Bifrost Android builds do not configure Composer GitHub auth (iOS does)

[philippspeck]

What were you trying to do?

Build the same NativePHP app on Bifrost for both iOS and Android. The app depends on a private GitHub Composer package (VCS repository in composer.json / dist zipball in composer.lock). Locally there is also a path repository for a sibling directory that does not exist in a Bifrost clone of the app repo.

What happened?

iOS Bifrost builds succeed. Android Bifrost builds fail during composer install.

The iOS pipeline (macOS builder) explicitly configures Composer to use the GitHub App token and strips local path repositories. After that, Composer can download the private GitHub package from dist. Relevant iOS log lines:

[install] Configuring GitHub authentication for Composer
[install] GitHub authentication configured for Composer
[install] Detected local path repositories in composer.json
[install] Removing local path repositories
[install] GitHub token available for Composer

The Android pipeline (Linux CodeBuild) does not do this. It only configures NativePHP Composer credentials (http-basic.nativephp.composer.sh) and then runs composer install. The GitHub zipball request is unauthenticated. GitHub returns HTTP 404 for private repos in that case (not 401), and Composer aborts because source fallback is disabled (preferred-install: dist):

Failed to download <private-package> from dist:
The "https://api.github.com/repos/<org>/<repo>/zipball/<sha>"
file could not be downloaded (HTTP/2 404)
Source fallback is disabled. Not trying alternative sources.

The Android job already has a GitHub token (it is used to clone the app repo). It is just never passed to Composer.

How to reproduce the bug

1. App composer.json includes a private GitHub VCS repository (and optionally a path repo pointing at a sibling directory that Bifrost does not clone).
2. composer.lock pins that package to a GitHub dist zipball.
3. Trigger a Bifrost iOS build of the same branch → Composer install succeeds.
4. Trigger a Bifrost Android build of the same branch → Composer install fails with a GitHub zipball 404.

Workaround that confirms the diagnosis: a Bifrost custom build command on Android that configures Composer GitHub HTTP basic auth with the existing GitHub token (x-access-token). After adding that, the Android build proceeds past Composer install.

Expected behavior

The Android CodeBuild script should match the iOS builder:

1. Configure Composer GitHub auth from the existing GitHub App token before composer install.
2. Remove local path repositories from composer.json when those paths are not present in the clone (iOS already does this).

Debug Output

N/A — this is a Bifrost cloud build failure, not a local native:run. php artisan native:debug is not part of the failing step.

Relevant environment from the build logs:

• Bifrost Android: AWS CodeBuild (Linux), PHP 8.4, Composer 2.10.1
• Bifrost iOS: macOS builder, PHP 8.4, Composer 2.10.1
• nativephp/mobile 3.3.x

Which operating systems have you seen this occur on?

• Linux (Bifrost Android / CodeBuild)
• macOS (Bifrost iOS builder — works)

Which platforms were you trying to build for?

• Android (Bifrost signed AAB/APK)
• iOS (Bifrost App Store) — succeeds

Notes

Please do not request a reproduction repo; this is a pipeline gap between the two Bifrost install scripts, independent of app code.