Merge branch 'main' into wh201906/fast-utf16

Author: wh201906

.claude/rules/test-verification.xml

@@ -0,0 +1,40 @@
+<rules category="testing">
+  <rule severity="HIGH" enforcement="STRICT">
+    <name>Wait for user test confirmation before pushing fixes</name>
+    <description>
+      Tests in this project run only in the example React Native app — the
+      assistant cannot execute them. After fixing a bug or adding a feature
+      that would normally be validated by running tests, commit locally and
+      WAIT for the user to manually run the test suite (`bun ios` /
+      `bun android` and exercise the relevant suite) and confirm it passes
+      before pushing to the remote.
+    </description>
+    <requirements>
+      <requirement>After committing a fix that requires runtime validation, do NOT immediately `git push`.</requirement>
+      <requirement>Tell the user the commit is ready and ask them to run the test that exercises the fix.</requirement>
+      <requirement>Wait for explicit user confirmation ("tests pass", "all green", "ship it", etc.) before pushing.</requirement>
+      <requirement>If the user reports a failure, iterate locally with new commits — do NOT push interim fixes either.</requirement>
+      <requirement>Once the user confirms, batch-push all the validated commits in one `git push`.</requirement>
+    </requirements>
+    <appliesWhen>
+      <case>The change touches C++ that only the example app can exercise.</case>
+      <case>The change modifies behavior that an existing example-app test asserts.</case>
+      <case>The change adds new example-app tests whose pass/fail is unknown.</case>
+      <case>A previous push had a confirmed test failure and you are pushing the followup.</case>
+    </appliesWhen>
+    <doesNotApplyWhen>
+      <case>The change is purely documentation, plan files, or `.claude/` config — no runtime impact.</case>
+      <case>The user explicitly says "push it" or "ship now" before running tests.</case>
+      <case>The branch has never been pushed and you are creating the first PR push (still ask first if any unverified runtime change is included).</case>
+    </doesNotApplyWhen>
+    <rationale>
+      The /pr and /commit skills are written for projects where the assistant
+      can run tests itself. This project's testing model puts that step on the
+      user. Pushing unverified fixes ships potentially broken code to the
+      remote, pollutes PR history with revert-style "fix the fix" commits,
+      and burns user trust. The cost of waiting is a single round-trip
+      message; the cost of not waiting is a force-push or noise on the PR.
+    </rationale>
+    <mustAcknowledge>true</mustAcknowledge>
+  </rule>
+</rules>

.github/workflows/deploy-docs.yml

@@ -17,12 +17,17 @@ concurrency:
   group: 'pages'
   cancel-in-progress: true
 
+env:
+  # Opt actions still on Node 20 into the runner's Node 24 instead.
+  # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Bun
         uses: ./.github/actions/setup-bun

.github/workflows/e2e-android-test.yml

@@ -10,21 +10,31 @@ on:
     paths:
       - '.github/workflows/e2e-android-test.yml'
       - 'example/**'
-      - 'cpp/**'
-      - 'nitrogen/**'
-      - 'src/**'
+      - 'packages/react-native-quick-crypto/cpp/**'
+      - 'packages/react-native-quick-crypto/nitrogen/**'
+      - 'packages/react-native-quick-crypto/src/**'
       - 'packages/react-native-quick-crypto/android/**'
   push:
     branches: [main]
     paths:
       - 'example/**'
-      - 'cpp/**'
-      - 'nitrogen/**'
-      - 'src/**'
+      - 'packages/react-native-quick-crypto/cpp/**'
+      - 'packages/react-native-quick-crypto/nitrogen/**'
+      - 'packages/react-native-quick-crypto/src/**'
       - 'packages/react-native-quick-crypto/android/**'
 
 env:
   EMULATOR_API_LEVEL: 34
+  # Opt actions still on Node 20 (setup-java, upload/download-artifact, setup-android, etc.)
+  # into the runner's Node 24 instead. Silences deprecation warnings until each action ships a v5.
+  # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
+# Minimum scopes — post-maestro-screenshot composite action posts a PR comment with
+# the upload-image artifact link.
+permissions:
+  contents: read
+  pull-requests: write
 
 jobs:
   # ============================================================================
@@ -51,7 +61,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v5
         with:
-          node-version: '20'
+          node-version: '24'
 
