Maintenance: advance tutorial to React on Rails 17.0.0

[justin808]

Rationale

Moves the public React Webpack Rails tutorial off the 17.0.0 release candidate onto the stable final release and adds standing dependency and fleet-health coverage.

Implementation

• Pins the Ruby and npm React on Rails Pro topology to 17.0.0 and regenerates Bundler/Yarn locks.
• Adds weekly Dependabot coverage for GitHub Actions, Bundler, and npm, grouping the React on Rails family before the catch-all and fencing Babel 8.
• Adds the pinned reusable demo-fleet smoke caller for PRs, master pushes, weekly scheduling, and manual dispatch. It runs the app's Postgres-free JS path, build, renderer-backed HTTP smoke, and produces the central evidence artifact.

Local verification

• bundle install, bundle check, and yarn install --frozen-lockfile
• CI-shaped JS: 4 suites, 16 tests passed
• CI-shaped RSpec with isolated Node renderer: 51 examples, 0 failures
• Development build plus renderer-backed Rails HTTP /simple smoke passed
• RuboCop, SCSS lint, ESLint (no errors; one existing warning), actionlint, YAML contract, shell syntax, and git diff --check

Known baseline: Prettier reports existing out-of-scope formatting in generated output and three pre-existing source files; this change does not alter them.

Summary by CodeRabbit

• New Features
  • Added a “Demo fleet smoke” GitHub Actions workflow that runs smoke checks on pull requests, pushes to master, on a weekly schedule, and via manual trigger.
• Updates
  • Upgraded React on Rails Pro (Gemfile/Gem) and the Node renderer to stable 17.0.0.
• Chores
  • Added Dependabot weekly dependency update checks, including dependency grouping and npm ignore rules for selected @babel/* packages.

[github-actions]

🚀 Quick Review App Commands

Welcome! Here are the commands you can use in this PR:
They require the repository to have cpflow review apps configured, including the CPLN_TOKEN_STAGING secret.

+review-app-deploy

Deploy your PR branch for testing.

+review-app-delete

Remove the review app when done.

+review-app-help

Show detailed instructions, environment setup, and configuration options.

Comment +review-app-help for full setup details.

[justin808]

+ci-status

[justin808]

+ci-run-hosted

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b0b94eed-c08e-45d6-a9af-448c0663e1f9

📥 Commits

Reviewing files that changed from the base of the PR and between d05de9b and 0b5b617.

⛔ Files ignored due to path filters (2)

• Gemfile.lock is excluded by !**/*.lock
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (4)

• .github/dependabot.yml
• .github/workflows/demo-fleet-smoke.yml
• Gemfile
• package.json

🚧 Files skipped from review as they are similar to previous changes (4)

• Gemfile
• .github/dependabot.yml
• package.json
• .github/workflows/demo-fleet-smoke.yml

---

Walkthrough

The PR promotes React on Rails Pro dependencies to stable 17.0.0, adds reusable demo-fleet smoke testing across multiple triggers, and configures weekly grouped Dependabot updates with selected Babel version ignores.

Changes

React on Rails 17 stable rollout

Layer / File(s)	Summary
Stable dependency pins Gemfile, package.json	Updates React on Rails Pro Ruby and npm dependencies from release candidates to 17.0.0.
Demo fleet smoke validation .github/workflows/demo-fleet-smoke.yml	Adds reusable-workflow smoke checks for pull requests, pushes, scheduled runs, and manual dispatch, including Rails, Node renderer, readiness polling, endpoint validation, and cleanup.
Dependency update policy .github/dependabot.yml	Configures weekly grouped updates for GitHub Actions, Bundler, and npm, with selected Babel version ignores.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant ReusableSmokeWorkflow
  participant NodeRenderer
  participant RailsServer
  participant SmokeChecks
  GitHubActions->>ReusableSmokeWorkflow: start smoke job
  ReusableSmokeWorkflow->>NodeRenderer: start renderer and poll port 3800
  ReusableSmokeWorkflow->>RailsServer: prepare database and start server
  SmokeChecks->>RailsServer: validate the root endpoint
  ReusableSmokeWorkflow->>NodeRenderer: terminate renderer
  ReusableSmokeWorkflow->>RailsServer: terminate server

Loading

Possibly related issues

• shakacode/react_on_rails#4752 — Directly concerns the demo-fleet smoke workflow added here.

