Merge branch 'main' of github.com:Expensify/App into onyx/session-3

Author: parasharrajat

.claude/agents/deploy-blocker-investigator.md

@@ -129,6 +129,10 @@ removeDeployBlockerLabel.sh "$ISSUE_URL" DeployBlocker      # For Frontend bugs
 
 Call scripts by name only (e.g., `removeDeployBlockerLabel.sh`), not with full paths.
 
+### Step 8: Assign contributors
+
+When a causing PR is identified with medium or high confidence, assign the PR author and all approving reviewers to the deploy blocker issue using `gh issue edit "$ISSUE_URL" --add-assignee`. Extract approving reviewers from `gh pr view <PR_NUMBER> --json reviews`.
+
 ---
 
 ## Decision Tree
@@ -182,6 +186,7 @@ Post ONE comment using this exact format:
 Brief explanation of why this recommendation (1-2 sentences).
 
 
+**Assigned**: @author (PR author), @reviewer (approving reviewer) — or omit if no causing PR identified
 **Labels**: [Describe any label changes made]
 
 <details>

.claude/commands/investigate-deploy-blocker.md

@@ -1,5 +1,5 @@
 ---
-allowed-tools: Bash(gh issue view:*),Bash(gh issue comment:*),Bash(gh issue list:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(gh pr diff:*),Bash(gh api:*),Bash(git log:*),Bash(git show:*),Bash(git blame:*),Bash(removeDeployBlockerLabel.sh:*),Glob,Grep,Read
+allowed-tools: Bash(gh issue view:*),Bash(gh issue comment:*),Bash(gh issue edit:*),Bash(gh issue list:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(gh pr diff:*),Bash(gh api:*),Bash(git log:*),Bash(git show:*),Bash(git blame:*),Bash(removeDeployBlockerLabel.sh:*),Glob,Grep,Read
 description: Investigate a deploy blocker issue to find the causing PR and recommend resolution
 ---
 

.claude/scripts/createInlineComment.sh

@@ -47,11 +47,12 @@ readonly LINE_ARG="${3:-}"
 validate_rule "$BODY_ARG"
 echo "Comment approved: $COMMENT_STATUS_REASON"
 
-readonly FOOTER=$'\n\n---\n\nPlease rate this suggestion with 👍 or 👎 to help us improve! Reactions are used to monitor reviewer efficiency.'
-readonly COMMENT_BODY="${BODY_ARG}${FOOTER}"
-
 COMMIT_ID=$(gh api "/repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" --jq '.head.sha')
 readonly COMMIT_ID
+readonly SHORT_SHA="${COMMIT_ID:0:7}"
+
+readonly FOOTER=$'\n\n---\n\n'"Reviewed at: [${SHORT_SHA}](https://github.com/${GITHUB_REPOSITORY}/commit/${COMMIT_ID}) | Please rate this suggestion with 👍 or 👎 to help us improve! Reactions are used to monitor reviewer efficiency."
+readonly COMMENT_BODY="${BODY_ARG}${FOOTER}"
 
 PAYLOAD=$(jq -n \
     --arg body "$COMMENT_BODY" \

.github/actions/composite/setupNode/action.yml

@@ -49,7 +49,7 @@ runs:
 
     - name: Install root project node packages
       if:  steps.cache-node-modules.outputs.cache-hit != 'true' || (inputs.IS_HYBRID_BUILD == 'true' && steps.cache-old-dot-node-modules.outputs.cache-hit != 'true')
-      uses: nick-fields/retry@3f757583fb1b1f940bc8ef4bf4734c8dc02a5847
+      uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
       with:
         timeout_minutes: 30
         max_attempts: 3

.github/workflows/buildAndroid.yml

@@ -178,6 +178,8 @@ jobs:
           sign: true
           re-sign: true
           ad-hoc: ${{ inputs.variant == 'Adhoc' }}
+          # We don't need Rock to setup java, because we already ran the setup-java action above
+          setup-java: false
           keystore-file: './upload-key.keystore'
           keystore-store-file: 'upload-key.keystore'
           keystore-store-password: ${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEYSTORE_PASSWORD }}

.github/workflows/buildIOS.yml

@@ -126,7 +126,7 @@ jobs:
         run: echo "IS_PODFILE_SAME_AS_MANIFEST=${{ hashFiles('Mobile-Expensify/iOS/Podfile.lock') == hashFiles('Mobile-Expensify/iOS/Pods/Manifest.lock') }}" >> "$GITHUB_OUTPUT"
 
       - name: Install cocoapods
-        uses: nick-fields/retry@3f757583fb1b1f940bc8ef4bf4734c8dc02a5847
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
         if: steps.pods-cache.outputs.cache-hit != 'true' || steps.compare-podfile-and-manifest.outputs.IS_PODFILE_SAME_AS_MANIFEST != 'true' || steps.setup-node.outputs.cache-hit != 'true'
         with:
           timeout_minutes: 10

