Merge main into my PR

.claude/skills/coding-standards/rules/clean-react-1-composition-over-config.md

@@ -462,11 +462,11 @@ In all cases, the rule applies to: **new components**, **new features added to e
 - The optional prop is used for logic beyond just conditional rendering (e.g., computing derived values, passed to callbacks, used in multiple places within the component)
 - The component is a thin wrapper around a platform primitive (e.g., wrapping `TextInput`, `ScrollView`, `Pressable`) — these naturally pass through configuration props
 - Items come from **runtime data** (API responses, user-generated content, Onyx collections) — dynamic data must be mapped
-- The array is used with **list components** (e.g., `FlatList`, `SectionList`, or custom wrappers) — these require data arrays by design
+- The array is used with **list components** (e.g., `FlatList`, or custom wrappers) — these require data arrays by design
 - Items are truly **homogeneous** (same shape, same behavior, only values differ) and the count is **unbounded** (e.g., list of chat messages, search results)
 - The array is a **framework requirement** (e.g., React Navigation screen config, form validation rules)
 - The `ReactNode` prop is `children` itself — `children` is the foundation of composition, not configuration
-- The render function is a **list component callback** (`renderItem` on `FlatList`, `SectionList`, `DraggableList`) — these are framework requirements
+- The render function is a **list component callback** (`renderItem` on `FlatList`, `DraggableList`) — these are framework requirements
 - The render function receives **per-item runtime data** from a dynamic collection (e.g., `renderSuggestionMenuItem(item, index)`) — this is list-style rendering, not slot configuration
 
 **Search Patterns** (hints for reviewers):

.claude/skills/coding-standards/rules/perf-1-no-spread-in-renderitem.md

@@ -37,7 +37,7 @@ title: No spread in list item's renderItem
 
 Flag ONLY when ALL of these are true:
 
-- Code is inside a renderItem function (function passed to FlatList, SectionList, etc.)
+- Code is inside a renderItem function (function passed to FlatList, etc.)
 - A spread operator (...) is used on an object
 - That object is being passed as a prop to a component
 - The spread creates a NEW object literal inline

.github/ISSUE_TEMPLATE/Standard.md

@@ -1,7 +1,7 @@
 ---
 name: Standard issue template
 about: A standard template to follow when creating a new issue in this repository
-labels: Bug, Daily, External
+labels: Bug, Daily
 ---
 
 If you haven’t already, check out our [contributing guidelines](https://github.com/Expensify/ReactNativeChat/blob/main/contributingGuides/CONTRIBUTING.md) for onboarding and email contributors@expensify.com to request to join our Slack channel!

.github/actions/composite/getMergedPullRequest/action.yml

@@ -0,0 +1,66 @@
+name: Get merged pull request
+description: Given the current push event's commit SHA, finds the pull request that was merged to produce it.
+
+inputs:
+  github_token:
+    description: GitHub token used to call the API
+    required: true
+
+outputs:
+  number:
+    description: The PR number
+    value: ${{ steps.getMergedPR.outputs.number }}
+  title:
+    description: The PR title
+    value: ${{ steps.getMergedPR.outputs.title }}
+  body:
+    description: The PR body
+    value: ${{ steps.getMergedPR.outputs.body }}
+  labels:
+    description: Newline-separated label names
+    value: ${{ steps.getMergedPR.outputs.labels }}
+  assignees:
+    description: Newline-separated assignee logins
+    value: ${{ steps.getMergedPR.outputs.assignees }}
+
+runs:
+  using: composite
+  steps:
+    - name: Find merged pull request for this commit
+      id: getMergedPR
+      shell: bash
+      run: |
+        RESP=$(gh api -H "Accept: application/vnd.github+json" "/repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/pulls")
+
+        # Prefer the PR whose merge_commit_sha matches exactly (parity with the old action)
+        PR=$(echo "$RESP" | jq -c "first(.[] | select(.merge_commit_sha == \"${GITHUB_SHA}\"))" 2>/dev/null)
+
+        # Fall back to the first merged PR associated with this commit
+        if [[ -z "$PR" || "$PR" == "null" ]]; then
+          PR=$(echo "$RESP" | jq -c 'first(.[] | select(.merged_at != null))' 2>/dev/null)
+        fi
+
+        if [[ -z "$PR" || "$PR" == "null" ]]; then
+          echo "::warning::No merged pull request found for commit ${GITHUB_SHA}"
+          exit 0
+        fi
+
+        {
+          echo "number=$(echo "$PR" | jq -r '.number')"
+          echo "title=$(echo "$PR" | jq -r '.title')"
+
+          echo "body<<GETMPR_EOF"
+          echo "$PR" | jq -r '.body // ""'
+          echo "GETMPR_EOF"
+
+          echo "labels<<GETMPR_LABELS_EOF"
+          echo "$PR" | jq -r '[.labels[].name] | join("\n")'
+          echo "GETMPR_LABELS_EOF"
+
+          echo "assignees<<GETMPR_ASSIGNEES_EOF"
+          echo "$PR" | jq -r '[.assignees[].login] | join("\n")'
+          echo "GETMPR_ASSIGNEES_EOF"
+
+        } >> "$GITHUB_OUTPUT"
+      env:
+        GITHUB_TOKEN: ${{ inputs.github_token }}

