Update main with staging 09/21/25

[transphorm]

Summary by CodeRabbit

• New Features

  • Added in-app FeedbackProvider.
  • Introduced Photo Picker activity on Android.
  • Unlocked screen rotation for the main Android activity.

• Mobile

  • Android app version bumped to 2.6.5 (code 99).
  • Updated dependencies; improved native library handling for smaller packages.

• Documentation

  • Updated setup requirements (Node ≥ 22); expanded Android/iOS guides.
  • Removed NFC-related documentation references.

• Chores

  • Major CI/CD revamp: caching, concurrency, staging branch support, new mobile/demo workflows.
  • Added pre-commit license header checks and refined secret scanning/ignore rules.

[coderabbitai]

Walkthrough

This PR overhauls CI/CD workflows, adds composite GitHub Actions (cache built deps, clone private Android module), updates Node/Yarn configs, introduces caching across jobs, and expands PR triggers (adds staging). It removes the legacy android-passport-reader module and NFC-related docs, updates Android app config (version bump, dependencies, manifest), and wraps the app with a new FeedbackProvider.

Changes

Cohort / File(s)	Summary
AI/Automation Config /.coderabbit.yaml	Add staging to auto_review base branches.
Cursor Rules & Specs Cleanup .cursor/rules/technical-specification.mdc, .cursorrules	Remove technical spec and NFC sections from Cursor docs/rules.
Ignore/Secret Scanners .cursorignore, .gitignore, .gitleaks.toml, .gitleaksignore, .gitguardian.yml	Adjust ignore rules, include private setup script, add mock/test data paths allowlists, refine secret ignore entries.
Repo Tooling .husky/pre-commit, .prettierignore, .watchmanconfig, .yarnrc.yml, .nvmrc, .vscode/tasks.json	Add license header pre-commit check and VSCode tasks; introduce Prettier ignore; tweak Watchman; enable Yarn global cache/scripts/checksumBehavior; pin Node to 22.12.0.
Composite GitHub Actions (new) .github/actions/cache-built-deps/action.yml, .github/actions/clone-android-passport-reader/action.yml, .github/actions/mobile-setup/action.yml	Add caching of built deps; add conditional private repo clone with credential scrubbing; refine mobile setup (Yarn flags, unified install, Ruby bundle install).
Core CI Workflows .github/workflows/common-ci.yml, .github/workflows/workspace-ci.yml	Widen Yarn and build artifact caching; add build:deps; introduce workspace-wide build/type/lint jobs with caching; some checks disabled via if:false.
Mobile CI/Deploy/E2E .github/workflows/mobile-ci.yml, .github/workflows/mobile-deploy.yml, .github/workflows/mobile-deploy-auto.yml, .github/workflows/mobile-bundle-analysis.yml, .github/workflows/mobile-e2e.yml	Shift to PR triggers incl. staging; add concurrency, Node/Yarn sanitization, caching, build-deps stage; add secret/keystore/provisioning validations; integrate private module clone; restructure iOS/Android builds, add WIF upload; adjust auto-deploy skip; switch runners to macos-latest-large.
Circuits/Contracts/Web/Qrcode CI .github/workflows/circuits-build.yml, .github/workflows/circuits.yml, .github/workflows/contracts.yml, .github/workflows/npm-publish.yml, .github/workflows/web.yml, .github/workflows/qrcode-sdk-ci.yml	Add staging PR triggers, concurrency, Node version sanitization; modify caching; add contracts change detection and publish job; update web build command; unify to PR-driven CI.
Mobile SDK Demo CI (new) .github/workflows/mobile-sdk-demo-ci.yml	Add PR workflow to test/build packages/mobile-sdk-alpha/demo-app.
App: RN/Docs/ESLint app/App.tsx, app/.eslintrc.cjs, app/README.md, app/AGENTS.md, README.md	Wrap AppNavigation with FeedbackProvider; adjust ESLint (imports, disable header/no-console); update Node>=22 and platform setup docs; remove NFC doc references and NFC checklist items; note staging PR guidance.
Android App Config app/android/app/build.gradle, app/android/app/src/main/AndroidManifest.xml	Bump versionCode 85→99 and versionName 2.6.4→2.6.5; set jniLibs.useLegacyPackaging=false; upgrade org.jmrtd to 0.7.35; add androidx.activity deps; add PhotoPickerActivity and Google ModuleDependencies service; android:extractNativeLibs="false"; remove MainActivity orientation.
Remove legacy android-passport-reader module app/android/android-passport-reader/**	Delete entire module: Gradle wrapper/config, sources (activities/fragments/utils/data/models), validators, views, network, trust store/cert utilities, layouts, drawables, fonts, tests, and manifests.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor Dev
  participant WF as GitHub Workflow
  participant CBA as cache-built-deps (composite)
  participant Cache as Actions Cache
  participant Build as Yarn build:deps

  Dev->>WF: PR opened (dev/staging/main)
  WF->>CBA: Run composite with cache-version
  CBA->>Cache: Restore common/dist, mobile-sdk-alpha/dist
  alt Cache hit
    CBA-->>WF: outputs.cache-hit = true
    WF-->>Build: Skip build deps
  else Cache miss
    WF->>Build: yarn workspace @selfxyz/mobile-app run build:deps
    Build-->>WF: dist artifacts created
    WF->>Cache: Save dist paths with key
  end

Loading

sequenceDiagram
  autonumber
  actor WF as Mobile CI/Deploy
  participant Clone as clone-android-passport-reader
  participant PAT as Secrets
  participant Repo as android-passport-reader repo

  WF->>Clone: Run composite (working_directory=app)
  alt PAT provided
    Clone->>Repo: git clone using PAT (shallow)
    Clone->>Repo: scrub remote to public origin
    Clone-->>WF: Completed
  else No PAT
    Clone-->>WF: Skip cloning (log)
  end

Loading

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120+ minutes

Possibly related PRs

• Feat/contracts npm publish #1089 — Adds contracts change detection and npm publish path; overlaps with npm-publish.yml changes here.
• [SELF-654] feat: add native modules #919 — Updates native passport reader stack; related to removal of legacy android-passport-reader and jmrtd version change.
• Replace circuits building #1065 — Modifies circuits-build workflow; overlaps on triggers/concurrency/node setup updated in this PR.