.github/workflows/cherryPick.yml

@@ -34,9 +34,34 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  validate:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Validate pull request URL
+        if: ${{ inputs.PULL_REQUEST_URL != '' }}
+        run: |
+          REPO_FULL_NAME=$(echo '${{ inputs.PULL_REQUEST_URL }}' | sed -E 's|https?://github.com/([^/]+/[^/]+)/pull/.*|\1|')
+          if [[ "$REPO_FULL_NAME" != ${{ github.repository }} ]] && [[ ! "$REPO_FULL_NAME" =~ Expensify/Mobile-Expensify* ]]; then
+            echo "::error::❌ Cherry picks are only supported for the Expensify/App and Expensify/Mobile-Expensify repositories. Found: $REPO_FULL_NAME"
+            exit 1
+          fi
+
+      - name: Verify PR is merged
+        if: ${{ inputs.PULL_REQUEST_URL != '' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
+        run: |
+          if gh pr view "${{ inputs.PULL_REQUEST_URL }}" --json mergedAt | jq --exit-status '.mergedAt'; then
+            echo "PR is merged: ${{ inputs.PULL_REQUEST_URL }}"
+          else
+            echo "::error::❌ PR is not merged: ${{ inputs.PULL_REQUEST_URL }}"
+            exit 1
+          fi
+
   createNewVersion:
     uses: ./.github/workflows/createNewVersion.yml
     secrets: inherit
+    needs: [validate]
     with:
       # In order to submit a new build for production review, it must have a higher PATCH version than the previously-submitted build.
       # The typical case is that with each staging deploy, we bump the BUILD version, and with each prod deploy we bump the PATCH version.
@@ -59,14 +84,6 @@ jobs:
           echo "REPO_FULL_NAME=$(echo '${{ inputs.PULL_REQUEST_URL }}' | sed -E 's|https?://github.com/([^/]+/[^/]+)/pull/.*|\1|')" >> "$GITHUB_OUTPUT"
           echo "PR_NUMBER=$(echo '${{ inputs.PULL_REQUEST_URL }}' | sed -E 's|.*/pull/([0-9]+).*|\1|')" >> "$GITHUB_OUTPUT"
 
-      - name: Verify pull request URL
-        if: ${{ inputs.PULL_REQUEST_URL != '' }}
-        run: |
-          if [[ "${{ steps.getPRInfo.outputs.REPO_FULL_NAME }}" != ${{ github.repository }} ]] && [[ ! "${{ steps.getPRInfo.outputs.REPO_FULL_NAME }}" =~ Expensify/Mobile-Expensify* ]]; then
-            echo "::error::❌ Cherry picks are only supported for the Expensify/App and Expensify/Mobile-Expensify repositories. Found: ${{ steps.getPRInfo.outputs.REPO_FULL_NAME }}"
-            exit 1
-          fi
-
       - name: Set conflict branch name
         if: ${{ inputs.PULL_REQUEST_URL != '' }}
         id: getBranchName

.github/workflows/deploy.yml

@@ -66,7 +66,7 @@ jobs:
         # JS is better at handling JSON: https://stackoverflow.com/questions/72953526/github-actions-how-to-pass-tojson-result-to-shell-commands
       - name: Check if this deploy was triggered by a cherry-pick
         id: isCherryPick
-        uses: actions/github-script@e7aeb8c663f696059ebb5f9ab1425ed2ef511bdb
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const commitMessages = context.payload.commits.map((commit) => commit.message);

.github/workflows/deployBlockerInvestigation.yml

@@ -77,4 +77,4 @@ jobs:
           github_token: ${{ secrets.OS_BOTIFY_TOKEN }}
           prompt: "/investigate-deploy-blocker ISSUE_URL: ${{ env.ISSUE_URL }}"
           claude_args: |
-            --allowedTools "Task,Glob,Grep,Read,Bash(gh issue view:*),Bash(gh issue comment:*),Bash(gh issue list:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(gh pr diff:*),Bash(gh api:*),Bash(git log:*),Bash(git show:*),Bash(git blame:*),Bash(removeDeployBlockerLabel.sh:*)"
+            --allowedTools "Task,Glob,Grep,Read,Bash(gh issue view:*),Bash(gh issue comment:*),Bash(gh issue edit:*),Bash(gh issue list:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(gh pr diff:*),Bash(gh api:*),Bash(git log:*),Bash(git show:*),Bash(git blame:*),Bash(removeDeployBlockerLabel.sh:*)"

Gemfile

@@ -4,7 +4,7 @@ source "https://rubygems.org"
 ruby ">= 3.3.4"
 
 gem "cocoapods", "= 1.16.2"
-gem 'activesupport', '>= 6.1.7.5', '!= 7.1.0'
+gem 'activesupport', '>= 7.2.3.1'
 gem 'xcodeproj', '~> 1.27'
 gem "fastlane", "~> 2", ">= 2.229.0"
 gem "xcpretty", "~> 0"