Merge branch 'main' into @GCygnaek/landscape-mode/hidden-input-fixes

Author: GCyganek

.claude/skills/coding-standards/rules/clean-react-0-compiler.md

@@ -17,7 +17,7 @@ Manual memoization is therefore:
 
 The codebase enforces this via:
 - **Babel plugin**: `babel-plugin-react-compiler` in `babel.config.js`
-- **ESLint processor**: `eslint-plugin-react-compiler-compat` suppresses redundant lint rules when files compile successfully
+- **ESLint processor**: `eslint-processor-react-compiler-compat` suppresses redundant lint rules when files compile successfully
 - **CI compliance check**: `scripts/react-compiler-compliance-check.ts` enforces that new components/hooks compile and that existing compiled files don't regress
 
 Reference: [React Compiler documentation](https://react.dev/learn/react-compiler)

.github/actions/composite/isContributorPlus/action.yml

@@ -0,0 +1,33 @@
+name: Is Contributor+
+description: Check whether a GitHub user is a member of the Expensify/contributor-plus team. Sets IS_CPLUS=true when the user is a member, IS_CPLUS=false otherwise.
+
+inputs:
+  USERNAME:
+    description: The GitHub login of the user to check.
+    required: true
+  OS_BOTIFY_TOKEN:
+    description: OSBotify token. Needed to read team memberships (the default GITHUB_TOKEN lacks the read:org scope).
+    required: true
+
+outputs:
+  IS_CPLUS:
+    description: "'true' if the user is a member of Expensify/contributor-plus, 'false' otherwise."
+    value: ${{ steps.check.outputs.IS_CPLUS }}
+
+runs:
+  using: composite
+  steps:
+    - name: Check Contributor+ membership
+      id: check
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.OS_BOTIFY_TOKEN }}
+        USERNAME: ${{ inputs.USERNAME }}
+      run: |
+        if gh api "/orgs/Expensify/teams/contributor-plus/memberships/$USERNAME" --silent; then
+          echo "::notice::✅ $USERNAME is a Contributor+ member"
+          echo "IS_CPLUS=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "::notice::$USERNAME is not a Contributor+ member"
+          echo "IS_CPLUS=false" >> "$GITHUB_OUTPUT"
+        fi

.github/actions/javascript/failureNotifier/failureNotifier.ts

@@ -122,6 +122,8 @@ ${errorMessage}
 1. **Why the PR caused the job to fail?**
 2. **Address any underlying issues.**
 
+**For detailed instructions, check [this SO](https://stackoverflowteams.com/c/expensify/questions/21936).**
+
 **🐛 We appreciate your help in squashing this bug!**`;
 
         await octokit.rest.issues.create({

.github/workflows/claude-review.yml

@@ -7,25 +7,50 @@ permissions:
 on:
   pull_request_target:
     types: [opened, ready_for_review]
+  pull_request_review:
+    types: [submitted]
 
 concurrency:
   group: claude-review-${{ github.event.pull_request.html_url }}
   cancel-in-progress: true
 
 jobs:
   validate:
+    if: github.event_name == 'pull_request_target'
     uses: ./.github/workflows/contributorValidationGate.yml
     with:
       PR_NUMBER: ${{ github.event.pull_request.number }}
       PR_AUTHOR: ${{ github.event.pull_request.user.login }}
       AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
 
+  checkCPlusApproval:
+    if: github.event_name == 'pull_request_review' && github.event.review.state == 'approved'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    outputs:
+      IS_CPLUS: ${{ steps.check.outputs.IS_CPLUS }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 1
+
+      - name: Check Contributor+ membership
+        id: check
+        uses: ./.github/actions/composite/isContributorPlus
+        with:
+          USERNAME: ${{ github.event.review.user.login }}
+          OS_BOTIFY_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
+
   review:
-    needs: [validate]
+    needs: [validate, checkCPlusApproval]
     if: |
-      needs.validate.outputs.IS_AUTHORIZED == 'true'
+      !cancelled()
       && github.event.pull_request.draft != true
       && !contains(github.event.pull_request.title, 'Revert')
+      && (
+        (github.event_name == 'pull_request_target' && needs.validate.outputs.IS_AUTHORIZED == 'true')
+        || (github.event_name == 'pull_request_review' && needs.checkCPlusApproval.outputs.IS_CPLUS == 'true')
+      )
     runs-on: blacksmith-2vcpu-ubuntu-2404
     env:
       PR_NUMBER: ${{ github.event.pull_request.number }}

