Let EAS Workflows jobs publish to and roll out on protected channels
Matthew Lieder
Protected channels and EAS Workflows can't currently be used together. Workflow jobs run with at most Developer-level permissions, even when an Owner starts the run. So the built-in update and update-rollout jobs fail on a protected channel with:
Entity Not Authorized: Updating this channel requires the Release Manager role or higher since it is a protected channel.
That leaves two choices. You can remove protection from your production channel, or you can move the production OTA rollout out of EAS Workflows entirely. We chose to remove protection so we could keep our pipeline, and that gives up exactly the safeguard protected channels exist to provide.
Our use case: our production workflow publishes a JS-only hotfix to 10% of the production channel. It waits for a 24-hour monitoring window and then rolls out to 100%. Both steps sit behind require-approval jobs. We'd like to keep production protected so nobody can publish to it by hand with Developer access, while the reviewed and approved workflow can still ship.
Possible approaches (any of these would solve it for us):
- Elevated permissions on specific jobs: for example, a permissions key on a job that grants Release Manager-level access to protected channels. Only an Admin or Owner could add or approve it in the workflow file.
- Approval-based elevation: when a Release Manager or higher approves a require-approval job, the jobs that depend on it run with that approver's permissions for protected resources. This fits how release gates already work.
- Robot tokens in workflows: let a job authenticate as a robot user with the Release Manager role, through an EXPO_TOKEN stored in EAS environment variables, and use that robot's role instead of the Developer-level limit.
Option 2 fits our setup best, because the approval step is already our human check before anything reaches production.
Expo support (Sarah) confirmed this is a known limitation and said you're exploring a way to opt specific jobs into higher permissions, so please count this as a vote for that.