Possibly related PRs

• shakacode/react-webpack-rails-tutorial#765 — Directly updates the same React on Rails Pro dependencies.
• shakacode/react-webpack-rails-tutorial#783 — Updates the same dependency entries from release-candidate versions.
• shakacode/react-webpack-rails-tutorial#779 — Modifies the same React on Rails Pro dependency entries.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main change: advancing the tutorial to React on Rails 17.0.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/final-17-0-0

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/dependabot.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/demo-fleet-smoke.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

Gemfile

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

• 1 others

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

package.json

Parsing error: Missing semicolon. (2:8)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Review Summary

Overview

This PR moves the tutorial off react_on_rails_pro 17.0.0.rc.12 to the stable 17.0.0 release (Gemfile/Gemfile.lock, package.json/yarn.lock), and adds standing CI/dependency infrastructure: a dependabot.yml covering GitHub Actions, Bundler, and npm ecosystems, and a new demo-fleet-smoke.yml workflow that calls a pinned reusable workflow from shakacode/react_on_rails to smoke-test the app's JS build + Rails/renderer HTTP path.

Code quality / correctness

• Version bump from 17.0.0.rc.12 → 17.0.0 is consistent and correctly threaded through Gemfile, Gemfile.lock, package.json, and yarn.lock.
• The reusable workflow is pinned to a specific commit SHA rather than a mutable tag/branch — good supply-chain hygiene.
• The smoke-command shell logic (background renderer + Rails server, EXIT trap, bounded 30s polling loops) is correct: the trap safely no-ops on rails_pid when unset via ${rails_pid:-}, and both loops are time-bounded so the job can't hang indefinitely. Left an inline suggestion to consider extracting it into a checked-in script for readability/lint coverage — not a blocker.
• Left an inline note flagging that Gemfile.lock also picked up several transitive dependency bumps unrelated to the react_on_rails_pro pin (console, io-event, io-stream, protocol-http/protocol-http2, and a newly added openssl entry) — worth confirming these are expected fallout from bundle install rather than scope creep from a broader bundle update.

Security

• No secrets are passed into the reusable workflow call, and the workflow correctly uses pull_request (not pull_request_target), so fork PRs won't get elevated token/secret access.
• Left an inline suggestion to add an explicit least-privilege permissions: block to the new workflow, since it currently inherits the repo's default GITHUB_TOKEN permissions and triggers on PRs (including forks).
• Dependabot ignore rules correctly fence out Babel 8 prereleases for the relevant @babel/* packages, and group ordering (react-on-rails-family before all-dependencies) is correct — Dependabot assigns each dependency to the first matching group, so this won't double-bucket.

Test coverage / performance

• No app test coverage needed here since this is a dependency/CI-only change; the PR description documents local verification (RSpec, JS suite, RuboCop, actionlint, etc.), which is appropriate for this kind of change.
• The new workflow runs on every pull_request with no path filter, so it will execute on unrelated PRs too — likely intentional for "fleet health" purposes, but worth confirming that's the desired cost/signal tradeoff.

Overall this is a low-risk, well-scoped maintenance PR. The three inline notes above are suggestions/confirmations rather than blockers.

[greptile-apps]

Greptile Summary

This PR moves the tutorial to React on Rails 17.0.0 and adds ongoing dependency and smoke-test coverage. The main changes are:

• Stable 17.0.0 Ruby and npm package pins.
• Regenerated Bundler and Yarn lockfiles.
• Weekly grouped Dependabot updates with Babel 8 exclusions.
• A pinned reusable demo-fleet smoke workflow.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.
• Ruby and npm package versions remain aligned at 17.0.0.
• The new automation uses pinned versions and consistent repository settings.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds weekly dependency updates, React on Rails family groups, catch-all groups, and Babel 8 exclusions.
.github/workflows/demo-fleet-smoke.yml	Adds a commit-pinned reusable workflow for installation, tests, build, renderer startup, and HTTP smoke coverage.
Gemfile	Updates react_on_rails_pro from the release candidate to stable 17.0.0.
Gemfile.lock	Resolves the stable React on Rails gems and related transitive dependency updates.
package.json	Updates the React on Rails Pro and Node renderer packages to stable 17.0.0.
yarn.lock	Locks the npm React on Rails package family to stable 17.0.0 artifacts.