Suggested labels

codex

Suggested reviewers

• aaronmgdr
• remicolin

Poem

Pipelines hum, caches prime the run,
Staging joins the chorus, jobs align as one.
Old NFC paths fade into the night,
New bots clone and build with tidy might.
Version ticks forward—99 in sight—
Ship it, with checks aglow, green light.

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title "Update main with staging 09/21/25" accurately reflects the PR's intent—bringing staging into main—and matches the PR metadata (source: staging, target: main). It is concise and specific enough for someone scanning history, though using "Merge" instead of "Update" would be slightly clearer; the included date is acceptable.

✨ Finishing touches

• 📝 Generate Docstrings

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch staging

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gitguardian]

⚠️ GitGuardian has uncovered 10 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
20511340	Triggered	Generic Private Key	ec732da	common/src/mock_certificates/sha256_rsa_130689_4096/mock_csca.key	View secret
20511341	Triggered	Generic Private Key	ec732da	common/src/mock_certificates/sha1_rsa_64321_4096/mock_csca.key	View secret
20511342	Triggered	Generic Private Key	ec732da	common/src/mock_certificates/sha256_rsa_107903_4096/mock_dsc.key	View secret
20511343	Triggered	Generic Private Key	ec732da	common/src/constants/mockCertificates.ts	View secret
20511344	Triggered	Generic Private Key	ec732da	common/src/mock_certificates/sha256_rsa_130689_4096/mock_dsc.key	View secret
20511345	Triggered	Generic Private Key	ec732da	common/src/mock_certificates/sha256_rsa_56611_4096/mock_dsc.key	View secret
20511346	Triggered	Generic Private Key	ec732da	common/src/mock_certificates/sha256_rsa_107903_4096/mock_csca.key	View secret
20511347	Triggered	Generic Private Key	ec732da	common/src/constants/mockCertificates.ts	View secret
20511348	Triggered	Generic Private Key	ec732da	common/src/mock_certificates/sha256_rsa_122125_4096/mock_csca.key	View secret
20511349	Triggered	Generic Private Key	ec732da	common/src/mock_certificates/sha256_rsa_56611_4096/mock_csca.key	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[coderabbitai]

Actionable comments posted: 9

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (12)

.husky/pre-commit (1)

1-5: Add Husky shebang and init to ensure the hook actually runs

Without the standard Husky shebang and init, the hook may not execute or may miss PATH setup for Yarn/Node on some environments.

+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+set -e
 if ! yarn gitleaks; then
   echo "❌ Gitleaks scan failed. Please review the output above and fix any issues."
   echo "💡 To skip this check temporarily, use: git commit --no-verify"
   exit 1
 fi

app/android/app/src/main/AndroidManifest.xml (2)

8-8: Remove ACCESS_SURFACE_FLINGER permission (privileged; Play will flag it)

This is a signature/privileged permission not granted to third‑party apps and commonly triggers Play Console policy warnings/rejections.

Apply:

-    <uses-permission android:name="android.permission.ACCESS_SURFACE_FLINGER" />

---

9-9: NFC permission/metadata remain but NFC module was removed in this PR

Per PR summary, NFC flows were removed. Keeping NFC permission and TECH_DISCOVERED metadata increases attack surface and may confuse Play’s permission declarations.

Apply:

-    <uses-permission android:name="android.permission.NFC" />
...
-      <meta-data
-        android:name="android.nfc.action.TECH_DISCOVERED"
-        android:resource="@xml/nfc_tech_filter" />

If NFC is still needed elsewhere, ignore this.

Also applies to: 48-51

.github/workflows/qrcode-sdk-ci.yml (1)

51-63: Replace direct actions/cache with shared cache-yarn composite per guidelines.

Our guidelines forbid calling actions/cache directly in workflows; use ./.github/actions/cache-yarn and pass cache-version for stable keys.

Apply (and replicate for each job):

-      - name: Cache Yarn dependencies
-        id: yarn-cache
-        uses: actions/cache@v4
-        with:
-          path: |
-            .yarn/cache
-            node_modules
-            sdk/qrcode/node_modules
-            common/node_modules
-          key: ${{ runner.os }}-${{ env.GH_YARN_CACHE_VERSION }}-node-${{ env.NODE_VERSION_SANITIZED }}-yarn-${{ hashFiles('yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-${{ env.GH_YARN_CACHE_VERSION }}-node-${{ env.NODE_VERSION_SANITIZED }}-yarn-
+      - name: Cache Yarn dependencies
+        uses: ./.github/actions/cache-yarn
+        with:
+          path: |
+            .yarn/cache
+            node_modules
+            sdk/qrcode/node_modules
+            common/node_modules
+          cache-version: ${{ env.GH_YARN_CACHE_VERSION }}

Also applies to: 109-121, 176-188, 236-248

.github/actions/mobile-setup/action.yml (1)

61-63: Avoid hardcoding Yarn 4.6.0; honor repo‑pinned Yarn via Corepack.

Prefer using the repo’s committed Yarn binary (yarnPath) or “corepack use” to the version from .yarn/releases/. Hardcoding risks drift vs local dev.

Apply this diff:

-        corepack enable
-        yarn set version 4.6.0
+        corepack enable
+        # Use the repo-pinned Yarn (from .yarn/releases) if present; otherwise fall back to Corepack default
+        if [ -f ".yarn/releases" ] && ls .yarn/releases/yarn-*.cjs >/dev/null 2>&1; then
+          echo "Using repo-pinned Yarn binary"
+        else
+          echo "No pinned Yarn found; using Corepack default"
+          corepack prepare yarn@stable --activate
+        fi

.github/workflows/contracts.yml (1)

51-55: Tests are disabled (if: false) — re‑enable or gate intentionally.

Merging to main without contract tests is risky. Either re‑enable now or gate with a flag/branch condition and run in staging at minimum.

Apply this diff to re‑enable:

-      - name: Run Tests (Contracts)
-        working-directory: ./contracts
-        # skip until they get fixed
-        if: false
-        run: yarn test
+      - name: Run Tests (Contracts)
+        working-directory: ./contracts
+        run: yarn test

If still flaky, consider:

• continue-on-error: true on staging only, or
• matrix to run a fast subset on main.

app/README.md (1)

203-209: Replace ChatGPT share link with an official Apple source (blocking onboarding).

The “Find your development team id” link points to a ChatGPT share, which is non‑canonical and may break. Replace it with an official Apple Developer/Xcode reference or add brief inline steps (e.g., Xcode → Settings/Preferences → Accounts → Team ID). This blocks iOS contributors if the link is inaccessible.

