EAS CD fingerprinting fails when using file-based secrets for Android configuration

[tharakadesilva]

Topic and scope of discussion

EAS CD fingerprint validation fails when using file-based secrets due to path differences between GitHub CI environment and EAS build environment

Motivation

The continuous deployment process is breaking because the fingerprint generated in the GitHub CI environment doesn't match the fingerprint calculated during the EAS build when using file-based secrets. This prevents successful deployment of builds even when there are no actual changes to the application code.

Additional context

I'm encountering an issue with the continuous deployment fingerprinting system when trying to securely handle the google-services.json file for Android builds.

Current Setup:

1. Using expo-github-action/continuous-deploy-fingerprint for CD
2. Following security best practices by not committing google-services.json to git
3. Implemented the recommended approach of using environment variables (https://docs.expo.dev/eas/environment-variables/#file-environment-variables):

   googleServicesFile: process.env.GOOGLE_SERVICES_JSON || "./google-services.json"

4. Created a file-based secret using EAS:

   eas secret:create --scope project --name GOOGLE_SERVICES_JSON --type file --value ./google-services.json

Problem:
The fingerprint validation fails because:

1. In the GitHub CI environment, the fingerprint is calculated using one file path configuration
2. When the build runs in EAS, the secret is materialized to a different random file path
3. This path difference in app.config.js causes the fingerprints to mismatch
4. As a result, EAS build fails with a fingerprint validation error

Questions:

1. What's the recommended way to handle file-based secrets with the fingerprinting system to ensure consistent paths between CI and EAS environments?
2. Should the fingerprinting system ignore or normalize paths for file-based secrets?
3. Are there alternative approaches to managing the google-services.json file that would work better with the fingerprinting system?