.github/workflows/androidBump.yml

@@ -10,7 +10,7 @@ jobs:
   android_bump:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Node
         uses: ./.github/actions/composite/setupNode

.github/workflows/authorChecklist.yml

@@ -27,8 +27,8 @@ jobs:
       && github.actor != 'imgbot[bot]'
     steps:
       - name: Checkout
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: authorChecklist.ts
         uses: ./.github/actions/javascript/authorChecklist

.github/workflows/checkSVGCompression.yml

@@ -21,8 +21,8 @@ jobs:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Checkout
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Setup Node
         uses: ./.github/actions/composite/setupNode

.github/workflows/cherryPick.yml

@@ -74,7 +74,8 @@ jobs:
 
         # v4
       - name: Checkout target branch
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           ref: ${{ inputs.TARGET }}
           token: ${{ secrets.OS_BOTIFY_TOKEN }}

.github/workflows/claude-review.yml

@@ -31,7 +31,7 @@ jobs:
       PR_NUMBER: ${{ github.event.pull_request.number }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 1
 

.github/workflows/createDeployChecklist.yml

@@ -9,8 +9,8 @@ jobs:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Checkout
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Setup Node
         uses: ./.github/actions/composite/setupNode

.github/workflows/createNewVersion.yml

@@ -53,8 +53,8 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
 
       - name: Check out
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           ref: main
           submodules: true

.github/workflows/deploy.yml

@@ -25,8 +25,8 @@ jobs:
       IOS_VERSION: ${{ steps.getIOSVersion.outputs.IOS_VERSION }}
     steps:
       - name: Checkout
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           token: ${{ secrets.OS_BOTIFY_TOKEN }}
           submodules: true
@@ -641,8 +641,8 @@ jobs:
     needs: [androidBuild, androidUploadGooglePlay, androidUploadBrowserStack, androidUploadApplause, androidSubmit, iosBuild, iosUploadTestflight, iosUploadBrowserStack, iosUploadApplause, iosSubmit, webBuild, webDeploy]
     steps:
       - name: Checkout
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Post Slack message on failure
         uses: ./.github/actions/composite/announceFailedWorkflowInSlack

.github/workflows/deployBlocker.yml

@@ -16,8 +16,8 @@ jobs:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Checkout
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Give the issue/PR the Hourly, Engineering labels
         run: gh issue edit ${{ github.event.issue.number }} --add-label 'Engineering,Hourly' --remove-label 'Daily,Weekly,Monthly'

.github/workflows/deployBlockerInvestigation.yml

@@ -28,7 +28,7 @@ jobs:
       ISSUE_URL: ${{ github.event.issue.html_url || inputs.ISSUE_URL }}
     steps:
       - name: Checkout App repository
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 1
 

.github/workflows/deployExpensifyHelp.yml

@@ -32,8 +32,8 @@ jobs:
     continue-on-error: true
     steps:
       - name: Checkout
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           fetch-depth: 0
 

.github/workflows/deployNewHelp.yml

@@ -42,8 +42,8 @@ jobs:
       # We start by checking out the entire repo into a clean build environment within
       # the Github Action
       - name: Checkout code
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       # Set up Ruby and run bundle install inside the /help directory
       - name: Set up Ruby
@@ -97,7 +97,7 @@ jobs:
       - name: Get merged pull request
         if: ${{ github.event_name == 'push' }}
         id: getMergedPullRequest
-        uses: actions-ecosystem/action-get-merged-pull-request@59afe90821bb0b555082ce8ff1e36b03f91553d9
+        uses: ./.github/actions/composite/getMergedPullRequest
         with:
           github_token: ${{ github.token }}
 

