fix(ci): repair the fallow workflow

.fallowrc.json

@@ -5,7 +5,8 @@
     "**/coverage/**",
     "**/storybook-static/**",
     "**/*.generated.ts",
-    "patches/**"
+    "patches/**",
+    "examples/**"
   ],
   "ignoreDependencies": ["expo-splash-screen", "expo-sqlite"],
   "dynamicallyLoaded": [

.github/workflows/fallow.yml

@@ -61,11 +61,29 @@ jobs:
             --fail-on-issues \
             --quiet > fallow-audit.sarif
 
+      # CodeQL's upload action rejects SARIF files that contain multiple runs
+      # under one category, and fallow emits one run per sub-analysis — this
+      # is why every upload failed before. Merge the runs (same driver) into
+      # one. Producing the .single.sarif file only when the input parses also
+      # guards against the empty file a crashed audit leaves behind, which
+      # passes hashFiles() but is not valid JSON.
+      - name: Normalize Fallow SARIF to a single run
+        if: always()
+        shell: bash
+        run: |
+          if jq -e '.runs | length >= 1' fallow-audit.sarif > /dev/null 2>&1; then
+            jq 'if (.runs | length) > 1 then
+                  .runs[0].results = ([.runs[].results // []] | add) |
+                  .runs[0].tool.driver.rules = ([.runs[].tool.driver.rules // []] | add | unique_by(.id)) |
+                  .runs = [.runs[0]]
+                else . end' fallow-audit.sarif > fallow-audit.single.sarif
+          fi
+
       - name: Upload Fallow SARIF
-        if: always() && hashFiles('fallow-audit.sarif') != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@v3
+        if: always() && hashFiles('fallow-audit.single.sarif') != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+        uses: github/codeql-action/upload-sarif@v4
         with:
-          sarif_file: fallow-audit.sarif
+          sarif_file: fallow-audit.single.sarif
           category: fallow-audit
 
       - name: Run Fallow dead-code regression

package.json

@@ -51,7 +51,7 @@
     "eslint": "^8.57.0",
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-react-hooks": "^5.2.0",
-    "fallow": "^2.88.1",
+    "fallow": "^2.93.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.2.7",
     "prettier": "^3.2.0",

tests/e2e/helpers/harness.ts

@@ -7,7 +7,7 @@ import { spawn, execSync, type ChildProcess } from 'node:child_process'
 
 export const ROOT = new URL('../../../', import.meta.url).pathname.replace(/\/$/, '')
 
-export function spawnAndWait(
+function spawnAndWait(
   command: string,
   args: string[],
   opts: {