Every Onyx PR ships with a linked E/App PR that becomes the bump PR. #91215

Coming from here

Background:

react-native-onyx is published as a standalone npm package and consumed by Expensify/App as an exact-pinned dependency (e.g. "react-native-onyx": "3.0.68"). Today, the workflow for shipping an Onyx change is:

  1. A developer opens a PR in Expensify/react-native-onyx.
  2. They optionally open a separate E/App PR with the Onyx version swapped (via git+https or a local link) to verify CI and prepare test steps. This is at the author's discretion.
  3. The Onyx PR is reviewed and merged on its own merits.
  4. After npm publish, a separate "bump" PR is opened in E/App pointing to the new published version.
  5. The bump PR is re-tested against E/App's current main — often 1–2 weeks after the original Onyx change — and merged.

Onyx is one of the most important dependencies of E/App, so each change carries meaningful risk. Contributors who ship to Onyx regularly tend to pair their Onyx PR with a linked E/App PR and validate end-to-end before merging. Occasional contributors - less familiar with the workflow and often open the Onyx PR on its own, without an E/App-side PR or testing against E/App at all.

Problem:

When an Onyx PR is merged without being validated against E/App's current main at the time of merge, regressions surface only weeks later during the bump, which prevents E/App from upgrading to the latest Onyx version quickly and confidently.

Solution:

1. Mandatory linked E/App PR per Onyx PR:

• Onyx PRs must include a Linked E/App PR: line in the PR body pointing to a corresponding Expensify/App PR. Existing validatePRChecklist action must be updated to parse the linked PR URL from the body and fail the check if the link is missing.
• The linked E/App PR pins to the Onyx PR HEAD via git+https ("react-native-onyx": "git+https://github.com/Expensify/react-native-onyx.git#<commit_sha>). It's a proven working pattern.

2. Single review surface for both PRs.

• The E/App PR runs the full E/App test suite, typecheck, lint, etc. This + manual testing passing is the authoritative signal that the Onyx change is safe.
  - The Onyx PR reviewer reviews and approves both PRs.
• The Onyx PR checklists gains a "Verified against linked E/App PR" item that must be ticked at approval.

3. After the Onyx PR is merged and the new version publishes to npm, the Onyx author manually updates the linked E/App PR: swap onyx sha version to the pinned published version (e.g. "react-native-onyx": "3.0.72"), push the commit, and request a final review.