_{Reviews (1): Last reviewed commit: "Maintenance: advance tutorial to React o..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/demo-fleet-smoke.yml:
- Around line 25-30: Update the smoke-command sequence to run bundle exec rake
react_on_rails_pro:pre_seed_renderer_cache before starting node
renderer/node-renderer.js. Preserve the existing renderer readiness checks,
Rails startup, and cleanup trap after the cache pre-seeding step.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7a43458f-6e7e-4f36-971a-02cb588c327f

📥 Commits

Reviewing files that changed from the base of the PR and between 803b592 and a6c8bea.

⛔ Files ignored due to path filters (2)

• Gemfile.lock is excluded by !**/*.lock
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (4)

• .github/dependabot.yml
• .github/workflows/demo-fleet-smoke.yml
• Gemfile
• package.json

[justin808]

+ci-status

[justin808]

+ci-run-hosted

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 656617c986

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Review Summary

This is a clean, low-risk maintenance PR: it moves off the 17.0.0.rc.12 React on Rails Pro release candidate to the stable 17.0.0 release, adds Dependabot coverage, and wires up a reusable "demo fleet smoke" workflow. The author's PR description documents thorough local verification (RSpec, JS suites, RuboCop, lint, build + HTTP smoke), which is great for a dependency-bump PR.

Strengths

• Reusable workflow pinned to a full commit SHA (@613c6c2a25...) rather than a mutable tag/branch — correct supply-chain hygiene for a third-party reusable workflow.
• Postgres image pinned by digest (postgres:11-alpine@sha256:...) in addition to tag — reproducible, tamper-resistant.
• Dependabot grouping is correctly ordered: the react-on-rails-family group is declared before the catch-all all-dependencies group for both bundler and npm ecosystems, so those updates land in the specific group rather than the catch-all (Dependabot assigns each dependency to the first matching group).
• Babel 8 fenced off via ignore on >= 8.0.0 for all Babel packages — sensible guard against an unplanned major bump while it's still new.
• Gemfile.lock / yarn.lock changes are consistent with the version bump (rc.12 to 17.0.0) across react_on_rails, react_on_rails_pro, and the node renderer package — no stray or unrelated lockfile churn.
• Renderer port (3800) and password default (local-dev-renderer-password) used in the smoke workflow match config/initializers/react_on_rails_pro.rb, so the readiness check (nc -z 127.0.0.1 3800) is well targeted.

Issues / Suggestions

• smoke-command: unchecked db:prepare step (line 32) — left an inline comment. If DB prep fails, the script silently continues to start the Rails server and poll /simple for up to 30s before failing with a generic curl error, obscuring the real cause.
• Minor/nit: in install-command's Postgres readiness loop (line 21), the docker inspect ... || exit 1 check aborts the entire install step immediately if the container isn't reported Running on any single iteration, rather than retrying like the rest of the loop does. In practice docker run -d should return only once the container is running, so this is unlikely to fire spuriously, but it's a bit inconsistent with the retry semantics of the surrounding loop.
• Pre-existing, not introduced by this PR: postgres:11-alpine is used both here and in rspec_test.yml; Postgres 11 has been EOL since Nov 2023. Not a blocker since it's consistent with existing CI, but worth a follow-up ticket at some point.

Risk Assessment
Low risk overall — this is a pin-forward from an RC to the corresponding stable release with matching lockfile updates, plus additive CI/Dependabot config. No application code paths are touched. The new workflow only runs Docker/Postgres/Node renderer inside the ephemeral GitHub-hosted runner and doesn't request secrets: inherit, so no secret-exposure concern for fork PRs.

[justin808]

+ci-status

[justin808]

+ci-run-hosted

[claude]

Review summary

Reviewed the version bump (RC → stable 17.0.0), the new Dependabot config, and the new demo-fleet smoke workflow.

Version bump (Gemfile/Gemfile.lock/package.json/yarn.lock) — straightforward RC-to-stable pin, lockfiles are consistent, no issues.

.github/dependabot.yml — grouping order (react-on-rails-family before all-dependencies) is correct so RoR packages won't get swept into the catch-all group, and the Babel 8 ignore fencing looks right for a proactive major-version guard. No issues.

