Merge main into lucien/fix-submitFlow-approver

Author: lakchote

.claude/skills/coding-standards/rules/clean-react-0-compiler.md

@@ -17,7 +17,7 @@ Manual memoization is therefore:
 
 The codebase enforces this via:
 - **Babel plugin**: `babel-plugin-react-compiler` in `babel.config.js`
-- **ESLint processor**: `eslint-plugin-react-compiler-compat` suppresses redundant lint rules when files compile successfully
+- **ESLint processor**: `eslint-processor-react-compiler-compat` suppresses redundant lint rules when files compile successfully
 - **CI compliance check**: `scripts/react-compiler-compliance-check.ts` enforces that new components/hooks compile and that existing compiled files don't regress
 
 Reference: [React Compiler documentation](https://react.dev/learn/react-compiler)

.github/workflows/deployExpensifyHelp.yml

@@ -7,13 +7,15 @@ on:
       - main
     paths:
       - 'docs/**'
+      - '.github/workflows/deployExpensifyHelp.yml'
 
   # Run on any pull request (except PRs against staging or production) that has changes to the docs directory
   pull_request:
     types: [opened, synchronize]
     branches-ignore: [staging, production]
     paths:
       - 'docs/**'
+      - '.github/workflows/deployExpensifyHelp.yml'
 
   # Run on any manual trigger
   workflow_dispatch:
@@ -51,18 +53,23 @@ jobs:
 
       - name: Enforce that a redirect link has been created
         run: ./.github/scripts/enforceRedirect.sh
-      
+
       - name: Enforce iframe and Cloudflare CDN usage
         run: ./.github/scripts/enforceVideoFormats.sh
 
       - name: Generate allowed URLs whitelist for AI search
         run: npx ts-node .github/scripts/generateAllowedUrls.ts
 
-      - name: Build with Jekyll
-        uses: actions/jekyll-build-pages@0143c158f4fa0c5dcd99499a5d00859d79f70b0e
+      - name: Set up Ruby
+        # v1.306.0
+        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f
         with:
-          source: ./docs/
-          destination: ./docs/_site
+          bundler-cache: true
+          working-directory: ./docs
+
+      - name: Build Jekyll site
+        run: bundle exec jekyll build --source ./ --destination ./_site
+        working-directory: ./docs
 
       - name: Deploy to Cloudflare Pages
         uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca

.github/workflows/lint-changed.yml

@@ -5,7 +5,7 @@ on:
   pull_request:
     types: [opened, synchronize]
     branches-ignore: [staging, production]
-    paths: ['**.js', '**.ts', '**.tsx', '**.json', '**.mjs', '**.cjs', 'config/.editorconfig', '.watchmanconfig', '.imgbotconfig']
+    paths: ['**.js', '**.ts', '**.tsx', '**.json', '**.mjs', '**.cjs', 'config/.editorconfig', 'config/eslint/**', 'scripts/lint.sh', 'scripts/lintChanged.sh', '.watchmanconfig', '.imgbotconfig']
 
 concurrency:
   group: ${{ github.ref == 'refs/heads/main' && format('{0}-{1}', github.ref, github.sha) || github.ref }}-lint
@@ -20,6 +20,12 @@ jobs:
       - name: Checkout
         # v6
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          # Only use the elevated OSBotify token on the post-merge `workflow_call` run
+          # (so the auto-commit step below can push to the protected `main` branch).
+          # PR runs use the default GITHUB_TOKEN so PR code can't borrow push-to-main
+          # access via the persisted checkout credentials.
+          token: ${{ github.event_name == 'workflow_call' && secrets.OS_BOTIFY_COMMIT_TOKEN || github.token }}
 
       - name: Setup Node
         uses: ./.github/actions/composite/setupNode
@@ -33,9 +39,9 @@ jobs:
         uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb
         with:
           path: node_modules/.cache/eslint
-          key: ${{ runner.os }}-eslint-${{ hashFiles('eslint.config.*', 'normalized-package-lock.json') }}-${{ github.sha }}
+          key: ${{ runner.os }}-eslint-${{ hashFiles('eslint.config.mjs', 'config/eslint/**', 'normalized-package-lock.json') }}-${{ github.sha }}
           restore-keys: |
-            ${{ runner.os }}-eslint-${{ hashFiles('eslint.config.*', 'normalized-package-lock.json') }}-
+            ${{ runner.os }}-eslint-${{ hashFiles('eslint.config.mjs', 'config/eslint/**', 'normalized-package-lock.json') }}-
             ${{ runner.os }}-eslint-
 
