lockfile-lint doesn't support pnpm-lock.yaml. pnpm enforces tarball
integrity hashes on install, covering the core supply-chain concern.
The explicit allowlists (hosts, schemes, git URLs) are gone with it;
acceptable tradeoff for now.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- switch root package manager to pnpm 10.33.4 via packageManager field
- add .npmrc with node-linker=hoisted for RN/Expo compatibility
- convert yarn resolutions to pnpm.overrides; pin psl@1.9.0 and @types/psl@1.1.1
to keep types resolving under exports-aware resolution
- pin react-compiler-runtime and babel-plugin-react-compiler to real rc.3 (the
deprecated "Wrong version name was published" tag would otherwise resolve)
- add pnpm.onlyBuiltDependencies allowlist for @sentry/cli, core-js-pure,
esbuild, unrs-resolver
- regenerate pnpm-lock.yaml; delete yarn.lock; drop postinstall-postinstall
- update all workflows, Dockerfile, Dockerfile.embedr (root-level), Makefile,
conductor.json; bskyembed/bskylink/bskyogcard/dev-env stay on yarn
- update docs (CLAUDE.md, docs/build.md, docs/testing.md, docs/localization.md,
bskyweb/README.md, scripts/push-notification/README.md, BlueskyClip/README.md)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sets the "What to test" field in TestFlight to distinguish between
TestFlight and Production builds.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Configure concurrency groups so only one iOS build and one Android build
can run at a time across all workflows. This prevents manual builds from
conflicting with automatic builds triggered by fingerprint changes.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* use xlarge runner for macos build
* try and fix yarn cache
* update actions/cache for pods step
* use expo github action main rather than v8
* update all actions to the same
* use yarn cache where missing
* Clean up env files
* Use new env in Sentry setup file
* Use new env in Bitdrift setup file
* Use new env in chat proxy header
* Prefix Bitdrift key with EXPO_PUBLIC
* Deprecate SENTRY_RELEASE since we use package.json now
* Use existing EXPO_PUBLIC_BUNDLE_IDENTIFIER short commit has as Sentry dist value
* Fix missing bundle identifier for Render deploys
* Deprecate SENTRY_DIST in favor of EXPO_PUBLIC_BUNDLE_IDENTIFIER
* Prefix SENTRY_DSN with EXPO_PUBLIC to match others
* Remove debugging field
* Replace NODE_ENV in places where its safe
* Self review
* Properly patch Sentry package
* Echo variables to .env in Dockerfile instead of passing to shell script
* Make sure EXPO_PUBLIC_ENV is set for web container builds
* Update IS_TESTFLIGHT to include testflight-android
* Slice bundle hash to match other platforms, needed for render.com deployments
* [APP-1331] Migrate `app-info` to new env (#8703)
* Move env files into directory with platform specific files
* Migrate usages of app-info to new env
* Fix bad import
* Update BUNDLE_DATE format comment
* Trim RENDER_GIT_COMMIT to first 7 to match --short sha
* Clarify build process env vars and ensure they are explicitly passed in
* Revert Sentry patch as a result of prev commit
* Update webpack Sentry dist value based on prev commits
* Add PACKAGE_VERSION and replace in statsig to fix conflict
* Fix render substitution syntax
* Remove invalid syntax
* Remove unnecessary testflight check
* Just use long commit hash
* Slice full hash for display in app
* Fix missing space in ios workflow
* Pass in sentry CLI env vars, align matching values
* Align on RELEASE_VERSION
* Add new env setup to missed OTA spot
* Update webpack to use same SENTRY_RELEASE var
* Just fallback to package version for Render deploys
* Remove TF check for BUNDLE_DATE
* Set EXPO_PUBLIC_ENV for bundle update
* Consistent naming "Env"
* Add comment
* Use RELEASE_VERSION instead of package.json
* Update PR comment CI
Samuel Newman