Merge pull request #2177 from selfxyz/staging

Release to Production v2.9.24 - 2026-06-14

Author: transphorm

.cursorignore

@@ -42,7 +42,7 @@ circuits/scripts/server/*.sh
 
 # Test wallets and mock data
 app/ios/passport.json
-app/ios/OpenPassport/passport.json
+app/ios/Self/passport.json
 
 # Environment sample files
 app/env.sample

.github/CI_FORCE_RUN

@@ -0,0 +1,43 @@
+# CI Force-Run Sentinel
+
+Every path-filtered CI workflow under `.github/workflows/` lists this file
+in its `paths:` filter (or, for workflows with an internal `check_changes`
+gate, in its diff allowlist). Editing this file forces those workflows to
+run on the next push, which is useful when:
+
+- Migrating tooling (package manager, Node version, monorepo runner)
+- Refactoring shared `.github/actions/*` composite actions
+- Pre-merge confidence check on a large branch
+- Verifying that a workflow you _think_ is unrelated to your changes still
+  passes
+
+## Scope and limitations
+
+- Triggers path-filtered `pull_request` / `push` workflows only.
+- Does **not** trigger workflows gated on `workflow_dispatch` / `schedule`
+  only (e.g. `release-calendar.yml`), nor workflows whose `push:` event
+  filters this branch out (e.g. `npm-publish.yml` only runs on `push` to
+  `dev`).
+- Jobs guarded by `if: github.event.pull_request.head.repo.fork == false`
+  still skip on fork PRs by design (secrets are not exposed to forks).
+- Jobs hard-disabled with `if: false` stay disabled regardless of the
+  sentinel.
+
+Run `python3 scripts/ci/add-force-run-sentinel.py --check` to verify that
+every workflow with a `paths:` block lists this sentinel and that internal
+`check_changes` allowlists include it too.
+
+## How to use
+
+1. Add a one-line entry to the log below with date + reason.
+2. Commit on your branch. Path-filtered CI workflows will run on the PR.
+3. After verification, you may revert the entry before merge (optional —
+   the file is intentionally low-churn; leaving entries as a history is
+   also fine).
+
+## Log
+
+- 2026-05-13 — Force-run all workflows to verify Yarn → pnpm migration
+  (PR #2069).
+- 2026-05-13 — Re-trigger after enabling check_changes sentinel + debug
+  step + re-enabling web/workspace jobs (PR #2069).

.github/PULL_REQUEST_TEMPLATE.md

@@ -14,13 +14,13 @@
 
 Run each command and check the box only after it passes. Paste failures into the Test plan.
 
-- [ ] `yarn lint && yarn types` pass
-- [ ] Bridge contract tests pass: `cd app && yarn jest:run` and `yarn workspace @selfxyz/rn-sdk-test-app test`
-- [ ] If `packages/mobile-sdk-alpha` touched: `cd packages/mobile-sdk-alpha && yarn test && yarn types` pass
-- [ ] Diff of `.kt`/`.swift` reviewed — no business logic added (only hardware/OS access; logic lives in TypeScript)
+- [ ] `pnpm lint && pnpm types` pass
+- [ ] Bridge contract tests pass: `cd app && pnpm jest:run` and `pnpm --filter @selfxyz/rn-sdk-test-app test`
+- [ ] If `packages/mobile-sdk-alpha` touched: `pnpm --filter @selfxyz/mobile-sdk-alpha test && pnpm --filter @selfxyz/mobile-sdk-alpha types` pass
+- [ ] Diff of `.kt`/`.swift` reviewed - no business logic added (only hardware/OS access; logic lives in TypeScript)
 - [ ] NativeModules bridge contract (method names, payload keys, error codes) unchanged, or the change is intentional and described in the summary
 
-**Cannot be verified by an agent — flag for human QA:**
+**Cannot be verified by an agent - flag for human QA:**
 
-- [ ] Native builds (app + RN test app, iOS + Android) — relying on CI, or needs a human local build
-- [ ] On-device smoke test of the affected flow (e.g. NFC passport read, MRZ camera scan) — **needs human**, or N/A if no runtime behavior changed
+- [ ] Native builds (app + RN test app, iOS + Android) - relying on CI, or needs a human local build
+- [ ] On-device smoke test of the affected flow (e.g. NFC passport read, MRZ camera scan) - **needs human**, or N/A if no runtime behavior changed

.github/actions/cache-core-sdk-build/action.yml

@@ -29,9 +29,6 @@ runs:
         path: |
           common/dist
           sdk/core/dist
-          node_modules
-          sdk/core/node_modules
-          common/node_modules
         key: core-sdk-build-${{ inputs.cache-version }}-${{ github.sha }}
         fail-on-cache-miss: ${{ inputs.fail-on-cache-miss }}
     - id: save
@@ -41,7 +38,4 @@ runs:
         path: |
           common/dist
           sdk/core/dist
-          node_modules
-          sdk/core/node_modules
-          common/node_modules
         key: core-sdk-build-${{ inputs.cache-version }}-${{ github.sha }}

.github/actions/cache-mobile-sdk-build/action.yml

@@ -29,9 +29,6 @@ runs:
         path: |
           common/dist
           packages/mobile-sdk-alpha/dist
-          node_modules
-          packages/mobile-sdk-alpha/node_modules
-          common/node_modules
         key: mobile-sdk-alpha-build-${{ inputs.cache-version }}-${{ github.sha }}
         fail-on-cache-miss: ${{ inputs.fail-on-cache-miss }}
     - id: save
@@ -41,7 +38,4 @@ runs:
         path: |
           common/dist
           packages/mobile-sdk-alpha/dist
-          node_modules
-          packages/mobile-sdk-alpha/node_modules
-          common/node_modules
         key: mobile-sdk-alpha-build-${{ inputs.cache-version }}-${{ github.sha }}