- Find your [development team id](https://chat.openai.com/share/9d52c37f-d9da-4a62-acb9-9e4ee8179f95) and run:
+ Find your development team ID (via Apple Developer portal or Xcode: Settings/Preferences → Accounts → select team to view Team ID), then run:

.github/workflows/web.yml (1)

18-26: Pin Node to .nvmrc (avoid silent Node 20 on ubuntu-latest).

This workflow doesn’t set up Node explicitly. On ubuntu-latest, the default is Node 20, which can break Yarn v4/PNP or builds expecting 22.12.0 from .nvmrc. Add setup-node with node-version-file before installing/building.

       - uses: actions/checkout@v4
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
       - name: Install Dependencies
         uses: ./.github/actions/yarn-install

.github/workflows/npm-publish.yml (2)

8-11: Add contracts/package.json to push path filters or contracts will never auto‑publish.

You introduced publish-contracts but didn’t include contracts/package.json in the on.push.paths. The workflow won’t trigger on contracts version bumps unless manually dispatched.

   push:
     branches:
       - dev
     paths:
       - "sdk/core/package.json"
       - "sdk/qrcode/package.json"
       - "common/package.json"
+      - "contracts/package.json"

---

26-49: Use the full push range for change detection (HEAD^ misses prior commits in a multi‑commit push).

Comparing only HEAD^..HEAD can miss version bumps if multiple commits are pushed together. Use the push event range (github.event.before → github.sha). Keep workflow_dispatch override.

-          git diff HEAD^ HEAD --name-only | grep -q "sdk/core/package.json" && echo "core_changed=true" >> $GITHUB_OUTPUT || echo "core_changed=false" >> $GITHUB_OUTPUT
-          git diff HEAD^ HEAD --name-only | grep -q "sdk/qrcode/package.json" && echo "qrcode_changed=true" >> $GITHUB_OUTPUT || echo "qrcode_changed=false" >> $GITHUB_OUTPUT
-          git diff HEAD^ HEAD --name-only | grep -q "common/package.json" && echo "common_changed=true" >> $GITHUB_OUTPUT || echo "common_changed=false" >> $GITHUB_OUTPUT
+          RANGE_START="${{ github.event.before }}"
+          RANGE_END="${{ github.sha }}"
+          DIFF_CMD="git diff --name-only ${RANGE_START} ${RANGE_END}"
+          $DIFF_CMD | grep -q "sdk/core/package.json" && echo "core_changed=true" >> $GITHUB_OUTPUT || echo "core_changed=false" >> $GITHUB_OUTPUT
+          $DIFF_CMD | grep -q "sdk/qrcode/package.json" && echo "qrcode_changed=true" >> $GITHUB_OUTPUT || echo "qrcode_changed=false" >> $GITHUB_OUTPUT
+          $DIFF_CMD | grep -q "common/package.json" && echo "common_changed=true" >> $GITHUB_OUTPUT || echo "common_changed=false" >> $GITHUB_OUTPUT
 
           # check if it was dispatched manually as well
           if git diff HEAD^ HEAD -- sdk/core/package.json | grep -q '"version":' || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             echo "core_changed=true" >> $GITHUB_OUTPUT
           fi
@@
-          if git diff HEAD^ HEAD -- contracts/package.json | grep -q '"version":' || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+          if $DIFF_CMD | grep -q "contracts/package.json" || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             echo "contracts_changed=true" >> $GITHUB_OUTPUT
           fi

.github/workflows/mobile-bundle-analysis.yml (1)

41-66: Replace direct actions/cache with shared composite cache actions

Repo guidelines require ./.github/actions/{cache-yarn,cache-bundler,cache-gradle,cache-pods}. Swap out actions/cache to avoid drift and ensure consistent keys.

Apply representative diffs (Android job):

-      - name: Cache Node Modules
-        uses: actions/cache@v4
-        with:
-          path: |
-            .yarn/cache
-            node_modules
-            app/node_modules
-          key: ${{ runner.os }}-node-${{ env.NODE_VERSION_SANITIZED }}-yarn-${{ hashFiles('yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-node-${{ env.NODE_VERSION_SANITIZED }}-yarn-
+      - name: Cache Yarn
+        uses: ./.github/actions/cache-yarn
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache-version: ${{ vars.GH_CACHE_VERSION }}

-      - name: Cache Ruby Bundler
-        uses: actions/cache@v4
-        with:
-          path: app/vendor/bundle
-          key: ${{ runner.os }}-ruby${{ env.RUBY_VERSION }}-gems-${{ hashFiles('app/Gemfile.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-ruby${{ env.RUBY_VERSION }}-gems-
+      - name: Cache Bundler
+        uses: ./.github/actions/cache-bundler
+        with:
+          ruby-version: ${{ env.RUBY_VERSION }}
+          cache-version: ${{ vars.GH_CACHE_VERSION }}

-      - name: Cache Gradle
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ runner.os }}-gradle-${{ hashFiles('app/android/**/gradle-wrapper.properties', 'app/android/**/gradle-wrapper.jar') }}
-          restore-keys: |
-            ${{ runner.os }}-gradle-
+      - name: Cache Gradle
+        uses: ./.github/actions/cache-gradle
+        with:
+          cache-version: ${{ vars.GH_CACHE_VERSION }}

(iOS job):

-      - name: Cache Node Modules
-        uses: actions/cache@v4
+      - name: Cache Yarn
+        uses: ./.github/actions/cache-yarn
         with:
-          path: |
-            .yarn/cache
-            node_modules
-            app/node_modules
-          key: ${{ runner.os }}-node${{ env.NODE_VERSION }}-yarn-${{ hashFiles('yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-node${{ env.NODE_VERSION }}-yarn-
+          node-version: ${{ env.NODE_VERSION }}
+          cache-version: ${{ vars.GH_CACHE_VERSION }}

-      - name: Cache Ruby Bundler
-        uses: actions/cache@v4
+      - name: Cache Bundler
+        uses: ./.github/actions/cache-bundler
         with:
-          path: app/vendor/bundle
-          key: ${{ runner.os }}-ruby${{ env.RUBY_VERSION }}-gems-${{ hashFiles('app/Gemfile.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-ruby${{ env.RUBY_VERSION }}-gems-
+          ruby-version: ${{ env.RUBY_VERSION }}
+          cache-version: ${{ vars.GH_CACHE_VERSION }}

-      - name: Cache CocoaPods
-        uses: actions/cache@v4
-        with:
-          path: app/ios/Pods
-          key: ${{ runner.os }}-pods-${{ hashFiles('app/ios/Podfile.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-pods-
+      - name: Cache CocoaPods
+        uses: ./.github/actions/cache-pods
+        with:
+          cache-version: ${{ vars.GH_CACHE_VERSION }}

Note: Based on retrieved learnings for this repo’s workflows to use shared composite caching actions.

