Summary:
Pull Request resolved: https://github.com/react/react-native/pull/57286
We currently have a mix of quote styles in `.yml` files (AI summary below). This applies prettier and reformats everything to single quotes to align with defaults.
Also fixes a couple of cases of over-indentation.
```
Single-quotes only (0 double-quoted scalars):
analyze-pr.yml
— 12 single, 0 double
api-changes.yml
— 3 single, 0 double
check-for-reproducer.yml
— 4 single, 0 double
retry-workflow.yml
— 1 single, 0 double
Single-quote predominant > double:
autorebase.yml 2 vs 1
create-draft-release.yml 8 vs 2
generate-changelog.yml 3 vs 2
on-issue-labeled.yml 7 vs 2
prebuild-ios-core.yml 59 vs 17
prebuild-ios-dependencies.yml 39 vs 1
stale-bot.yml 18 vs 15
test-all.yml 70 vs 27
Double-quote predominant > single:
bump-podfile-lock.yml 1 vs 10
create-release.yml 3 vs 12
e2e-android-rntester.yml 2 vs 6
e2e-android-templateapp.yml 6 vs 13
e2e-ios-rntester.yml 2 vs 7
e2e-ios-templateapp.yml 2 vs 18
fantom-tests.yml 2 vs 7
monitor-new-issues.yml 3 vs 12
publish-npm.yml 42 vs 50
validate-cxx-api-snapshots.yml 2 vs 23
validate-dotslash-artifacts.yml 2 vs 5
Tie / 1-1:
cache-reaper.yml 1 vs 1
close-pr.yml 1 vs 1
needs-attention.yml 2 vs 2
All files contain single quotes somewhere, but only those 4 are single-quote-exclusive. Most CI-heavy workflows — bump, create-release, e2e-, fantom, monitor, publish-npm, validate- — lean double-quoted, while the pr/issue automation, prebuild ios, test-all, and stale-bot lean single-quoted.
```
Changelog: [Internal]
___
Differential Revision: D109151683
fbshipit-source-id: 24391e906c0dd92fe402224089dce8bb2068b4d9
Summary:
Pull Request resolved: https://github.com/facebook/react-native/pull/57099
Replaces the long-lived `GHA_NPM_TOKEN` automation token with npm
Trusted Publishing (OIDC) for every `npm publish` invoked from this
repo's GitHub Actions.
Why a reusable workflow:
npmjs.com Trusted Publishing accepts only ONE (org, repo,
workflow_filename, environment) tuple per package. Today, packages
are published from multiple workflow files:
- `react-native` from publish-release.yml + nightly.yml
- every `react-native/*` from nightly.yml + publish-bumped-packages.yml
A naive per-workflow OIDC migration would require two Trusted
Publisher entries per package, which npm doesn't support. Instead,
this diff funnels every `npm publish` through one new file —
`.github/workflows/publish-npm.yml` — invoked via `workflow_call`
from the existing top-level workflows. The OIDC `job_workflow_ref`
claim therefore always resolves to `publish-npm.yml`, so each
package needs exactly one Trusted Publisher entry pointing here.
What changes:
* New `.github/workflows/publish-npm.yml`: reusable workflow with a
`mode` input. `mode: react-native` runs the full Android + iOS
prebuilt + JS build path (used by release & nightly, publishes
`react-native` and — in nightly mode — every `react-native/*`
package via `scripts/releases-ci/publish-npm.js`). `mode:
monorepo-packages` runs only the JS build and publishes the
delta-bumped packages via
`scripts/releases-ci/publish-updated-packages.js` (used by
publish-bumped-packages.yml). Both jobs grant `id-token: write` so
the npm CLI can mint the OIDC token for Trusted Publishing.
* `.github/workflows/publish-release.yml`: replace the
`build_npm_package` job's inline build/publish steps with a
`uses: ./.github/workflows/publish-npm.yml` call. The
template-publish, rn-diff-purge, npm-verify, and Maven-verify
steps move into a new `post_publish` follow-up job that
`needs: [build_npm_package]`. Drops `GHA_NPM_TOKEN` from the env.
* `.github/workflows/nightly.yml`: same — `build_npm_package` now
delegates to the reusable workflow. Drops `GHA_NPM_TOKEN` and the
obsolete `Verify NPM token` precheck (Trusted Publishing has no
pre-mintable token to validate; failures surface at `npm publish`
time).
* `.github/workflows/publish-bumped-packages.yml`: shrinks to a thin
trigger wrapper that calls the reusable workflow with
`mode: monorepo-packages`.
* `.github/workflows/create-release.yml`: drop the obsolete `Verify
NPM token` step.
* `.github/actions/build-npm-package`: drop the `gha-npm-token`
input and the `Set npm credentials` step that wrote `_authToken`.
Pass `registry-url: https://registry.npmjs.org` to setup-node so
`actions/setup-node@v6` writes a `.npmrc` configured to consume
the OIDC token at publish time.
* `.github/actions/setup-node`: thread a new `registry-url` input
through to `actions/setup-node@v6`.
The publish scripts themselves (`scripts/releases-ci/publish-npm.js`,
`scripts/releases-ci/publish-updated-packages.js`,
`scripts/releases/utils/npm-utils.js`) are unchanged: they shell out
to plain `npm publish`, which performs the OIDC exchange transparently
when it sees a GitHub Actions OIDC environment and a Trusted Publisher
configured for the package on npmjs.com.