       - name: Install Bun
         uses: ./.github/actions/setup-bun
@@ -87,7 +97,7 @@ jobs:
             packages/react-native-quick-crypto/android/build
             node_modules/.bun/react-native-nitro-modules*/node_modules/react-native-nitro-modules/android/.cxx
             node_modules/.bun/react-native-nitro-modules*/node_modules/react-native-nitro-modules/android/build
-          key: ${{ runner.os }}-gradle-${{ github.run_id }}
+          key: ${{ runner.os }}-gradle-${{ hashFiles('example/android/**/*.gradle*', 'example/android/gradle.properties', 'example/android/gradle/wrapper/gradle-wrapper.properties', 'packages/react-native-quick-crypto/android/build.gradle', 'packages/react-native-quick-crypto/android/gradle.properties', 'bun.lock') }}
           restore-keys: |
             ${{ runner.os }}-gradle-
 
@@ -141,7 +151,7 @@ jobs:
             packages/react-native-quick-crypto/android/build
             node_modules/.bun/react-native-nitro-modules*/node_modules/react-native-nitro-modules/android/.cxx
             node_modules/.bun/react-native-nitro-modules*/node_modules/react-native-nitro-modules/android/build
-          key: ${{ runner.os }}-gradle-${{ github.run_id }}
+          key: ${{ runner.os }}-gradle-${{ hashFiles('example/android/**/*.gradle*', 'example/android/gradle.properties', 'example/android/gradle/wrapper/gradle-wrapper.properties', 'packages/react-native-quick-crypto/android/build.gradle', 'packages/react-native-quick-crypto/android/gradle.properties', 'bun.lock') }}
 
   # ============================================================================
   # AVD Job - Create and cache emulator snapshot (runs in parallel with build)
@@ -167,9 +177,7 @@ jobs:
           path: |
             ~/.android/avd/*
             ~/.android/adb*
-          key: avd-pixel7pro-${{ env.EMULATOR_API_LEVEL }}-${{ github.run_id }}
-          restore-keys: |
-            avd-pixel7pro-${{ env.EMULATOR_API_LEVEL }}-
+          key: avd-pixel7pro-${{ env.EMULATOR_API_LEVEL }}-x86_64-v1
 
       - name: Create AVD and Generate Snapshot for Caching
         if: steps.avd-cache.outputs.cache-hit != 'true'
@@ -190,7 +198,7 @@ jobs:
           path: |
             ~/.android/avd/*
             ~/.android/adb*
-          key: avd-pixel7pro-${{ env.EMULATOR_API_LEVEL }}-${{ github.run_id }}
+          key: avd-pixel7pro-${{ env.EMULATOR_API_LEVEL }}-x86_64-v1
 
   # ============================================================================
   # Test Job - Run E2E tests (needs both build and AVD)
@@ -209,7 +217,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v5
         with:
-          node-version: '20'
+          node-version: '24'
 
       - name: Install Bun
         uses: ./.github/actions/setup-bun
@@ -226,7 +234,7 @@ jobs:
         uses: actions/cache/restore@v5
         with:
           path: node_modules
-          key: ${{ runner.os }}-node-modules-${{ github.run_id }}
+          key: ${{ runner.os }}-node-modules-${{ hashFiles('bun.lock') }}
           restore-keys: |
             ${{ runner.os }}-node-modules-
 
@@ -237,7 +245,7 @@ jobs:
         uses: actions/cache/save@v5
         with:
           path: node_modules
-          key: ${{ runner.os }}-node-modules-${{ github.run_id }}
+          key: ${{ runner.os }}-node-modules-${{ hashFiles('bun.lock') }}
 
       - name: Download APK
         uses: actions/download-artifact@v4
@@ -263,9 +271,7 @@ jobs:
           path: |
             ~/.android/avd/*
             ~/.android/adb*
-          key: avd-pixel7pro-${{ env.EMULATOR_API_LEVEL }}-${{ github.run_id }}
-          restore-keys: |
-            avd-pixel7pro-${{ env.EMULATOR_API_LEVEL }}-
+          key: avd-pixel7pro-${{ env.EMULATOR_API_LEVEL }}-x86_64-v1
 
