ci(release): adopt automated SDK governance

[tolgahan-arikan]

Summary

Migrates the transferred React Native SDK to the same Changesets-based governance and npm trusted-publishing model used by oms-wallet-typescript-sdk, adapted for this repository's single root package, Yarn 4, Builder Bob, TurboModule/codegen, native Android/iOS builds, and standalone Expo example.

This PR includes a patch Changeset. Its release PR will propose 0.2.1 and publish the validated package metadata (type, engines, and sideEffects) together with the release machinery.

TypeScript SDK alignment

• Changesets release intent, changelog generation, and release PRs
• CI-only releases with npm OIDC trusted publishing and no NPM_TOKEN
• GitHub App-authored, GitHub-verified release commits and tags through commitMode: github-api
• GitHub Releases generated from CHANGELOG.md
• Runner-only snapshot releases under non-SemVer npm dist-tags
• Husky commit-message, pre-commit, and pre-push policy
• CODEOWNERS ownership by @0xPolygon/product-applications
• Dependency review plus package/export/API/generated-artifact drift gates
• A 24-hour dependency release-age gate with matching first-party scope exemptions

React Native-specific adaptations

• Keeps @polygonlabs/oms-wallet-react-native publishable at the repository root
• Includes . in the Yarn workspace list so Changesets versions the root package while leaving private examples unversioned
• Keeps Yarn with the node-modules linker; it does not copy pnpm or @polygonlabs/source patterns
• Uses the shared Polygon Claude workflows, which are package-manager-independent
• Implements Changesets, release, and verification workflows locally because the shared package workflows are pnpm-specific
• Preserves Builder Bob, source/react-native entrypoints, TurboModule codegen, root android/ and ios/, bare React Native examples, and Expo autolinking
• Enforces Swift/Kotlin native dependency parity while keeping npm versioning independent
• Runs package dry-run validation and full Expo, Android, and iOS verification before release
• Opens a post-publication PR that moves the standalone Expo example to the registry-published version
• Pins third-party GitHub Actions to full commit SHAs; organization-maintained shared workflows use @main

Changes after requested review

• Replaced the obsolete repository-local Claude action with the shared 0xPolygon/pipelines review and interactive-trigger workflows using CLAUDE_API_KEY
• Restored pull-request concurrency cancellation so superseded macOS and Android builds do not continue consuming runner time
• Removed the advanced Kotlin/Swift CodeQL workflow that duplicated native compilation; GitHub CodeQL default setup continues to scan Actions, JavaScript/TypeScript, and Ruby, while required Android and iOS CI builds remain on every pull request
• Split the post-publish Expo update into a separate job so a follow-up failure cannot make a successful npm publication appear to have failed
• Made the Expo update derive its base branch from Changesets configuration and retry until the exact published npm version is visible
• Upgraded Yarn from 4.11.0 to 4.18.0 and added supported supply-chain controls: a 24-hour release-age gate, first-party exemptions matching the TypeScript SDK, disabled third-party lifecycle scripts by default, and an explicit block on unapproved Git-hosted dependencies
• Kept pnpm migration outside this PR. Yarn does not currently provide direct equivalents for pnpm's trustPolicy or blockExoticSubdeps, so unsupported configuration was not added
• Updated vulnerable fast-uri and js-yaml resolutions and incorporated the safe dependency updates merged into master

Release flow

1. Contributor pull requests include a user-facing or empty Changeset.
2. Merging to master runs full verification and opens or updates chore(release): publish package.
3. The release pull request versions the root package and updates CHANGELOG.md.
4. Merging the release pull request reruns verification, publishes through npm OIDC, creates signed v<version>, and creates the GitHub Release.
5. Successful publication completes independently, then a separate job verifies the registry package in the Expo example and opens its follow-up update pull request.

Manual snapshots verify the same surface, version only runner state, publish under the selected non-SemVer dist-tag, and skip git tags, GitHub Releases, and Expo follow-up pull requests.

