[No QA] Merge Main

.github/PULL_REQUEST_TEMPLATE.md

@@ -106,6 +106,11 @@ This is a checklist for PR authors. Please make sure to complete all tasks and c
 - [ ] If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
     - [ ] I verified that all the inputs inside a form are aligned with each other.
     - [ ] I added `Design` label and/or tagged `@Expensify/design` so the design team can review the changes.
+- [ ] If the PR adds or modifies the UI:
+    - [ ] I asked an AI agent to review the changes for accessibility issues and addressed its findings.
+    - [ ] I tested with a screen reader (VoiceOver on macOS) and verified all new/changed elements are reachable with a logical focus order.
+    - [ ] I verified all new/changed elements have meaningful accessible names and roles.
+    - [ ] I verified state changes are announced (e.g. checked/unchecked, expanded/collapsed, selected).
 - [ ] I added [unit tests](https://github.com/Expensify/App/blob/main/tests/README.md) for any new feature or bug fix in this PR to help automatically prevent regressions in this user flow.
 - [ ] If the `main` branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the `Test` steps.
 

.github/actions/composite/uploadSentrySizeAnalysis/action.yml

@@ -61,9 +61,17 @@ runs:
         ASSET: ${{ inputs.asset-name }}
         PLATFORM: ${{ inputs.platform }}
       run: |
+        # Capture the exit code so bash -e does not discard the CLI diagnostic on failure
+        set +e
         OUTPUT=$(npx sentry-cli build upload "$ASSET" \
           --org expensify --project app --build-configuration Release --log-level info 2>&1)
+        EXIT_CODE=$?
+        set -e
         echo "$OUTPUT"
+        if [ "$EXIT_CODE" -ne 0 ]; then
+          echo "::error::${PLATFORM} Sentry size-analysis upload failed (exit $EXIT_CODE)"
+          exit "$EXIT_CODE"
+        fi
         SENTRY_URL=$(echo "$OUTPUT" | grep -oE 'https://expensify\.sentry\.io/[^ )"}]+' | head -1)
         if [ -n "$SENTRY_URL" ]; then
           echo "::notice::${PLATFORM} Sentry size analysis: $SENTRY_URL"

.github/actions/javascript/markPullRequestsAsDeployed/index.js

@@ -26670,6 +26670,12 @@ function getDeployTableMessage(platformResult) {
       return `${platformResult} \u274C`;
   }
 }
+function parseDeployList(input) {
+  if (!Array.isArray(input) || input.some((item) => typeof item !== "string" && typeof item !== "number")) {
+    throw new TypeError("Deploy pull request list must be an array of strings or numbers");
+  }
+  return input.map((item) => Number.parseInt(String(item), 10));
+}
 async function commentPR(PR, message, repo = context2.repo.repo) {
   try {
     await GithubUtils_default.createComment(repo, PR, message);
@@ -26716,7 +26722,10 @@ async function commentOnDeployChecklistPRs(prList, repoName, recentTags, getDepl
         const deployMessage = deployer ? getDeployMessage(deployer, isCP ? "Cherry-picked" : "Deployed", title) : "";
         await commentPR(prNumber, deployMessage, repoName);
       } catch (error2) {
-        if (error2.status === 404) {
+        if (error2 === null || error2 === void 0) {
+          throw new TypeError(`Cannot read properties of ${String(error2)} (reading 'status')`);
+        }
+        if ((typeof error2 === "object" || typeof error2 === "function") && "status" in error2 && error2.status === 404) {
           console.log(`Unable to comment on ${repoName} PR #${prNumber}. GitHub responded with 404.`);
         } else if (repoName === CONST_default.MOBILE_EXPENSIFY_REPO && process.env.GITHUB_REPOSITORY !== `${CONST_default.GITHUB_OWNER}/${CONST_default.APP_REPO}`) {
           console.warn(`Unable to comment on ${repoName} PR #${prNumber} from forked repository. This is expected.`);
@@ -26729,10 +26738,10 @@ async function commentOnDeployChecklistPRs(prList, repoName, recentTags, getDepl
   await Promise.all(commentPromises);
 }
 async function run() {
-  const prList = getJSONInput("PR_LIST", { required: true }).map((num) => Number.parseInt(num, 10));
+  const prList = parseDeployList(getJSONInput("PR_LIST", { required: true }));
   const mobileExpensifyPRListInput = getJSONInput("MOBILE_EXPENSIFY_PR_LIST", { required: false });
-  const mobileExpensifyPRList = Array.isArray(mobileExpensifyPRListInput) ? mobileExpensifyPRListInput.map((num) => Number.parseInt(num, 10)) : [];
-  const isProd = getJSONInput("IS_PRODUCTION_DEPLOY", {
+  const mobileExpensifyPRList = Array.isArray(mobileExpensifyPRListInput) ? parseDeployList(mobileExpensifyPRListInput) : [];
+  const isProd = !!getJSONInput("IS_PRODUCTION_DEPLOY", {
     required: true
   });
   const version = getInput("DEPLOY_VERSION", { required: true });

.github/actions/javascript/markPullRequestsAsDeployed/markPullRequestsAsDeployed.ts