.github/workflows/deployExpensifyHelp.yml

@@ -7,13 +7,15 @@ on:
       - main
     paths:
       - 'docs/**'
+      - '.github/workflows/deployExpensifyHelp.yml'
 
   # Run on any pull request (except PRs against staging or production) that has changes to the docs directory
   pull_request:
     types: [opened, synchronize]
     branches-ignore: [staging, production]
     paths:
       - 'docs/**'
+      - '.github/workflows/deployExpensifyHelp.yml'
 
   # Run on any manual trigger
   workflow_dispatch:
@@ -51,18 +53,23 @@ jobs:
 
       - name: Enforce that a redirect link has been created
         run: ./.github/scripts/enforceRedirect.sh
-      
+
       - name: Enforce iframe and Cloudflare CDN usage
         run: ./.github/scripts/enforceVideoFormats.sh
 
       - name: Generate allowed URLs whitelist for AI search
         run: npx ts-node .github/scripts/generateAllowedUrls.ts
 
-      - name: Build with Jekyll
-        uses: actions/jekyll-build-pages@0143c158f4fa0c5dcd99499a5d00859d79f70b0e
+      - name: Set up Ruby
+        # v1.306.0
+        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f
         with:
-          source: ./docs/
-          destination: ./docs/_site
+          bundler-cache: true
+          working-directory: ./docs
+
+      - name: Build Jekyll site
+        run: bundle exec jekyll build --source ./ --destination ./_site
+        working-directory: ./docs
 
       - name: Deploy to Cloudflare Pages
         uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca

.github/workflows/lint-changed.yml

@@ -5,7 +5,7 @@ on:
   pull_request:
     types: [opened, synchronize]
     branches-ignore: [staging, production]
-    paths: ['**.js', '**.ts', '**.tsx', '**.json', '**.mjs', '**.cjs', 'config/.editorconfig', '.watchmanconfig', '.imgbotconfig']
+    paths: ['**.js', '**.ts', '**.tsx', '**.json', '**.mjs', '**.cjs', 'config/.editorconfig', 'config/eslint/**', 'scripts/lint.sh', 'scripts/lintChanged.sh', '.watchmanconfig', '.imgbotconfig']
 
 concurrency:
   group: ${{ github.ref == 'refs/heads/main' && format('{0}-{1}', github.ref, github.sha) || github.ref }}-lint
@@ -20,6 +20,12 @@ jobs:
       - name: Checkout
         # v6
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          # Only use the elevated OSBotify token on the post-merge `workflow_call` run
+          # (so the auto-commit step below can push to the protected `main` branch).
+          # PR runs use the default GITHUB_TOKEN so PR code can't borrow push-to-main
+          # access via the persisted checkout credentials.
+          token: ${{ github.event_name == 'workflow_call' && secrets.OS_BOTIFY_COMMIT_TOKEN || github.token }}
 
       - name: Setup Node
         uses: ./.github/actions/composite/setupNode
@@ -33,9 +39,9 @@ jobs:
         uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb
         with:
           path: node_modules/.cache/eslint
-          key: ${{ runner.os }}-eslint-${{ hashFiles('eslint.config.*', 'normalized-package-lock.json') }}-${{ github.sha }}
+          key: ${{ runner.os }}-eslint-${{ hashFiles('eslint.config.mjs', 'config/eslint/**', 'normalized-package-lock.json') }}-${{ github.sha }}
           restore-keys: |
-            ${{ runner.os }}-eslint-${{ hashFiles('eslint.config.*', 'normalized-package-lock.json') }}-
+            ${{ runner.os }}-eslint-${{ hashFiles('eslint.config.mjs', 'config/eslint/**', 'normalized-package-lock.json') }}-
             ${{ runner.os }}-eslint-
 
       # ESLint's cache doesn't track cross-file TypeScript dependencies, which can cause stale errors.
@@ -48,13 +54,44 @@ jobs:
             rm -rf node_modules/.cache/eslint
             npm run lint
           fi
-        env:
-          CI: true
 