Also applies to: 104-127

.github/workflows/circuits.yml (1)

37-43: Policy: stop using actions/cache directly; wrap tool cache in a shared composite.

Repo guidelines require composite caching actions from .github/actions. Circom binary caching uses actions/cache restore/save directly here. Standardize via a small composite (e.g., .github/actions/cache-file) so keys/versioning are uniform and auditable.

I can draft a minimal composite that accepts key, path, and optional restore-only behavior and update these two steps accordingly. Want me to open a PR stub?

Also applies to: 91-97

🧹 Nitpick comments (16)

.husky/pre-commit (1)

6-15: Scope license header check to staged files to avoid scanning the whole repo on every commit

Current approach scales poorly in large workspaces and slows developers down. Limit to staged files and exclude heavy/vendor dirs.

-# Check license headers
-echo "🔍 Checking license headers..."
-if ! node scripts/check-license-headers.mjs --check; then
-  echo "❌ License header check failed. Please review the output above and fix any issues."
-  echo "💡 You can auto-fix some issues with: node scripts/check-license-headers.mjs --fix"
-  echo "💡 To skip this check temporarily, use: git commit --no-verify"
-  exit 1
-fi
+# Check license headers (staged files only)
+echo "🔍 Checking license headers for staged files..."
+# Collect only relevant staged files and ignore heavy/vendor paths
+CHANGED_FILES="$(git diff --name-only --cached \
+  | grep -E '\.(ts|tsx|js|jsx|mjs|cjs|json|yml|yaml|java|kt|kts|gradle|xml|sh|sol|swift|m|mm|c|cc|cpp|h|hpp|go|rb|py)$' \
+  | grep -Ev '^(node_modules|dist|build|ios/Pods|android/(\.gradle|build)|\.yarn|\.git)/' || true)"
+
+if [ -z "$CHANGED_FILES" ]; then
+  echo "ℹ️ No relevant staged changes; skipping license header check."
+else
+  # Note: if the checker supports file args, pass them; otherwise consider adding such support.
+  if ! node scripts/check-license-headers.mjs --check $CHANGED_FILES; then
+    echo "❌ License header check failed. Please review the output above and fix any issues."
+    echo "💡 You can auto-fix some issues with: node scripts/check-license-headers.mjs --fix"
+    echo "💡 To skip this check temporarily, use: git commit --no-verify"
+    exit 1
+  fi
+fi

If the checker does not accept file paths, I can help add support or wrap it to read from stdin to keep this fast.

app/android/app/src/main/AndroidManifest.xml (2)

86-90: PhotoPickerActivity is non‑exported: verify screen privacy for user photos

Translucent UIs can be captured by screenshots/recents. If this screen previews user photos or sensitive thumbnails, set FLAG_SECURE at runtime to prevent unintended capture.

Example (in onCreate):

+getWindow().setFlags(
+    android.view.WindowManager.LayoutParams.FLAG_SECURE,
+    android.view.WindowManager.LayoutParams.FLAG_SECURE
+);

---

12-12: RECEIVE_BOOT_COMPLETED: remove permission or add BootReceiver

Manifest declares RECEIVE_BOOT_COMPLETED but no / BroadcastReceiver implementation exists in the repo — remove the permission from app/android/app/src/main/AndroidManifest.xml unless a third‑party library requires it; if you need boot handling, add an enabled and implement the BroadcastReceiver.

    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />

.github/workflows/qrcode-sdk-ci.yml (1)

29-42: DRY the “read .nvmrc” logic into a reusable step/action.

The same bash block repeats across jobs; consider a tiny composite action that exports NODE_VERSION and NODE_VERSION_SANITIZED to cut duplication and errors.

Also applies to: 87-100, 154-167, 214-227

.github/actions/mobile-setup/action.yml (1)

83-103: Ruby install step is robust.

Deployment mode + clear failure guidance is solid. Consider caching gems via our composite cache-bundler in workflows for speed.

.github/workflows/workspace-ci.yml (1)

3-14: Avoid duplicate runs on push + pull_request to the same branches.

PRs from dev/staging can double-trigger (push and PR). Add concurrency and/or drop push for PR branches to save minutes.

Apply:

 name: Workspace CI
 
 on:
   pull_request:
     branches:
       - dev
       - staging
       - main
-  push:
-    branches:
-      - dev
-      - staging
-      - main
+
+concurrency:
+  group: workspace-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true

app/README.md (1)

113-121: Fix markdown fenced code languages to satisfy lint and improve DX.

Several code fences lack a language hint (MD040). If your CI runs markdownlint, this can fail the build. Add “bash” to CLI snippets.

-```
+```bash
 adb pair PHONE_IP:PAIRING_PORT PAIRING_CODE

- +bash
adb connect PHONE_IP:DEVELOPMENT_PORT

-```
+```bash
sdk.dir=/path/to/your/android/sdk

- +bash
echo sdk.dir=$ANDROID_HOME > android/local.properties

-```
+```bash
cd ios
pod install

Also applies to: 127-135, 158-161

</blockquote></details>
<details>
<summary>.github/workflows/circuits-build.yml (1)</summary><blockquote>