@@ -5,18 +5,14 @@ import GithubUtils from '@github/libs/GithubUtils';
 
 import PromisePool from '@scripts/utils/PromisePool';
 
-import type {RequestError} from '@octokit/types';
-
 import * as core from '@actions/core';
 import {context} from '@actions/github';
 import memoize from 'lodash/memoize';
 
-type PlatformResult = 'success' | 'cancelled' | 'skipped' | 'failure';
-
 /**
  * Return a nicely formatted message for the table based on the result of the GitHub action job
  */
-function getDeployTableMessage(platformResult: PlatformResult): string {
+function getDeployTableMessage(platformResult: string): string {
     switch (platformResult) {
         case 'success':
             return `${platformResult} ✅`;
@@ -30,6 +26,14 @@ function getDeployTableMessage(platformResult: PlatformResult): string {
     }
 }
 
+function parseDeployList(input: unknown): number[] {
+    if (!Array.isArray(input) || input.some((item) => typeof item !== 'string' && typeof item !== 'number')) {
+        throw new TypeError('Deploy pull request list must be an array of strings or numbers');
+    }
+
+    return input.map((item) => Number.parseInt(String(item), 10));
+}
+
 async function commentPR(PR: number, message: string, repo: string = context.repo.repo) {
     try {
         await GithubUtils.createComment(repo, PR, message);
@@ -90,7 +94,11 @@ async function commentOnDeployChecklistPRs(
                 const deployMessage = deployer ? getDeployMessage(deployer, isCP ? 'Cherry-picked' : 'Deployed', title) : '';
                 await commentPR(prNumber, deployMessage, repoName);
             } catch (error) {
-                if ((error as RequestError).status === 404) {
+                // Preserve the former direct `.status` access ordering for nullish rejections.
+                if (error === null || error === undefined) {
+                    throw new TypeError(`Cannot read properties of ${String(error)} (reading 'status')`);
+                }
+                if ((typeof error === 'object' || typeof error === 'function') && 'status' in error && error.status === 404) {
                     console.log(`Unable to comment on ${repoName} PR #${prNumber}. GitHub responded with 404.`);
                 } else if (repoName === CONST.MOBILE_EXPENSIFY_REPO && process.env.GITHUB_REPOSITORY !== `${CONST.GITHUB_OWNER}/${CONST.APP_REPO}`) {
                     console.warn(`Unable to comment on ${repoName} PR #${prNumber} from forked repository. This is expected.`);
@@ -105,17 +113,17 @@ async function commentOnDeployChecklistPRs(
 }
 
 async function run() {
-    const prList = (ActionUtils.getJSONInput('PR_LIST', {required: true}) as string[]).map((num) => Number.parseInt(num, 10));
+    const prList = parseDeployList(ActionUtils.getJSONInput('PR_LIST', {required: true}));
     const mobileExpensifyPRListInput = ActionUtils.getJSONInput('MOBILE_EXPENSIFY_PR_LIST', {required: false});
-    const mobileExpensifyPRList = Array.isArray(mobileExpensifyPRListInput) ? mobileExpensifyPRListInput.map((num: string) => Number.parseInt(num, 10)) : [];
-    const isProd = ActionUtils.getJSONInput('IS_PRODUCTION_DEPLOY', {
+    const mobileExpensifyPRList = Array.isArray(mobileExpensifyPRListInput) ? parseDeployList(mobileExpensifyPRListInput) : [];
+    const isProd = !!ActionUtils.getJSONInput('IS_PRODUCTION_DEPLOY', {
         required: true,
-    }) as boolean;
+    });
     const version = core.getInput('DEPLOY_VERSION', {required: true});
 
-    const androidResult = getDeployTableMessage(core.getInput('ANDROID', {required: true}) as PlatformResult);
-    const iOSResult = getDeployTableMessage(core.getInput('IOS', {required: true}) as PlatformResult);
-    const webResult = getDeployTableMessage(core.getInput('WEB', {required: true}) as PlatformResult);
+    const androidResult = getDeployTableMessage(core.getInput('ANDROID', {required: true}));
+    const iOSResult = getDeployTableMessage(core.getInput('IOS', {required: true}));
+    const webResult = getDeployTableMessage(core.getInput('WEB', {required: true}));
 
     const date = core.getInput('DATE');
     const note = core.getInput('NOTE');

