ci: maintain native lockfiles for both apps - #1631
Draft
mrousavy wants to merge 1 commit into
Draft
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
mrousavy
force-pushed
the
ci/group-app-dependency-updates
branch
from
September 7, 2026 19:01
54e9e47 to
a638ad2
Compare
mrousavy
force-pushed
the
ci/maintain-benchmark-lockfiles
branch
from
September 7, 2026 19:02
37fd977 to
f168ef8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #1626.
Dependency lock maintenance currently refreshes only the example app, and Gemfile-only updates do not trigger it. Refresh and stage both apps' Gemfile.lock and Podfile.lock files, and include Gemfile/Gemfile.lock changes in the pull-request paths.
Apply the same two-app loop to the release lockfile hook, with explicit lockfile staging and its existing best-effort behavior.
Validation: actionlint, ShellCheck, Bash syntax, and diff checks pass. Disposable fixtures exercised the actual workflow shell commands before publishing and the release hook: both apps' commands and all five staged lockfiles are correct; CI stops on an install failure while the release hook continues. App script paths and Gemfile triggers were also checked.
The live maintenance job runs only for
dependabot[bot], so it will skip this human-authored PR. Native dependency installation and bot publishing still need validation on a Dependabot PR.