`131-133`: **Use Corepack for Yarn v4 to avoid version drift across runners.**

Installing Yarn globally via npm can mismatch the repo’s intended Yarn version and PnP settings. Use Corepack to pin Yarn from the repo (aligns with your guidelines).


```diff
-      - name: Install Yarn
-        run: npm i -g yarn
+      - name: Enable Corepack (Yarn v4)
+        run: |
+          corepack enable
+          corepack prepare yarn@stable --activate

.github/workflows/common-ci.yml (2)

38-45: Ensure consistency in Yarn cache configuration.

The cache configuration is duplicated across jobs with identical paths and cache-version. Consider if this could be consolidated or if different cache keys are intentionally used for job isolation.

Consider extracting the common cache configuration to reduce duplication:

# Could define as a workflow-level environment variable or use a matrix strategy
env:
  YARN_CACHE_PATHS: |
    .yarn/cache
    node_modules
    common/node_modules
  YARN_CACHE_VERSION: v1

Also applies to: 58-65, 92-99

---

80-81: Add validation for mobile-sdk-alpha build output.

The mobile-sdk-alpha build step runs unconditionally in the type-check and test jobs. Consider adding verification that the build artifacts were created successfully.

Add verification after the build step:

 - name: Build @selfxyz/mobile-sdk-alpha
   run: yarn workspace @selfxyz/mobile-sdk-alpha build
+  - name: Verify mobile-sdk-alpha build artifacts
+    run: |
+      if [ ! -f "packages/mobile-sdk-alpha/dist/index.js" ]; then
+        echo "❌ Mobile SDK build artifacts not found"
+        exit 1
+      fi
+      echo "✅ Mobile SDK build artifacts verified"

.github/workflows/mobile-ci.yml (2)

59-63: Inconsistent Yarn version specification.

Line 62 hardcodes [email protected] while other parts reference environment variables. Consider using a consistent approach across all workflows for maintainability.

Define Yarn version consistently:

+env:
+  YARN_VERSION: "4.6.0"
+
 - name: Activate Yarn 4.6.0
-  run: corepack prepare [email protected] --activate
+  run: corepack prepare yarn@${{ env.YARN_VERSION }} --activate

Also applies to: 119-119, 225-225

---

135-180: Excessive debug logging in production CI.

The extensive debugging output (Lines 135-180) includes detailed file system checks and verbose logging. While helpful during development, this creates noise in production CI logs.

Consider conditioning debug output on a debug flag:

 - name: Debug Cache Restoration
+  if: env.CI_DEBUG == 'true'
   run: |
     echo "Cache hit: ${{ steps.built-deps.outputs.cache-hit }}"

.github/workflows/mobile-e2e.yml (1)

219-229: Inconsistent dependency installation patterns.

The iOS workflow repeats the same fork detection pattern as Android but with different step names and slight variations. Consider consistency improvements.

Extract the fork detection logic into a reusable composite action to ensure consistent behavior across platforms.

.github/workflows/mobile-bundle-analysis.yml (1)

20-20: Verify “macos-latest-large” entitlement and plan limits

Large macOS hosted runners require org enablement; if unavailable, jobs will queue/fail. Confirm availability and cost, or add a fallback.

Optional hardening outside this hunk:

+concurrency:
+  group: mobile-bundle-analysis-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read

Also applies to: 83-83

app/android/app/build.gradle (1)

220-222: Remove redundant dependency; keep only activity-ktx

activity-ktx already pulls in the base activity artifact — remove the explicit activity implementation to avoid duplicate artifacts and version skew. (mvnrepository.com)

-    implementation "androidx.activity:activity:1.9.3"
     implementation "androidx.activity:activity-ktx:1.9.3"

Activity 1.9.x requires compileSdk >= 34. (stackoverflow.com)

• app root: app/android/build.gradle -> compileSdk = 35 (OK).
• module to check: app/android/react-native-passport-reader/android/build.gradle -> compileSdkVersion 33 — bump that module to >=34 if you encounter AAR/metadata errors.

.github/workflows/circuits.yml (1)

118-122: Switch setup-node to read .nvmrc (avoid hardcoded node-version: 22)

.github/actions/yarn-install/action.yml currently calls actions/setup-node@v4 with node-version: 22 (line ~25). Hardcoding risks drift from the repo .nvmrc; update the composite to use node-version-file: .nvmrc, or add an explicit actions/setup-node@v4 step in .github/workflows/circuits.yml (lines 118–122) with node-version-file: .nvmrc to guarantee the workflow uses the repository Node version and avoid native build/workspace resolution issues.

[coderabbitai]

⚠️ Potential issue

Critical security concern: PAT exposure in git clone URL.

The PAT is embedded directly in the git clone URL, which could potentially expose it in logs or process lists. While you do scrub the credential afterward, this creates a window of vulnerability.

Consider using git credential helper or environment variables:

-          # Clone using PAT (embed temporarily, then scrub)
-          if git clone --depth 1 --quiet "https://${{ inputs.selfxyz_internal_pat }}@github.com/selfxyz/android-passport-reader.git"; then
+          # Configure git credential helper temporarily
+          git config --global credential.helper store
+          echo "https://${{ inputs.selfxyz_internal_pat }}@github.com" > ~/.git-credentials
+          
+          if git clone --depth 1 --quiet https://github.com/selfxyz/android-passport-reader.git; then
             echo "✅ android-passport-reader cloned successfully"
-            # Immediately scrub the credential from remote URL for security
-            git -C android-passport-reader remote set-url origin https://github.com/selfxyz/android-passport-reader.git || true
+            # Clean up credentials
+            rm -f ~/.git-credentials
+            git config --global --unset credential.helper

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if git clone --depth 1 --quiet "https://${{ inputs.selfxyz_internal_pat }}@github.com/selfxyz/android-passport-reader.git"; then
	echo "✅ android-passport-reader cloned successfully"
	# Immediately scrub the credential from remote URL for security
	git -C android-passport-reader remote set-url origin https://github.com/selfxyz/android-passport-reader.git || true