.github/workflows/demo-fleet-smoke.yml — left two inline comments:

1. In smoke-command, db:prepare runs unchained (; not &&) before the Rails server is backgrounded, so a db:prepare failure is silently swallowed and only surfaces ~30s later as a generic curl timeout on /simple instead of a clear, immediate error — makes CI failures harder to diagnose.
2. The reusable workflow is pinned to a commit SHA (good — mitigates supply-chain risk), but no secrets: inherit/secrets: block is passed. Worth confirming the upstream workflow_call doesn't require secrets, since this call would otherwise fail.

Nothing else stood out — Postgres image is pinned by digest, ruby/node versions match Gemfile/package.json engines, and the referenced rake tasks (ci:js) and route (/simple) exist in the repo.

[justin808]

+ci-status

[justin808]

+ci-run-hosted

[claude]

Review: Maintenance: advance tutorial to React on Rails 17.0.0

Overview

Small, well-scoped maintenance PR with three independent pieces:

1. Bumps react_on_rails_pro/react-on-rails-pro* from 17.0.0.rc.12 to the final 17.0.0 (Gemfile, Gemfile.lock, package.json, yarn.lock).
2. Adds .github/dependabot.yml with weekly Bundler/npm/GitHub Actions updates, grouping the React on Rails family ahead of a catch-all, and fencing Babel 8 pre-releases.
3. Adds .github/workflows/demo-fleet-smoke.yml, calling a reusable workflow (pinned to a commit SHA) for PR/push/weekly/manual smoke runs.

Code quality / good practices observed

• Reusable workflow is pinned to a full commit SHA rather than a tag — solid supply-chain hygiene.
• The Postgres image in the smoke workflow is pinned by digest, not just tag.
• Dependabot's Babel >= 8.0.0 ignore rules are a sensible guard against an unwanted major bump.
• Lockfiles look like a clean regenerate (transitive bumps to console, io-event, io-stream, protocol-http(2), and a new openssl gem match Ruby 3.4's default-gem changes) rather than a hand edit.
• Left inline notes on demo-fleet-smoke.yml around trigger scoping (no paths/paths-ignore, so every PR — even docs-only — runs the full docker+Postgres+Rails+renderer suite), an optional permissions: block, and a couple of minor shell-script robustness notes (redundant final pg_isready check, non-idempotent docker run --name).

Other notes (non-blocking)

• README.md still references 17.0.0.rc.9 for react_on_rails_pro/react-on-rails-pro* (lines ~187-189). That's pre-existing drift, not introduced by this PR, but since the stated goal here is moving off the RC entirely, it'd be worth a follow-up to sync the README with the new stable version.
• The PR's "Local verification" section covers bundle/yarn/RSpec/JS/RuboCop/lint runs, but the new reusable-workflow call itself (uses: shakacode/react_on_rails/.github/workflows/demo-fleet-smoke.yml@...) can't be exercised locally — worth confirming a real Actions run (e.g. via workflow_dispatch) succeeds end-to-end before merging, since correctness of the with: inputs depends on the callee's contract.
• No secrets are passed to the reusable workflow, so no credential-exposure concern from this PR's side; the hardcoded password Postgres credential is a throwaway CI-only value scoped to the ephemeral runner and not a real security issue.

Risk assessment

Low risk overall — dependency bump matches an already-validated RC → final transition, and the new CI workflow only adds coverage (it doesn't touch existing test/build jobs). Recommend merging once the live Actions run of demo-fleet-smoke.yml is confirmed green.

[justin808]

Address-review summary

Scan scope: full current-head review inventory after 0b5b617.

Mattered

• SSR smoke coverage, aligned renderer-cache staging, and immediate database-prepare failure propagation were fixed in 0b5b617 and validated by the exact-head hosted smoke.
• Dependency-lock transitive changes and the reusable-workflow no-secrets contract were independently verified.

Optional

• Explicit permissions, script extraction, path filtering, and self-hosted cleanup suggestions were declined with per-thread rationale: they are either already satisfied by the runner, outside the exact caller scope, or would weaken required coverage.

Skipped

• None.

All current review threads were replied to and resolved. Next default scan starts after this comment. Say check all reviews to rescan the full PR.

[github-actions]

✅ Review App Deleted

Review app for PR #792 is deleted

🎮 Control Plane Console
📋 View Workflow Logs