.github/workflows/failureNotifier.yml

@@ -16,8 +16,8 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'failure' }}
     steps:
       - name: Checkout
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Process Failed Jobs
         uses: ./.github/actions/javascript/failureNotifier

.github/workflows/finishReleaseCycle.yml

@@ -13,8 +13,8 @@ jobs:
       isValid: ${{ fromJSON(steps.isDeployer.outputs.IS_DEPLOYER) && !fromJSON(steps.checkDeployBlockers.outputs.HAS_DEPLOY_BLOCKERS) }}
     steps:
       - name: Checkout
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           ref: main
           token: ${{ secrets.OS_BOTIFY_TOKEN }}

.github/workflows/formatCodeCovComment.yml

@@ -13,8 +13,8 @@ jobs:
     if: github.event.issue.pull_request && github.event.comment.user.login == 'codecov[bot]'
     steps:
       - name: Checkout
-      # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 
+      # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd 
       - name: Format CodeCov Comment
         uses: ./.github/actions/javascript/formatCodeCovComment
         with:

.github/workflows/generateTranslations.yml

@@ -41,9 +41,9 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ github.token }}
 
-      # v4
+      # v6
       - name: Checkout
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           ref: ${{ steps.pr-data.outputs.HEAD_SHA }}
 

.github/workflows/lint-changed.yml

@@ -47,8 +47,8 @@ jobs:
           REPO: ${{ github.repository }}
 
       - name: Checkout
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           fetch-depth: ${{ fromJSON(steps.count.outputs.count) }}
 

.github/workflows/lint.yml

@@ -18,8 +18,8 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Setup Node
         uses: ./.github/actions/composite/setupNode

.github/workflows/lockDeploys.yml

@@ -10,8 +10,8 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Wait for staging deploys to finish
         uses: ./.github/actions/javascript/awaitStagingDeploys

.github/workflows/postDeployComments.yml

@@ -89,8 +89,8 @@ jobs:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Checkout
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Setup Node
         uses: ./.github/actions/composite/setupNode

.github/workflows/preDeploy.yml

@@ -26,7 +26,7 @@ jobs:
     if: ${{ always() }}
 
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Exit failed workflow
         if: ${{ needs.typecheck.result == 'failure' || needs.lint.result == 'failure' || needs.test.result == 'failure' }}
@@ -42,11 +42,11 @@ jobs:
       SHOULD_DEPLOY: ${{ fromJSON(steps.shouldDeploy.outputs.SHOULD_DEPLOY) }}
 
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Get merged pull request
         id: getMergedPullRequest
-        uses: actions-ecosystem/action-get-merged-pull-request@59afe90821bb0b555082ce8ff1e36b03f91553d9
+        uses: ./.github/actions/composite/getMergedPullRequest
         with:
           github_token: ${{ github.token }}
 
@@ -73,12 +73,13 @@ jobs:
     if: ${{ !fromJSON(needs.chooseDeployActions.outputs.SHOULD_DEPLOY) && github.actor != 'OSBotify' }}
     steps:
       - name: Comment on deferred PR
-        uses: actions-ecosystem/action-create-comment@cd098164398331c50e7dfdd0dfa1b564a1873fac
-        with:
-          github_token: ${{ secrets.OS_BOTIFY_TOKEN }}
-          number: ${{ needs.chooseDeployActions.outputs.MERGED_PR }}
-          body: |
-            :hand: This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.
+        run: |
+          gh pr comment ${{ needs.chooseDeployActions.outputs.MERGED_PR }} --repo ${{ github.repository }} --body "$(cat <<'EOF'
+          :hand: This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.
+          EOF
+          )"
+        env:
+          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
 
   createNewVersion:
     needs: chooseDeployActions

.github/workflows/prettier.yml

@@ -18,8 +18,8 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout
-        # v4
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+        # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Setup Node
         uses: ./.github/actions/composite/setupNode

.github/workflows/proposalPolice.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     if: "!contains(fromJSON('[\"OSBotify\", \"imgbot[bot]\", \"melvin-bot[bot]\", \"codecov[bot]\"]'), github.actor)"
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       # Checks if the comment is created and follows the template OR
       # if the comment is edited and if proposal template is followed.