	else
	echo "❌ Failed to clone android-passport-reader"
	echo "Please ensure a valid SELFXYZ internal PAT is provided to this action"
	exit 1
	fi
	git config --global credential.helper store
	echo "https://${{ inputs.selfxyz_internal_pat }}@github.com" > ~/.git-credentials
	if git clone --depth 1 --quiet https://github.com/selfxyz/android-passport-reader.git; then
	echo "✅ android-passport-reader cloned successfully"
	# Clean up credentials
	rm -f ~/.git-credentials
	git config --global --unset credential.helper
	else
	echo "❌ Failed to clone android-passport-reader"
	echo "Please ensure a valid SELFXYZ internal PAT is provided to this action"
	exit 1
	fi

🤖 Prompt for AI Agents

.github/actions/clone-android-passport-reader/action.yml lines 34-42: avoid
embedding the PAT directly in the clone URL; instead remove the token from the
URL and supply credentials via a non-URL mechanism (e.g., configure git to use
an in-memory credential helper or supply an auth header). Replace the current
git clone call with one that does not include the token and either (a) use git
-c http.extraheader="AUTHORIZATION: bearer $TOKEN" clone
https://github.com/selfxyz/android-passport-reader.git, or (b) use GIT_ASKPASS
or a temporary credential helper to provide the PAT to git (approve the
credential then immediately clear it), and ensure you scrub or unset the
environment variable after use so the token never appears in process args or
logs.

[coderabbitai]

⚠️ Potential issue

🧩 Analysis chain

Avoid exposing PAT as a raw environment variable in steps

Passing SELFXYZ_INTERNAL_REPO_PAT via env increases accidental log exposure risk within the composite action. Prefer passing as an input and exporting only within the composite scope; ensure read-only, fine‑grained PAT.

Apply:

       - name: Install Mobile Dependencies
         uses: ./.github/actions/mobile-setup
         with:
           app_path: ${{ env.APP_PATH }}
           node_version: ${{ env.NODE_VERSION }}
           ruby_version: ${{ env.RUBY_VERSION }}
           workspace: ${{ env.WORKSPACE }}
-        env:
-          SELFXYZ_INTERNAL_REPO_PAT: ${{ secrets.SELFXYZ_INTERNAL_REPO_PAT }}
+          internal_repo_pat: ${{ secrets.SELFXYZ_INTERNAL_REPO_PAT }}

And ensure .github/actions/mobile-setup/action.yml defines:

inputs:
  internal_repo_pat:
    required: false
    description: Fine-grained PAT for private read access
runs:
  using: composite
  steps:
    - name: Export token
      shell: bash
      run: echo "SELFXYZ_INTERNAL_REPO_PAT=${{ inputs.internal_repo_pat }}" >> "$GITHUB_ENV"

Please confirm the composite doesn’t echo the token, uses HTTPS with token headers, and avoids set -x.

Also applies to: 134-136

---

🏁 Script executed:

#!/bin/bash
set -euox pipefail

echo "1) Searching repo for SELFXYZ_INTERNAL_REPO_PAT occurrences..."
if command -v rg >/dev/null 2>&1; then
  rg -nS "SELFXYZ_INTERNAL_REPO_PAT" || true
else
  grep -RIn --exclude-dir=.git "SELFXYZ_INTERNAL_REPO_PAT" . || true
fi

echo "----"
echo "2) Show .github/workflows/mobile-bundle-analysis.yml around lines 60-95 (if present)"
if [ -f .github/workflows/mobile-bundle-analysis.yml ]; then
  nl -ba .github/workflows/mobile-bundle-analysis.yml | sed -n '60,95p'
else
  echo "file not found: .github/workflows/mobile-bundle-analysis.yml"
fi

echo "----"
echo "3) Show .github/actions/mobile-setup/action.yml (if present)"
if [ -f .github/actions/mobile-setup/action.yml ]; then
  nl -ba .github/actions/mobile-setup/action.yml | sed -n '1,240p'
else
  echo "file not found: .github/actions/mobile-setup/action.yml"
fi

echo "----"
echo "4) Search for workflows that `uses: ./.github/actions/mobile-setup`"
if command -v rg >/dev/null 2>&1; then
  rg -nS "uses:\s*\.\/\.github\/actions\/mobile-setup" || true
else
  grep -RIn --exclude-dir=.git "uses: ./.github/actions/mobile-setup" . || true
fi

echo "----"
echo "5) Check composite action directory for echo to GITHUB_ENV or debug flags (set -x)"
if [ -d .github/actions/mobile-setup ]; then
  if command -v rg >/dev/null 2>&1; then
    rg -nS "GITHUB_ENV|echo .*GITHUB_ENV|set -x|set -o xtrace" .github/actions/mobile-setup || true
  else
    grep -RInE --exclude-dir=.git "GITHUB_ENV|echo .*GITHUB_ENV|set -x|set -o xtrace" .github/actions/mobile-setup || true
  fi
else
  echo "directory not found: .github/actions/mobile-setup"
fi

echo "Done."

Length of output: 2064

---

🏁 Script executed:

#!/bin/bash
# Extract relevant lines from the workflow
if [ -f .github/workflows/mobile-bundle-analysis.yml ]; then
  echo "---- .github/workflows/mobile-bundle-analysis.yml L60-95 ----"
  sed -n '60,95p' .github/workflows/mobile-bundle-analysis.yml
else
  echo "Workflow file not found"
fi

# Extract composite action definition
if [ -f .github/actions/mobile-setup/action.yml ]; then
  echo "---- .github/actions/mobile-setup/action.yml ----"
  sed -n '1,200p' .github/actions/mobile-setup/action.yml
else
  echo "Composite action action.yml not found"
fi

# Check composite for risky echo or debug flags
if [ -d .github/actions/mobile-setup ]; then
  echo "---- Checking for GITHUB_ENV echoes in composite ----"
  grep -RIn --exclude-dir=.git -E "echo .*GITHUB_ENV" .github/actions/mobile-setup || echo "No GITHUB_ENV echo"
  echo "---- Checking for set -x in composite ----"
  grep -RIn --exclude-dir=.git "set -x" .github/actions/mobile-setup || echo "No set -x"
else
  echo "Composite action directory not found"
fi

# Confirm workflow uses composite action
echo "---- Checking workflows for mobile-setup usage ----"
grep -RIn --exclude-dir=.git "uses: ./.github/actions/mobile-setup" .github/workflows || echo "No mobile-setup usage found in workflows"

Length of output: 5184

---

Security: stop passing SELFXYZ_INTERNAL_REPO_PAT as a step env — pass it as a composite input and export inside the composite

Workflow currently injects the PAT into step env (exposed at .github/workflows/mobile-bundle-analysis.yml L67 & L128; .github/workflows/mobile-deploy.yml L228, L239, L782). Several scripts read this var (app/scripts/setup-private-modules.cjs; app/scripts/mobile-ci-build-android.sh; app/ios/Podfile) — leaking risk is medium/high.