Verification

• yarn install --immutable
• Forced Yarn hardened-mode immutable install
• yarn verify
• 23 unit tests
• API documentation current: 109 public API IDs
• Publint: All good!
• yarn check:package: 107-file npm dry run
• Native SDK dependency parity: Swift/Kotlin 0.2.0
• Expo locally packed-package install, typecheck, clean prebuild, and Android/iOS autolinking
• Candidate CommonJS consumption and strict supported-Node engine installation
• Changesets calculates only the root package from 0.2.0 to 0.2.1; private examples remain unchanged
• Disposable changeset version run updates the root package and changelog successfully
• Husky/lint-staged/commitlint hooks
• Actionlint and YAML parsing for all workflows
• npm trusted-publishing boundary: Node 24.13.0/npm 11.6.2, with a guard requiring npm 11.5.1+
• GitHub-hosted Android bare React Native build
• GitHub-hosted iOS bare React Native build
• GitHub dependency review
• GitHub CodeQL default setup
• Shared Claude review runs when this draft is marked ready for review

External configuration

Completed

• npm trusted publishing is configured for @polygonlabs/oms-wallet-react-native with organization 0xPolygon, repository oms-wallet-react-native-sdk, and workflow release.yml
• GitHub CodeQL default setup is active and passing

Required before merge

• Install or authorize the Changesets release GitHub App for this repository with Contents read/write and Pull requests read/write
• Expose CHANGESET_RELEASE_BOT_APP_ID and CHANGESET_RELEASE_BOT_APP_PRIVATE_KEY to this repository
• Ensure the shared Claude workflows can access CLAUDE_API_KEY
• Ensure visible team @0xPolygon/product-applications has explicit Write access
• Require the final CI, package, Expo, Android, iOS, Changeset, dependency-review, and CodeQL check names in the master ruleset

Recommended hardening: change the default GITHUB_TOKEN permission from Write to Read and disable its ability to create or approve pull requests. Release pull requests use the GitHub App token instead.

Findings intentionally kept separate

Peer dependency warnings

• ESLint 9 versus dependency ranges including @eslint/js 10
• Missing hermes-eslint peer requested by eslint-plugin-ft-flow
• Trails example missing @tanstack/react-query and react-dom peers requested by 0xtrails

Packaging and dependency audit

• Publint reports All good!; no package export changes were made for unsupported Node ESM or React Native Web behavior
• GitHub dependency review passes and no new high-severity vulnerability is introduced by this PR
• The full dependency graph still contains pre-existing audit findings that remain separate from the governance migration
• The standalone Expo example's npm install separately reports the existing uuid@7.0.3 deprecation and 22 audit findings (11 moderate and 11 high)

Checklist

• yarn lint passes
• yarn typecheck passes
• yarn prepare succeeds
• Patch Changeset included (0.2.1 release plan)
• Public API documentation unchanged and current
• npm trusted publisher configured
• GitHub-hosted native checks pass
• GitHub administrator prerequisites complete

[MaximusHaximus]

Cool! This looks great.

1. Trusted publishing has been configured for @polygonlabs/oms-wallet-react-native so that your release.yml will successfully publish the package from now on 🙂

2. Missing supply chain protection configuration (this one will be flagged by the security team's repo scans too)

Strongly recommend just migrating to PNPM so you get the benefit of consistency by adopting the shared workflows we maintain across the org -- right now we've got hand-rolled ci.yml, verification.yml, changeset-check.yml and release.yml locally in this repo; it's around 400 lines of bespoke workflow that now has to be maintained in parallel with the existing ecosystem, and will drift.

• Metro symlink support has been stable since RN 0.73 (the 0.72 release notes call it out explicitly as "monorepo/pnpm support"). This repo is on 0.85.
• You're already on nodeLinker: node-modules, with nmHoistingLimits: workspaces -- i.e. not using Yarn PnP at all. That's a near-identical shape to pnpm with a hoisted linker, so the migration is much less of a leap than it would be from a PnP repo. The main risk would be concentrated in the native layer — CocoaPods use_native_modules! and Gradle autolinking resolving through symlinks, plus the standalone Expo example's prebuild path.

Being pragmatic about symlinks and the native code side of things, this might take some effort so shouldn't block releasing something -- but at the very least if you're going to stick with Yarn, update to a more recent version of yarn that supports most of the equivalent supply chain hardening, and configure appropriately in yarnrc -- right now, Yarn is totally unconfigured on this axis

e.g.

• minimumReleaseAge isn't supported until >= 4.12

• = 4.14 would default trustPolicy appropriately also

• There isn't really a blockExoticSubdeps equivalent for Yarn at all.

Added a few other things that I noticed would be problems as a code review w/ changes requested

[MaximusHaximus]

🪨 on