Note: this diff only changes the workflow definitions. Each package
on npmjs.com must additionally be configured with a Trusted Publisher
pointing at:
- org: facebook
- repo: react-native
- workflow filename: publish-npm.yml
- environment: npm-publish
The npm CLI's OIDC exchange returns 404 until that registry-side
config is in place. Trusted Publisher entries are additive on
npmjs.com (don't enable "Require Trusted Publishing" yet) so the
existing token-based flow keeps working through the cutover. See the
stack landing notes for the full package list and UI steps.
Backport: this also needs picking back to `*-stable` branches before
"Require Trusted Publishing" is enabled on any package, since
GitHub Actions runs the workflow file from the ref that triggers it.
Changelog:
[Internal]
Reviewed By: cortinico, cipolleschi
Differential Revision: D107805971
fbshipit-source-id: 7a360dff9666c4b0952504331d26c0af74148789
Summary:
Pull Request resolved: https://github.com/facebook/react-native/pull/51840
Bumps the minimum version of Node.js in React Native to the current active LTS release (22.x, upgraded from 18.x which is now out of support).
- CI configurations are reduced from `[22, 20, 18]` to `[24, 22]`.
{F1978909878}
See https://nodejs.org/en/about/previous-releases.
Changelog:
[General][Breaking] - Our new minimum Node version is Node.js 22
Reviewed By: yungsters, cortinico
Differential Revision: D76037015
fbshipit-source-id: b6e4b3ee279a9a93d716a13297420bba73f45250
Summary:
Pull Request resolved: https://github.com/facebook/react-native/pull/49658
This bumps the version of Node that we use to build React Native from 18 to 20.
We'll still be supporting building with 20, but we'll moving our toolchain to Node 20 becuase 18 is at EOL soon.
Changelog:
[General] [Changed] - Bump Node 18 -> 20 to build React Native in OSS
Reviewed By: javache, cipolleschi
Differential Revision: D70168003
fbshipit-source-id: b64ee583b2d2e72d25393119ae9e9029a74d5b13
Summary:
Pull Request resolved: https://github.com/facebook/react-native/pull/48237
Noticed this when trying to diagnose what seemed like a stale caching issue. It effectively reverts D59917944.
D59917944 added logic to only do yarn caching on main, but it has some correctness issues:
1. We cache `node_modules` instead of the yarn cache, which may contain e.g. build artifacts, or other scratch/cache files written (such as anything that writes to `node_modules/.cache`). We really want to be caching the yarn cache, which has pristine packages before install, which I think it will also need to perform the real install anyways.
2. We key the cache on root `package.json`, which is missing a lot of information (both provided by the other `package.json` in the repo, but mostly, the lockfile resolution).
We only save cache when we're on `refs/heads/main` (so continuous builds against main), and supposedly, builds against base branch should be able to restore against those, but recent PR jobs I have seen, where `package.json` has not changed, all have `Cache not found for input keys: node-modules-068350889e87919c1c6c2c220c8d2d92db13f38820bf2efb315d1274b97bc367`
Because of the potential correctness issues, and that the strategy for limiting to main seemingly is not allowing cache to be used in PR, this diff goes back to previous solution, which may store more artifacts (but working cache should also reduce cost by making jobs run faster).
Changelog: [Internal]
Reviewed By: cipolleschi
Differential Revision: D67140004
fbshipit-source-id: f74074a498af56b1837fa23cf80795f76935b762
Summary:
Pull Request resolved: https://github.com/facebook/react-native/pull/45544
## This diff now does 5 things:
1. removes the old way we used `actions/setup-node` to manage the cache itself.
2. it creates a new `update-node-modules-cache` workflow, which is the only job that will update the node modules cache
3. it create a `yarn-install-with-cache` action that should be used install of directly calling `yarn install --non-interactive`. This will load a cache against a hash of `package.json`.
4. updated the cache reaper to aggressively remove everything but the latest `npm-{{ hash('package.json') }}`.
5. removed a `cache-setup`, which couldn't be used (we're using artefacts now).
## Why are we doing this:
The various `node-cache-` keys for platforms and on various branches accounts for a very large proportion of the cache (10-20%).
We don't frequently change these dependencies, and even when we do running `yarn install` after loading the cache will resolve any issues.
Limiting the cache to `main` and aggressively pruning older cache entries will clean up a lot of "small win" caching.
Changelog: [Internal]
Reviewed By: cortinico
Differential Revision: D59917944
fbshipit-source-id: 4be6f1959e8fde642a4f208f7d19aceba2c3262f
Summary:
Pull Request resolved: https://github.com/facebook/react-native/pull/45542
As we do have several version numbers for external actions all across the codebase,
here I'm aligning all of them to just use the majors.
I'm doing it only for GitHub first party actions as we trust them,
so minor/patch changes can safely be pulled in without code changes.
Changelog:
[Internal] [Changed] - Align github/* action versions on major
Reviewed By: cipolleschi, blakef
Differential Revision: D59959978
fbshipit-source-id: bb07ce0dfd74d9502a2ac0ea90a2b32f55d6d655
Rob Hogan