KEY secret is not set on this repository."
+          echo "::notice::Skipping Hex publish. Add the secret at"
+          echo "::notice::https://github.com/${{ github.repository }}/settings/secrets/actions"
+          echo "::notice::and re-run the workflow (Actions tab → Run workflow) to publish."

.github/workflows/test.yml

@@ -0,0 +1,125 @@
+name: tests
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: tests-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Elixir ${{ matrix.elixir }} / OTP ${{ matrix.otp }}
+    runs-on: ubuntu-latest
+    env:
+      MIX_ENV: test
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - elixir: '1.19'
+            otp: '28'
+    steps:
+      - uses: actions/checkout@v4
+
+      # mob.adopt's native (--android/--ios) tests render from mob_new's
+      # templates — mob_new is the single source, not duplicated here. Provide
+      # a mob_new checkout so MobDev.Adopt.Generator resolves them via
+      # MOB_NEW_DIR (mirrors a user having the mob_new archive installed).
+      - name: Checkout mob_new (native adopt templates)
+        uses: actions/checkout@v4
+        with:
+          repository: GenericJam/mob_new
+          path: mob_new
+
+      - uses: erlef/setup-beam@v1
+        with:
+          elixir-version: ${{ matrix.elixir }}
+          otp-version: ${{ matrix.otp }}
+
+      - name: Cache deps + _build
+        uses: actions/cache@v4
+        with:
+          path: |
+            deps
+            _build
+          key: mix-${{ runner.os }}-${{ matrix.elixir }}-${{ matrix.otp }}-${{ hashFiles('**/mix.lock') }}
+          restore-keys: mix-${{ runner.os }}-${{ matrix.elixir }}-${{ matrix.otp }}-
+
+      - run: mix deps.get
+      - run: mix deps.compile
+      - run: mix compile --warnings-as-errors
+
+      # Some HotPush tests inspect `_build/dev/lib/*/ebin/*.beam` to verify
+      # which runtime BEAMs the `mix mob.push` helper would ship to a device.
+      # Under MIX_ENV=test the dev tree doesn't exist; pre-populate it so
+      # those tests have something to look at.
+      - name: Compile :dev tree (for HotPush tests)
+        env:
+          MIX_ENV: dev
+        run: mix compile
+
+      - name: Format check
+        run: mix format --check-formatted
+
+      - name: Credo (strict)
+        run: mix credo --strict
+
+      - name: Tests
+        env:
+          # mob.adopt native tests resolve mob_new's templates from this checkout.
+          MOB_NEW_DIR: ${{ github.workspace }}/mob_new
+        # `:macos_only` — tests that shell out to /usr/libexec/PlistBuddy
+        # and similar macOS-bound tools.
+        # `:requires_zig` — the StaticNifs zig-ast-check round-trip; we
+        # don't install Zig in CI yet (it's a 30 MB download for one test).
+        # Both run by default on a maintainer's laptop; CI explicitly skips.
+        run: mix test --exclude macos_only --exclude requires_zig
+
+  security_scan:
+    name: Security scan
+    needs: test
+    runs-on: ubuntu-latest
+    if: always()
+    # Informational: a finding shouldn't block the workflow gate while we
+    # establish a baseline. Flip to `--strict` once we've triaged what's
+    # already in the dep tree.
+    continue-on-error: true
+    env:
+      MIX_ENV: test
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: erlef/setup-beam@v1
+        with:
+          elixir-version: '1.19'
+          otp-version: '28'
+
+      - name: Cache deps + _build (reuse test job's key)
+        uses: actions/cache@v4
+        with:
+          path: |
+            deps
+            _build
+          key: mix-${{ runner.os }}-1.19-28-${{ hashFiles('**/mix.lock') }}
+          restore-keys: mix-${{ runner.os }}-1.19-28-
+
+      - run: mix deps.get
+      - run: mix deps.compile
+
+      # osv-scanner is an optional external tool the scanner consumes when
+      # available. Missing tools are reported as soft warnings (not failures).
+      - name: Install osv-scanner
+        run: |
+          curl -sSfL https://github.com/google/osv-scanner/releases/latest/download/osv-scanner_linux_amd64 \
+            -o /usr/local/bin/osv-scanner
+          chmod +x /usr/local/bin/osv-scanner
+          osv-scanner --version
+
+      - name: mix mob.security_scan
+        # The hex_deps layer applies to mob_dev itself; the gradle / swift /
+        # bundled_runtime layers no-op (mob_dev has no native surface).
+        run: mix mob.security_scan

.tool-versions

@@ -0,0 +1,3 @@
+elixir 1.20.0-otp-29
+erlang 29.0
+zig 0.17.0-dev.269+ebff43698