• Change each workflow step that uses ./.github/actions/mobile-setup to pass the secret as an input (remove the step-level env), and add an input in the composite that exports the token only inside the composite scope.
• Audit scripts that consume SELFXYZ_INTERNAL_REPO_PAT and remove patterns that embed the token in URLs (e.g., https://${TOKEN}@github.com/...). Use HTTP headers / credential helpers / GH CLI instead of embedding tokens in clone URLs.

Apply:

       - name: Install Mobile Dependencies
         uses: ./.github/actions/mobile-setup
         with:
           app_path: ${{ env.APP_PATH }}
           node_version: ${{ env.NODE_VERSION }}
           ruby_version: ${{ env.RUBY_VERSION }}
           workspace: ${{ env.WORKSPACE }}
-        env:
-          SELFXYZ_INTERNAL_REPO_PAT: ${{ secrets.SELFXYZ_INTERNAL_REPO_PAT }}
+          internal_repo_pat: ${{ secrets.SELFXYZ_INTERNAL_REPO_PAT }}

Ensure .github/actions/mobile-setup/action.yml defines:

inputs:
  internal_repo_pat:
    required: false
    description: Fine-grained PAT for private read access
runs:
  using: composite
  steps:
    - name: Export token
      shell: bash
      run: echo "SELFXYZ_INTERNAL_REPO_PAT=${{ inputs.internal_repo_pat }}" >> "$GITHUB_ENV"

Confirm the composite does NOT print the token to logs, avoids set -x, and that any git clones or HTTP calls use authorization headers or credential helpers (not token-in-URL). Apply the workflow change across all uses of ./.github/actions/mobile-setup and audit the listed scripts/files above.

[coderabbitai]

⚠️ Potential issue

🧩 Analysis chain

Verify clone action integration with Android build.

The clone action is used but verify that the android-passport-reader integration actually works with the Android build process and doesn't cause build failures when the PAT is unavailable.

---

🏁 Script executed:

#!/bin/bash
# Description: Check Android build configuration for android-passport-reader dependency

# Check if Android build files reference the cloned module
rg -n "android-passport-reader" app/android/ | head -10 || echo "No android-passport-reader references found"

# Look for settings.gradle or build.gradle references
find app/android -name "*.gradle" -exec grep -l "android-passport-reader" {} \; || echo "No gradle references found"

Length of output: 164

---

Prevent CI break: handle missing android-passport-reader clone

• app/android/settings.gradle:12 includes project(':passportreader') → './android-passport-reader/app' — Gradle will fail if that directory is missing.
• .github/workflows/mobile-ci.yml (lines ~452–456) clones that repo using secrets.SELFXYZ_INTERNAL_REPO_PAT; forked PRs / runs without the secret will make the clone fail and break the "Build Android" step.

Fix (choose one): guard the include in settings.gradle (only include if the directory exists), or make the CI clone step resilient (detect missing secret and skip/replace the module), or vendor/publish the module to avoid relying on a private repo.

🤖 Prompt for AI Agents

In .github/workflows/mobile-ci.yml around lines 452–456 the workflow
unconditionally attempts to clone the private android-passport-reader repo using
secrets.SELFXYZ_INTERNAL_REPO_PAT which will fail for forked PRs (no secret) and
break the subsequent "Build Android" step; fix by making the clone step
conditional on the secret (use an if: expression to run only when
secrets.SELFXYZ_INTERNAL_REPO_PAT is defined) or, if you prefer CI resilience,
change the step to detect the secret and when missing either create an empty
placeholder ./android-passport-reader/app directory before the build or skip
adding the module and ensure app/android/settings.gradle is guarded to include
the passportreader project only if the directory exists.

[coderabbitai]

⚠️ Potential issue

Prevent concurrent prod/internal deploys for rapid merges.

Current concurrency groups by PR ref and keeps cancel-in-progress: false, allowing overlapping releases to the same track. This risks double publishes and race-y versioning. Group by base branch (or track) and cancel in-progress.

Apply:

-concurrency:
-  group: mobile-deploy-${{ github.ref }}
-  cancel-in-progress: false
+concurrency:
+  group: mobile-deploy-${{ github.event.pull_request.base.ref }}
+  cancel-in-progress: true

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	concurrency:
	group: mobile-deploy-${{ github.ref }}
	cancel-in-progress: false
	concurrency:
	group: mobile-deploy-${{ github.event.pull_request.base.ref }}
	cancel-in-progress: true

🤖 Prompt for AI Agents

In .github/workflows/mobile-deploy-auto.yml around lines 13 to 15, the
concurrency group currently uses the PR ref and sets cancel-in-progress: false
which allows overlapping releases; change the group to target the base
branch/track and enable cancellation by replacing the group expression with
something like mobile-deploy-${{ github.event.pull_request.base.ref ||
github.ref_name }} (so PRs use the base branch and pushes use the branch name)
and set cancel-in-progress: true to ensure in-flight runs for the same track are
cancelled.

[coderabbitai]

⚠️ Potential issue

Incorrect cache key usage with cache-bundler action.

Lines 180 and 730 use key and restore-keys parameters that don't exist in the cache-bundler action. The static analysis correctly identifies this issue.

Fix the cache-bundler action usage:

 - name: Cache Ruby gems
   uses: ./.github/actions/cache-bundler
   with:
     path: ${{ env.APP_PATH }}/ios/vendor/bundle
-    key: ${{ runner.os }}-ruby${{ env.RUBY_VERSION }}-gems-${{ env.GH_CACHE_VERSION }}-${{ env.GH_GEMS_CACHE_VERSION }}-${{ hashFiles('app/Gemfile.lock') }}
-    restore-keys: |
-      ${{ runner.os }}-ruby${{ env.RUBY_VERSION }}-gems-${{ env.GH_CACHE_VERSION }}-${{ env.GH_GEMS_CACHE_VERSION }}-${{ hashFiles('app/Gemfile.lock') }}-
+    lock-file: app/Gemfile.lock
+    cache-version: ${{ env.GH_CACHE_VERSION }}-${{ env.GH_GEMS_CACHE_VERSION }}

Also applies to: 730-735

🧰 Tools

🪛 actionlint (1.7.7)

180-180: input "key" is not defined in action "Cache Bundler" defined at "./.github/actions/cache-bundler". available inputs are "cache-version", "lock-file", "path"

(action)

---

181-181: input "restore-keys" is not defined in action "Cache Bundler" defined at "./.github/actions/cache-bundler". available inputs are "cache-version", "lock-file", "path"