.github/actions/cache-pnpm/action.yml

@@ -0,0 +1,46 @@
+name: Cache PNPM
+
+description: Cache the pnpm content-addressable store. Do not cache node_modules — pnpm uses `.modules.yaml` as an up-to-date marker and will skip re-linking workspace packages if a partial node_modules tree is restored.
+
+inputs:
+  lock-file:
+    description: Path to pnpm-lock.yaml
+    required: false
+    default: pnpm-lock.yaml
+  cache-version:
+    description: Additional cache version segment
+    required: false
+    default: v2
+
+outputs:
+  cache-hit:
+    description: Whether an exact match was found for the cache key
+    value: ${{ steps.cache.outputs.cache-hit }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: get-hash
+      name: Hash lock file
+      shell: bash
+      run: |
+        if [ -f "${{ inputs.lock-file }}" ]; then
+          echo "hash=$(shasum -a 256 "${{ inputs.lock-file }}" | awk '{ print $1 }')" >> $GITHUB_OUTPUT
+        else
+          echo "::warning::Lock file '${{ inputs.lock-file }}' not found."
+          echo "hash=no-lock-file" >> $GITHUB_OUTPUT
+        fi
+    - id: cache
+      name: Cache pnpm store
+      uses: actions/cache@v4
+      with:
+        # Default pnpm store locations on Linux/macOS. If PNPM_HOME is set or
+        # pnpm changes its default store path in a future release, update
+        # these paths or invoke `pnpm store path --silent` dynamically.
+        path: |
+          ~/.local/share/pnpm/store
+          ~/Library/pnpm/store
+        key: ${{ runner.os }}-pnpm-store-${{ inputs.cache-version }}-${{ steps.get-hash.outputs.hash }}
+        restore-keys: |
+          ${{ runner.os }}-pnpm-store-${{ inputs.cache-version }}-
+          ${{ runner.os }}-pnpm-store-

.github/actions/cache-yarn/action.yml

@@ -0,0 +1,35 @@
+name: Check Nested Requires
+description: Fail CI if tests contain nested require() patterns that can trigger OOMs.
+
+inputs:
+  paths:
+    description: Newline-separated list of paths to scan.
+    required: true
+  pattern:
+    description: Extended regular expression to search for.
+    required: false
+    default: "require\\(['\"]react(-native)?['\"]\\)"
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        CHECK_PATHS: ${{ inputs.paths }}
+        CHECK_PATTERN: ${{ inputs.pattern }}
+      run: |
+        set -euo pipefail
+
+        paths=()
+        while IFS= read -r path; do
+          if [[ -n "$path" ]]; then
+            paths+=("$path")
+          fi
+        done <<< "$CHECK_PATHS"
+
+        if grep -rE "$CHECK_PATTERN" -- "${paths[@]}" 2>/dev/null; then
+          echo "❌ Found nested require() patterns that cause OOM in CI"
+          exit 1
+        fi
+
+        echo "✅ No nested require() patterns found"

.github/actions/check-nested-requires/action.yml

@@ -57,28 +57,28 @@ runs:
       run: |
         cd ${{ inputs.app_path }}
 
-        # Configure Yarn
+        # Configure pnpm
         corepack enable
-        yarn set version 4.12.0
 
         echo "📦 Installing JavaScript dependencies with strict lock file..."
-        if ! yarn install --immutable --inline-builds; then
+        # Force full dependency installation even when workflows export NODE_ENV=production.
+        if ! NODE_ENV=development pnpm install --frozen-lockfile --no-prod; then
           echo ""
-          echo "❌ ERROR: yarn.lock is out of date!"
+          echo "❌ ERROR: pnpm-lock.yaml is out of date!"
           echo ""
-          echo "This happens when package.json was modified but yarn.lock wasn't updated."
+          echo "This happens when package.json was modified but pnpm-lock.yaml wasn't updated."
           echo ""
           echo "To fix this:"
-          echo "  1. Run 'yarn install' locally in the app directory"
-          echo "  2. Commit the updated yarn.lock file"
+          echo "  1. Run 'pnpm install' locally at the repository root"
+          echo "  2. Commit the updated pnpm-lock.yaml file"
           echo "  3. Push your changes"
           echo ""
           echo "This ensures everyone has the exact same dependency versions."
           exit 1
         fi
 
-        # Run mobile-specific installation
-        yarn install-app:mobile-deploy
+        # Run mobile-specific installation with full dependency graph as well.
+        NODE_ENV=development pnpm install-app:mobile-deploy
 
     - name: Install Ruby dependencies
       shell: bash

.github/actions/mobile-setup/action.yml

@@ -1,6 +1,6 @@
-name: Yarn Install
+name: PNPM Install
 
-description: Install Yarn v4 and run yarn install.
+description: Install pnpm and run pnpm install.
 
 inputs:
   working_directory:
@@ -11,27 +11,21 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Install Yarn v4
-      shell: bash
-      run: |
-        corepack enable
-        corepack prepare yarn@4.12.0 --activate
-        # Ensure we're using the correct version
-        yarn --version
-
     - name: Setup Node.js
       uses: actions/setup-node@v4
       with:
         node-version-file: .nvmrc
-        cache: "yarn"
-        cache-dependency-path: |
-          yarn.lock
-          .yarnrc.yml
+
+    - name: Install pnpm
+      shell: bash
+      run: |
+        corepack enable
+        pnpm --version
 
     - name: Install dependencies
       uses: nick-fields/retry@v3
       with:
         timeout_minutes: 10
         max_attempts: 3
         retry_wait_seconds: 5
-        command: yarn install --immutable
+        command: pnpm install --frozen-lockfile