.github/scripts/syncVersions.sh

@@ -17,16 +17,17 @@
 #     with push access to App main.
 #   - GITHUB_OUTPUT: written by `check` and `sync` (defaults to /dev/null outside GitHub Actions).
 #   - TARGET_VERSION (sync, optional): version to sync to. Must equal the Mobile-Expensify version,
-#     since only the App side is rewritten and the final verification compares the two. Empty means
-#     "use the Mobile-Expensify version".
+#     since only the App side is rewritten and the final verification compares the two. Anything else
+#     is rejected before the sync writes or pushes. Empty means "use the Mobile-Expensify version".
 #   - NEED_FULL_VERSION_SYNC (sync): 'true' to rewrite versions, anything else to only bump the
 #     submodule pointer. Threaded from `check` so exactly one decision exists across both steps.
 #   - EXPECTED_SUBMODULE_SHA (sync): Mobile-Expensify SHA `check` updated to. The submodule-only
-#     path asserts against it so a checkout that moved in between is caught.
+#     path asserts against it so a checkout that moved in between is caught, and verification uses
+#     it to tell "this sync went wrong" apart from "Mobile-Expensify moved on again".
 #
 # Outputs (via GITHUB_OUTPUT):
 #   - check: IN_SYNC, NEED_FULL_VERSION_SYNC, ACTUAL_SHA
-#   - sync:  POST_SYNC_APP_VERSION
+#   - sync:  POST_SYNC_APP_VERSION, SUBMODULE_MATCHES_REMOTE
 #
 # Side effects:
 #   - `check` is not read-only: it runs `git submodule update --remote`.
@@ -96,17 +97,25 @@ function update_ios_versions {
 }
 
 function resolve_target_version {
-    if [[ -n "$TARGET_VERSION" ]]; then
-        echo "Using provided target version: $TARGET_VERSION" >&2
-        echo "$TARGET_VERSION"
-        return
-    fi
-
     # Use Mobile-Expensify version as source of truth since it was pushed first
     local me_version
     me_version="$(get_mobile_expensify_version)"
-    echo "Using Mobile-Expensify version as target: $me_version" >&2
-    echo "$me_version"
+
+    if [[ -z "$TARGET_VERSION" ]]; then
+        echo "Using Mobile-Expensify version as target: $me_version" >&2
+        echo "$me_version"
+        return
+    fi
+
+    # Only the App side is rewritten, so any other target fails verification -- after the commits
+    # have already been pushed to main. Reject it before anything is written.
+    if [[ "$TARGET_VERSION" != "$me_version" ]]; then
+        echo "::error::TARGET_VERSION ($TARGET_VERSION) must match the Mobile-Expensify version ($me_version)" >&2
+        exit 1
+    fi
+
+    echo "Using provided target version: $TARGET_VERSION" >&2
+    echo "$TARGET_VERSION"
 }
 
 function cmd_check {
@@ -168,10 +177,12 @@ function sync_full_version {
     git add package.json package-lock.json android/app/build.gradle ios/*/Info.plist
     git commit -m "Update version to $target (sync recovery)"
 
-    # Stages the submodule's checked-out HEAD, which is the commit `check` moved it to with
-    # --remote, not whatever main currently records.
+    # Stages the submodule's checked-out HEAD, the commit `check` moved it to with --remote. That can
+    # already be what main records, when a previous sync got this far and then died, hence the guard.
     git add Mobile-Expensify
-    git commit -m "Update Mobile-Expensify submodule version to $target (sync recovery)"
+    if ! git diff --staged --quiet; then
+        git commit -m "Update Mobile-Expensify submodule version to $target (sync recovery)"
+    fi
 
     # main is busy enough that another merge can land between `check` and here, which makes this
     # push non fast-forward.
@@ -233,12 +244,25 @@ function verify_sync {
     recorded=$(git rev-parse HEAD:Mobile-Expensify)
     remote_sha=$(git -C Mobile-Expensify rev-parse origin/main)
     if [[ "$recorded" != "$remote_sha" ]]; then
-        echo "::error::Submodule on App main ($recorded) still differs from Mobile-Expensify origin/main ($remote_sha)"
-        exit 1
+        # Mobile-Expensify main can advance mid-run, which is likely because a deployer triggers this
+        # during a deploy. Recording what `check` pinned is still a successful sync, so report it and
+        # let the next run collect the newer commit.
+        if [[ "$recorded" == "$EXPECTED_SUBMODULE_SHA" ]]; then
+            echo "::warning::Mobile-Expensify main advanced to $remote_sha while syncing. App main records $recorded, which is what this run set out to record. Re-run to pick up the newer commit."
+            set_output SUBMODULE_MATCHES_REMOTE false
+        else
+            echo "::error::Submodule on App main ($recorded) still differs from Mobile-Expensify origin/main ($remote_sha)"
+            exit 1
+        fi
     fi
 
     set_output POST_SYNC_APP_VERSION "$app_version"
-    echo "::notice::✅ Verified versions ($app_version) and submodule match Mobile-Expensify main ($recorded)"
+    if [[ "$recorded" == "$remote_sha" ]]; then
+        set_output SUBMODULE_MATCHES_REMOTE true
+        echo "::notice::✅ Verified versions ($app_version) and submodule match Mobile-Expensify main ($recorded)"
+    else
+        echo "::notice::✅ Verified versions ($app_version); submodule records $recorded, one behind Mobile-Expensify main"
+    fi
 }
 
 function cmd_sync {

.github/workflows/buildAdHoc.yml

@@ -136,6 +136,7 @@ jobs:
           BUCKET="s3://ad-hoc-expensify-cash/web/${{ inputs.APP_PR_NUMBER }}"
 
           aws s3 sync dist "$BUCKET" --delete --acl public-read \
+            --exclude "*.br" \
             --exclude "index.html" \
             --exclude "service-worker.js" \
             --exclude "workbox-*.js" \