       - name: Run E2E Tests
         uses: reactivecircus/android-emulator-runner@v2

.github/workflows/e2e-ios-test.yml

@@ -10,19 +10,31 @@ on:
     paths:
       - '.github/workflows/e2e-ios-test.yml'
       - 'example/**'
-      - 'cpp/**'
-      - 'nitrogen/**'
-      - 'src/**'
+      - 'packages/react-native-quick-crypto/cpp/**'
+      - 'packages/react-native-quick-crypto/nitrogen/**'
+      - 'packages/react-native-quick-crypto/src/**'
       - 'packages/react-native-quick-crypto/ios/**'
   push:
     branches: [main]
     paths:
       - 'example/**'
-      - 'cpp/**'
-      - 'nitrogen/**'
-      - 'src/**'
+      - 'packages/react-native-quick-crypto/cpp/**'
+      - 'packages/react-native-quick-crypto/nitrogen/**'
+      - 'packages/react-native-quick-crypto/src/**'
       - 'packages/react-native-quick-crypto/ios/**'
 
+env:
+  # Opt actions still on Node 20 (upload-artifact, McCzarny/upload-image, peter-evans/*, etc.)
+  # into the runner's Node 24 instead. Silences deprecation warnings until each action ships a v5.
+  # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
+# Minimum scopes — post-maestro-screenshot composite action posts a PR comment with
+# the upload-image artifact link.
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   e2e-tests-ios:
     runs-on: macOS-26
@@ -34,7 +46,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Select Xcode 26.2
         run: |

.github/workflows/release.yml

@@ -12,6 +12,11 @@ on:
         type: boolean
         default: false
 
+env:
+  # Opt actions still on Node 20 into the runner's Node 24 instead.
+  # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
 jobs:
   release:
     runs-on: macos-latest
@@ -20,7 +25,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -29,7 +34,7 @@ jobs:
         uses: ./.github/actions/setup-bun
 
       - name: Setup Node.js (for npm publish with OIDC)
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
@@ -58,20 +63,24 @@ jobs:
       - name: Release package to npm
         working-directory: packages/react-native-quick-crypto
         run: |
-          if [ "${{ inputs.dry-run }}" = "true" ]; then
-            bun release ${{ inputs.version }} --dry-run --ci
+          if [ "$DRY_RUN" = "true" ]; then
+            bun release "$VERSION" --dry-run --ci
           else
-            bun release ${{ inputs.version }} --ci
+            bun release "$VERSION" --ci
           fi
         env:
           NPM_CONFIG_PROVENANCE: true
+          VERSION: ${{ inputs.version }}
+          DRY_RUN: ${{ inputs.dry-run }}
 
       - name: Create Git tag and GitHub release
         run: |
-          if [ "${{ inputs.dry-run }}" = "true" ]; then
-            bun run release-it ${{ inputs.version }} --dry-run --ci
+          if [ "$DRY_RUN" = "true" ]; then
+            bun run release-it "$VERSION" --dry-run --ci
           else
-            bun run release-it ${{ inputs.version }} --ci
+            bun run release-it "$VERSION" --ci
           fi
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ inputs.version }}
+          DRY_RUN: ${{ inputs.dry-run }}

.github/workflows/update-lockfiles.yml

@@ -15,13 +15,18 @@ on:
 permissions:
   contents: write
 
+env:
+  # Opt actions still on Node 20 into the runner's Node 24 instead.
+  # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
 jobs:
   update-lockfiles:
     name: 'Update lockfiles (Podfile.lock)'
     if: github.actor == 'dependabot[bot]'
     runs-on: macOS-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.ref }}

.github/workflows/validate-cpp.yml

@@ -16,20 +16,32 @@ on:
       - 'packages/react-native-quick-crypto/cpp/**'
       - 'packages/react-native-quick-crypto/nitrogen/generated/shared/**'
 
+env:
+  # Opt actions still on Node 20 (e.g. reviewdog/action-cpplint) into the runner's Node 24.
+  # Silences deprecation warnings until each action ships a v5.
+  # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
+# Minimum scopes — reviewdog posts review comments on PRs.
+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
+
 jobs:
   validate_cpp:
     name: C++ Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Set up clang-format
         run: sudo apt-get install -y clang-format
       - name: Run clang-format check
         run: |
           find packages/react-native-quick-crypto/cpp packages/react-native-quick-crypto/android/src/main/cpp \
           -regex '.*\.\(cpp\|hpp\|cc\|cxx\|h\)' \
           -exec clang-format --style=file --dry-run --Werror {} +
-      - uses: reviewdog/action-cpplint@master
+      - uses: reviewdog/action-cpplint@9552c62f4bd516c1e3a6f84eae56bd864cc304c6 # v1.11.0
         with:
           github_token: ${{ secrets.github_token }}
           reporter: github-pr-review