declapract-typescript-ehmpathy 0.49.8 → 0.49.10

package/dist/practices/cicd-app-react-native-expo/best-practice/.declapract.readme.md

@@ -0,0 +1,27 @@
+the cicd workflows and gitignore for an expo app
+
+this practice declares `android/` and `ios/` — the build output `expo prebuild` emits, which is
+scratch in a managed-workflow repo.
+
+📖 several practices declare this same `.gitignore`. the contract they share — one shared
+algorithm, the ordered tail, what a new declarer owes — is stated once at
+`.agent/repo=.this/role=any/briefs/howto.declare-the-repo-gitignore.md`. read that before you add
+a line here.
+
+## this declaration once went stale, and that is why it imports
+
+it was authored 2024-09-11, cloned from the `git` practice's shape at the time. `git` gained its
+ordered tail in #404 on 2026-01-31, and this copy never caught up — so it sorted every line,
+which hoisted the `!` negations above their target and turned them inert.
+
+fixed 2026-07-30 (#537) by an import of the shared algorithm rather than a re-derivation.
+consumers saw no content change: an expo repo already received the ordered tail from `git`; what
+changed is that this practice no longer hoists it.
+
+the clamp is `.gitignore.declapract.test.ts` → `convergence with the git practice`, which asserts
+both checks pass once both have run, that the settled file is a fixed point under either, and
+that the negations stay below `node_modules`.
+
+⚠️ its declared set is **disjoint** from git's, so neither practice's output alone satisfies the
+other's check — both must run. this differs from `rhachet`, whose one line is a subset of git's.
+do not copy an assertion between those two suites without that check.

package/dist/practices/cicd-app-react-native-expo/best-practice/.github/workflows/.deploy-expo.yml

@@ -49,21 +49,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: set node-version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: ".nvmrc"
 
       - name: configure aws credentials (oidc)
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ inputs.creds-aws-role-arn }}
           aws-region: ${{ inputs.creds-aws-region }}
 
       - name: node-modules cache get
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         id: cache
         with:
           path: ./node_modules
@@ -74,7 +74,7 @@ jobs:
         run: npm ci --ignore-scripts --prefer-offline --no-audit
 
       - name: setup expo
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@c7b66a9c327a43a8fa7c0158e7f30d6040d2481e # v8
         with:
           eas-version: latest
           token: ${{ secrets.expo-token }}
@@ -91,21 +91,21 @@ jobs:
     if: ${{ inputs.stage == 'prod' && inputs.app-web-deployment-s3-bucket }}
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: set node-version
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: ".nvmrc"
 
       - name: configure aws credentials (oidc)
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ inputs.creds-aws-role-arn }}
           aws-region: ${{ inputs.creds-aws-region }}
 
       - name: node-modules cache get
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         id: cache
         with:
           path: ./node_modules
@@ -116,7 +116,7 @@ jobs:
         run: npm ci --ignore-scripts --prefer-offline --no-audit
 
       - name: setup expo
-        uses: expo/expo-github-action@v8
+        uses: expo/expo-github-action@c7b66a9c327a43a8fa7c0158e7f30d6040d2481e # v8
         with:
           eas-version: latest
           token: ${{ secrets.expo-token }}

package/dist/practices/cicd-app-react-native-expo/best-practice/.github/workflows/deploy.yml

@@ -30,6 +30,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }} # per [workflow] x [branch, tag] x [event]
   cancel-in-progress: true # only cancel work flows on non-latest commits
 
+permissions:
+  id-token: write # required for oidc; a called workflow cannot exceed its caller's grant
+  contents: read
+
 jobs:
   test:
     uses: ./.github/workflows/.test.yml

package/dist/practices/cicd-app-react-native-expo/best-practice/.github/workflows/test.yml

@@ -12,6 +12,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }} # per [workflow] x [branch, tag]
   cancel-in-progress: true #  cancel workflows for non-latest commits
 
+permissions:
+  id-token: write # required for oidc; a called workflow cannot exceed its caller's grant
+  contents: read
+
 jobs:
   suite:
     uses: ./.github/workflows/.test.yml

package/dist/practices/cicd-app-react-native-expo/best-practice/.gitignore.declapract.ts

@@ -1,21 +1,28 @@
 import type { FileCheckFunction, FileFixFunction } from 'declapract';
-import { dedupe } from 'domain-objects';
 import expect from 'expect';
 
-const expectedIgnores = ['android/', 'ios/'].sort();
+import { defineExpectedGitignoreContents } from '../../../utils/defineExpectedGitignoreContents';
 
-const defineExpectedContents = (contents: string | null): string => {
-  const ignoresAlreadyDefined = contents ? contents.split('\n') : [];
-  const finalLines = dedupe([...ignoresAlreadyDefined, ...expectedIgnores])
-    .sort() // sorted
-    .filter((line) => !!line); // without empty lines
-  return [...finalLines.sort(), ''].join('\n');
-};
+/**
+ * .what = the ignores this practice declares — the build output an expo app emits
+ * .why  = `android/` and `ios/` are generated by `expo prebuild`, so they are scratch
+ *         in a managed-workflow repo.
+ * .note = this list is NOT sorted here, and that is deliberate.
+ *         `defineExpectedGitignoreContents` sorts the union of these lines with the
+ *         repo's own, so a `.sort()` at this site would be a second sort that changes
+ *         no output -- while it mutates a module-cached array in place. `readonly`
+ *         forbids that mutation outright.
+ */
+const ignoresSortable: readonly string[] = ['android/', 'ios/'];
 
 export const check: FileCheckFunction = (contents) => {
-  expect(contents).toEqual(defineExpectedContents(contents));
+  expect(contents).toEqual(
+    defineExpectedGitignoreContents({ contents, ignoresSortable }),
+  );
 };
 
 export const fix: FileFixFunction = (contents) => {
-  return { contents: defineExpectedContents(contents) };
+  return {
+    contents: defineExpectedGitignoreContents({ contents, ignoresSortable }),
+  };
 };