chore: pin geofence native SDK versions and example test wiring

[mrehan27]

Summary

Wires the geofence feature to the native SDK versions that will ship it, and makes the example app buildable/testable against the pre-release native builds — including publishing this PR's sample builds to the feature-branch distribution channel so subscribed peers can test geofence before release.

Targets feature/geofence-on-device, not main. Nothing is released here.

⚠️ Read this first — two commits, one is temporary

This PR is intentionally two commits that must not be squashed:

Commit 1 — the real change we keep. Pins the native SDK versions that will contain geofence:

• android/gradle.properties: cioSDKVersionAndroid → 4.20.0
• package.json: cioNativeiOSSdkVersion → = 4.7.0

These versions aren't published yet, which is why Commit 2 exists.

Commit 2 — temporary test/CI scaffolding, reverted when native goes live. It only touches the example app, the iOS version pin, and one CI line:

• example/android/build.gradle: snapshot Maven repo → central.sonatype.com/repository/maven-snapshots
• example/android/gradle.properties: example uses cioSDKVersionAndroid=feature-geofence-on-device-SNAPSHOT
• example/ios/Podfile: load the geofence-aware CocoaPods override and build the app target against the customerio-ios main branch (geofence is merged there) via a single cio_ios_sdk_branch variable — for a future unreleased feature, change only that one line — plus an explicit CustomerIO/LocationGeofence git pod (the umbrella subspec isn't on the released trunk spec yet)
• package.json: temporarily pins cioNativeiOSSdkVersion to = 4.6.1 (customerio-ios main's current podspec version) so CocoaPods can resolve — deliberately undoes Commit 1's iOS bump for testing only
• .github/workflows/build-sample-app.yml: publish this PR branch's sample builds to the feature-branch Firebase channel (see below)

Reverting Commit 2 restores Commit 1's production state exactly (package.json → = 4.7.0, no example/CI scaffolding).

Note for reviewers

Commit 2 is temporary test-only scaffolding — the downgraded iOS pin, the -SNAPSHOT Android version, the snapshot repo, the git-branch pods, and the feature-channel CI line are all intentional and get reverted before this reaches main. Please don't flag them as defects.

Feature builds for peers 📱

Native geofence is still pre-release, so the released SDKs can't build the example and the normal feature/* sample builds fail. This PR's CI builds against the pre-release native and pushes the sample apps to the feature-branch Firebase channel — that's where peers subscribed to feature builds should get geofence test builds until native ships.

iOS builds against customerio-ios main and passes. Android has no native main snapshot yet, so the Android sample build is expected to fail until native Android releases geofence — that's understood and not a defect in this PR.

Merge plan

This PR stays open while native geofence is pre-release — it's the source of feature-channel builds. When native iOS 4.7.0 / Android 4.20.0 are released, Commit 2 is reverted entirely and only Commit 1 is merged into feature/geofence-on-device — Commit 2 never lands on the feature branch.

Requires (native)

• customerio-android#768 — ships in Android 4.20.0
• customerio-ios#1140 — ships in iOS 4.7.0

Ticket

MBL-1785 — React Native: add geofencing support

PR stack

1. chore: add geofence module base #605 — geofence module base
2. chore: register geofence module and treat geofence as implying location #606 — register geofence module + geofence implies Location
3. chore: add iOS allowBackgroundDelivery config for geofence #607 — iOS allowBackgroundDelivery config
4. chore: enable geofence in the example app #608 — enable geofence in the example app
5. 👉 This PR — native SDK version pins + temporary feature-build/CI wiring

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes native SDK version pins and build/CI distribution paths; risk is mostly confined to example apps and pre-release tooling, not production customer integration defaults beyond the Android pin.

Overview
Bumps the shipping Android native dependency to 4.20.0 in android/gradle.properties for geofence support, and adds temporary scaffolding so the example app and CI can exercise geofence before those natives are on Maven/CocoaPods trunk.

The example Android build switches to Sonatype’s snapshot repo and feature-geofence-on-device-SNAPSHOT; the iOS Podfile builds against a configurable customerio-ios git branch (main in this diff) with non-production CocoaPods overrides and an explicit CustomerIO/LocationGeofence git pod. package.json’s cioNativeiOSSdkVersion moves to 4.6.1 (test resolution, not the final 4.7.0 ship pin described in the PR body). Sample-app CI also publishes builds from PR head branch mbl-1785-geofence-final to the feature-branch Firebase distribution group.

All example/CI/pod snapshot pieces are marked TEMP and intended to be reverted once native Android 4.20.0 / iOS 4.7.0 release.

^{Reviewed by Cursor Bugbot for commit 5cb8c31. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Sample app builds 📱

Below you will find the list of the latest versions of the sample apps. It's recommended to always download the latest builds of the sample apps to accurately test the pull request.

---

• iOS APN: 609.2.0 (29750159)
• iOS FCM: 609.2.0 (29750159)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit be8acc3. Configure here.}

[cursor]

Android snapshot property not applied

High Severity

The example app sets cioSDKVersionAndroid to the geofence snapshot, but the React Native Android module resolves the native SDK via getExtOrDefault('cioSDKVersionAndroid'), which only reads rootProject.ext.cioSDKVersionAndroid or customerio.reactnative.cioSDKVersionAndroid. The snapshot line is ignored, so Gradle keeps resolving 4.20.0 from the library defaults even though that artifact is not released yet.

Additional Locations (1)

• android/gradle.properties#L4-L5

 

^{Reviewed by Cursor Bugbot for commit be8acc3. Configure here.}