(action)

[coderabbitai]

⚠️ Potential issue

🧩 Analysis chain

Pin to Node 22.12.0 looks good; ensure CI picks it up from .nvmrc.

Confirm all workflows/composites use actions/setup-node with node-version-file: .nvmrc to avoid Node drift across jobs.

Run:

---

🏁 Script executed:

#!/bin/bash
# Find setup-node usages that respect .nvmrc
rg -nP --type=yaml -C2 'uses:\s*actions/setup-node@.*\n(?s).*?node-version-file:\s*\.nvmrc' .github/workflows || true

# Inspect composites for setup-node behavior (yarn-install, etc.)
fd -a action.yml .github/actions | xargs -I{} bash -lc 'echo "::group::{}"; rg -n "setup-node|node-version-file|.nvmrc" "{}"; echo "::endgroup::"'

Length of output: 1890

---

Ensure CI reads .nvmrc (Node 22.12.0)

22.12.0 in .nvmrc is fine — CI currently doesn't appear to consume it. Update every actions/setup-node@v4 step to include node-version-file: .nvmrc (or set node-version: '22.12.0').

• .github/actions/mobile-setup/action.yml — uses: actions/setup-node@v4 (line 43) — no node-version-file.
• .github/actions/yarn-install/action.yml — uses: actions/setup-node@v4 (line 23) — no node-version-file.
• No workflows in .github/workflows set node-version-file: .nvmrc (search returned no matches).

🤖 Prompt for AI Agents

.nvmrc lines 1-1: CI isn't consuming the .nvmrc Node version; update the
setup-node steps to read it. Edit .github/actions/mobile-setup/action.yml (uses:
actions/setup-node@v4 at ~line 43) and .github/actions/yarn-install/action.yml
(uses: actions/setup-node@v4 at ~line 23) to add node-version-file: .nvmrc under
the uses step (or alternatively set node-version: '22.12.0'); also search all
.github/workflows/*.yml for actions/setup-node@v4 usages and add
node-version-file: .nvmrc or set node-version: '22.12.0' there so CI
consistently uses Node 22.12.0.

[coderabbitai]

⚠️ Potential issue

Harden Yarn integrity: use checksumBehavior: "throw" (not "update").

"update" can silently rewrite checksums and mask supply‑chain tampering. Set to "throw" (especially in CI) to fail fast on mismatches.

Apply this diff:

 nodeLinker: node-modules
 enableGlobalCache: true
 enableScripts: true
-checksumBehavior: "update"
+checksumBehavior: "throw"

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	enableGlobalCache: true
	enableScripts: true
	checksumBehavior: "update"
	enableGlobalCache: true
	enableScripts: true
	checksumBehavior: "throw"

🤖 Prompt for AI Agents

In .yarnrc.yml around lines 2 to 4, the checksumBehavior is set to "update"
which can silently rewrite checksums; change checksumBehavior to "throw" so Yarn
fails on checksum mismatches (especially in CI) to harden integrity; update the
file to set checksumBehavior: "throw" and ensure CI environments do not override
this setting.

[coderabbitai]

⚠️ Potential issue

Turning off no-console globally risks PII leakage and noisy production bundles.

Prefer erroring on console usage app-wide with targeted overrides for tests/scripts (already present).

Apply:

-    'no-console': 'off',
+    'no-console': ['error', { allow: ['warn', 'error'] }],

Operational: ensure release builds strip console calls (e.g., Babel transform-remove-console or Metro equivalent in production).

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	'no-console': 'off',
	'no-console': ['error', { allow: ['warn', 'error'] }],

🤖 Prompt for AI Agents

In app/.eslintrc.cjs around line 159 the rule 'no-console' is set to 'off' which
weakens linting and risks PII/noisy production logs; change the rule to 'error'
(or 'warn' per team policy) to enforce no-console app-wide, keep or add targeted
overrides for test and script directories to allow console usage, and ensure the
production release pipeline strips console calls (e.g., add
transform-remove-console in Babel or the equivalent Metro/RN config) so builds
do not include console statements.

[coderabbitai]

⚠️ Potential issue

🧩 Analysis chain

Verify SPDX headers align with LICENSE and planned conversion date.

Headers declare BUSL-1.1 with a conversion note to Apache-2.0 on 2029-06-11. Please confirm the root LICENSE reflects this schedule and that headers are consistent across TS/TSX files to avoid compliance drift in scanners.

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Inspect LICENSE for BUSL/Apache conversion markers =="
rg -n "BUSL-1\.1|Apache-2\.0|2029-06-11" LICENSE* || true

echo "== Files under app/ missing SPDX identifier in first 3 lines =="
fd -e ts -e tsx app | xargs -I{} sh -c 'head -n3 "{}" | rg -q "SPDX-License-Identifier" || echo "{}"'

echo "== TS/TSX files explicitly marked BUSL-1.1 =="
rg -nP --glob '!**/node_modules/**' '^// SPDX-License-Identifier:\s*BUSL-1\.1' -g 'app/**/*.{ts,tsx}' || true

Length of output: 20003

---

Sync root LICENSE with file SPDX headers (BUSL-1.1 → Apache-2.0 conversion) — action required

• Root LICENSE contains no occurrences of "BUSL-1.1", "Apache-2.0", or "2029-06-11" — add an explicit conversion clause to match file headers.
• Files missing SPDX identifier in the first 3 lines (add canonical header): common/src/types/app.ts, common/src/utils/appType.ts.
• Some files embed the conversion note inline instead of a single SPDX line (examples: app/tests/utils/selfClientProvider.ts, app/src/utils/qrScanner.ts) — standardize to one SPDX line per file and ensure wording exactly matches LICENSE to avoid scanner false positives.
  Risk: compliance scans will flag mismatches; fix before release.

🤖 Prompt for AI Agents

In app/App.tsx lines 1-3, the file header declares BUSL-1.1 converting to
Apache-2.0 on 2029-06-11 but the repo root LICENSE and several files don't
match; update the root LICENSE to include an explicit BUSL-1.1 → Apache-2.0
conversion clause with the exact text and date used in headers, add the
canonical single-line SPDX header ("// SPDX-FileCopyrightText: 2025 Social
Connect Labs, Inc." and "// SPDX-License-Identifier: BUSL-1.1" plus the
conversion note as a single SPDX-style line) to common/src/types/app.ts and
common/src/utils/appType.ts, and replace any inline conversion notes in
app/tests/utils/selfClientProvider.ts and app/src/utils/qrScanner.ts with the
exact single SPDX header line that matches the LICENSE wording to ensure scanner
consistency.