       # ESLint's cache doesn't track cross-file TypeScript dependencies, which can cause stale errors.
@@ -48,13 +54,44 @@ jobs:
             rm -rf node_modules/.cache/eslint
             npm run lint
           fi
-        env:
-          CI: true
 
       - name: Save ESLint cache
         # v5.0.1
         uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb
         if: always()
         with:
           path: node_modules/.cache/eslint
-          key: ${{ runner.os }}-eslint-${{ hashFiles('eslint.config.*', 'normalized-package-lock.json') }}-${{ github.sha }}
+          key: ${{ runner.os }}-eslint-${{ hashFiles('eslint.config.mjs', 'config/eslint/**', 'normalized-package-lock.json') }}-${{ github.sha }}
+
+      # If lint tightened the seatbelt baseline (i.e. fewer baselined errors than last time),
+      # commit the updated TSV back to `main` as OSBotify. Only runs under `workflow_call`
+      # (i.e. invoked from preDeploy.yml, which only triggers on push to main).
+      - name: Check for tightened eslint-seatbelt baseline
+        id: seatbelt_diff
+        if: github.event_name == 'workflow_call'
+        run: |
+          if git diff --quiet config/eslint/eslint.seatbelt.tsv; then
+            echo "tightened=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::eslint.seatbelt.tsv unchanged; skipping auto-commit."
+          else
+            echo "tightened=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Setup git for OSBotify
+        if: steps.seatbelt_diff.outputs.tightened == 'true'
+        uses: Expensify/GitHub-Actions/setupGitForOSBotify@main
+        with:
+          OP_VAULT: ${{ vars.OP_VAULT }}
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          SETUP_AS_APP: false
+
+      # If the push races with another commit to `main`, let this step fail.
+      # The next `push: main` lint run will re-tighten the baseline and try
+      # again; no need to retry here.
+      - name: Auto-commit tightened eslint-seatbelt baseline
+        if: steps.seatbelt_diff.outputs.tightened == 'true'
+        continue-on-error: true
+        run: |
+          git add config/eslint/eslint.seatbelt.tsv
+          git commit -m "Auto-tighten eslint-seatbelt baseline"
+          git push origin main

.github/workflows/lint.yml

@@ -12,6 +12,7 @@ jobs:
 
   lint:
     uses: ./.github/workflows/lint.yml
+    secrets: inherit
 
   prettier:
     uses: ./.github/workflows/prettier.yml

.github/workflows/preDeploy.yml

@@ -185,14 +185,14 @@ The skill provides guidance on:
 
 ### Code Quality
 - **TypeScript**: Strict mode enabled
-- **ESLint**: Linter
+- **ESLint**: Linter. Pre-existing violations are grandfathered via [`eslint-seatbelt`](https://github.com/justjake/eslint-seatbelt).
 - **Prettier**: Code formatting - run `npm run prettier` after making changes
 - **Patch Management**: patch-package for dependency fixes
 
 ### Post-Edit Checklist (IMPORTANT)
 **ALWAYS run these steps after making code changes, before committing:**
 1. **Prettier**: Run `npx prettier --write <changed files>` on every file you modified. This is mandatory - CI will reject unformatted code.
-2. **ESLint**: Run `npx eslint <changed files> --max-warnings=0` to catch lint errors early.
+2. **ESLint**: Run `npm run lint-changed` to catch lint errors early.
 3. **TypeScript**: Run `npm run typecheck-tsgo` after changes that may affect typing (types, interfaces, or function signatures). It is ~10x faster and usually stricter than tsc. CI validates with `npm run typecheck` (tsc), which remains the required merge gate.
 4. **React Compiler**: If you added new React components/hooks or modified existing ones, run `npm run react-compiler-compliance-check check-changed` to verify they compile with React Compiler. This applies the same rules as CI: new components/hooks must compile, and existing compiled files must not regress. See `contributingGuides/REACT_COMPILER.md` for details and common fixes.
 

CLAUDE.md

@@ -111,8 +111,8 @@ android {
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
         multiDexEnabled rootProject.ext.multiDexEnabled
-        versionCode 1009036203
-        versionName "9.3.62-3"
+        versionCode 1009036400
+        versionName "9.3.64-0"
         // Supported language variants must be declared here to avoid from being removed during the compilation.
         // This also helps us to not include unnecessary language variants in the APK.
         resConfigs "en", "es"