       - name: Save ESLint cache
         # v5.0.1
         uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb
         if: always()
         with:
           path: node_modules/.cache/eslint
-          key: ${{ runner.os }}-eslint-${{ hashFiles('eslint.config.*', 'normalized-package-lock.json') }}-${{ github.sha }}
+          key: ${{ runner.os }}-eslint-${{ hashFiles('eslint.config.mjs', 'config/eslint/**', 'normalized-package-lock.json') }}-${{ github.sha }}
+
+      # If lint tightened the seatbelt baseline (i.e. fewer baselined errors than last time),
+      # commit the updated TSV back to `main` as OSBotify. Only runs under `workflow_call`
+      # (i.e. invoked from preDeploy.yml, which only triggers on push to main).
+      - name: Check for tightened eslint-seatbelt baseline
+        id: seatbelt_diff
+        if: github.event_name == 'workflow_call'
+        run: |
+          if git diff --quiet config/eslint/eslint.seatbelt.tsv; then
+            echo "tightened=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::eslint.seatbelt.tsv unchanged; skipping auto-commit."
+          else
+            echo "tightened=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Setup git for OSBotify
+        if: steps.seatbelt_diff.outputs.tightened == 'true'
+        uses: Expensify/GitHub-Actions/setupGitForOSBotify@main
+        with:
+          OP_VAULT: ${{ vars.OP_VAULT }}
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          SETUP_AS_APP: false
+
+      # If the push races with another commit to `main`, let this step fail.
+      # The next `push: main` lint run will re-tighten the baseline and try
+      # again; no need to retry here.
+      - name: Auto-commit tightened eslint-seatbelt baseline
+        if: steps.seatbelt_diff.outputs.tightened == 'true'
+        continue-on-error: true
+        run: |
+          git add config/eslint/eslint.seatbelt.tsv
+          git commit -m "Auto-tighten eslint-seatbelt baseline"
+          git push origin main

.github/workflows/lint.yml

@@ -12,6 +12,7 @@ jobs:
 
   lint:
     uses: ./.github/workflows/lint.yml
+    secrets: inherit
 
   prettier:
     uses: ./.github/workflows/prettier.yml

.github/workflows/preDeploy.yml

@@ -31,10 +31,6 @@ jobs:
       - name: Setup Node
         uses: ./.github/actions/composite/setupNode
 
-      - name: Get number of CPU cores
-        id: cpu-cores
-        uses: SimenB/github-actions-cpu-cores@31e91de0f8654375a21e8e83078be625380e2b18
-
       - name: Cache Jest cache
         id: cache-jest-cache
         # v5.0.1

.github/workflows/test.yml

@@ -185,14 +185,14 @@ The skill provides guidance on:
 
 ### Code Quality
 - **TypeScript**: Strict mode enabled
-- **ESLint**: Linter
+- **ESLint**: Linter. Pre-existing violations are grandfathered via [`eslint-seatbelt`](https://github.com/justjake/eslint-seatbelt).
 - **Prettier**: Code formatting - run `npm run prettier` after making changes
 - **Patch Management**: patch-package for dependency fixes
 
 ### Post-Edit Checklist (IMPORTANT)
 **ALWAYS run these steps after making code changes, before committing:**
 1. **Prettier**: Run `npx prettier --write <changed files>` on every file you modified. This is mandatory - CI will reject unformatted code.
-2. **ESLint**: Run `npx eslint <changed files> --max-warnings=0` to catch lint errors early.
+2. **ESLint**: Run `npm run lint-changed` to catch lint errors early.
 3. **TypeScript**: Run `npm run typecheck-tsgo` after changes that may affect typing (types, interfaces, or function signatures). It is ~10x faster and usually stricter than tsc. CI validates with `npm run typecheck` (tsc), which remains the required merge gate.
 4. **React Compiler**: If you added new React components/hooks or modified existing ones, run `npm run react-compiler-compliance-check check-changed` to verify they compile with React Compiler. This applies the same rules as CI: new components/hooks must compile, and existing compiled files must not regress. See `contributingGuides/REACT_COMPILER.md` for details and common fixes.