Update TanStack starter for React on Rails 17.0.0

[justin808]

Why

Keep the public TanStack Pro + RSC starter on the final React on Rails 17.0.0 and RSC 19.2.1 artifacts, with an auditable fleet-smoke path.

Changes

• promote the Ruby/npm product dependencies and locks to their final releases
• add an exact-pinned, fail-closed reusable fleet-smoke caller
• make Dependabot weekly with explicit React on Rails grouping and preserve the Babel-major guard
• update current-stack documentation; historical references remain unchanged

Verification

• frozen Bundler and pnpm installs
• RuboCop, TypeScript, router shim, RSpec (119 examples), and isolated Playwright (18 tests)
• RSC manifest repro, production assets precompile, dev/static/HMR/prod smoke
• actionlint, YAML parsing, bundler-audit, Brakeman, pnpm audit, peer check, docs link scan, diff check
• final uncommitted independent review: clean

Summary by CodeRabbit

• Updates

  • Upgraded React on Rails Pro and RSC integrations from release candidates to stable versions.
  • Improved automated dependency checks with weekly updates and grouped package updates.

• Testing

  • Added automated smoke testing for pull requests, main-branch changes, scheduled runs, and manual execution.

• Documentation

  • Updated project documentation and version references to reflect the stable release stack.

[github-actions]

🚀 Quick Review App Commands

Welcome! Here are the commands you can use in this PR:
They require the repository to have cpflow review apps configured, including the CPLN_TOKEN_STAGING secret.

+review-app-deploy

Deploy your PR branch for testing.

+review-app-delete

Remove the review app when done.

+review-app-help

Show detailed instructions, environment setup, and configuration options.

Comment +review-app-help for full setup details.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f4ade85b-4fdb-4abb-a113-175aa9e703ab

📥 Commits

Reviewing files that changed from the base of the PR and between 97733de and 0a00955.

⛔ Files ignored due to path filters (2)

• Gemfile.lock is excluded by !**/*.lock
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (12)

• .github/dependabot.yml
• .github/workflows/demo-fleet-smoke.yml
• Gemfile
• README.md
• SPIKE.md
• docs/01-architecture.md
• docs/02-vs-inertia.md
• docs/06-tested-modes.md
• docs/08-why-rsc-on-rails.md
• docs/09-rsc-webpack-bundler-spike.md
• docs/10-rsc-tanstack-loader-spike.md
• package.json

---

Walkthrough

The PR promotes React on Rails Pro and RSC dependencies from release candidates to stable versions, updates related documentation, configures weekly grouped Dependabot updates, and adds a reusable GitHub Actions smoke workflow.

Changes

Stable React on Rails stack

Layer / File(s)	Summary
Stable dependency pins Gemfile, package.json	Ruby and npm dependencies now use React on Rails Pro 17.0.0 and RSC 19.2.1.
Version documentation alignment README.md, SPIKE.md, docs/*.md	Documentation and tested-mode references now describe the stable releases instead of RC versions.
Dependency and smoke automation .github/dependabot.yml, .github/workflows/demo-fleet-smoke.yml	Dependabot runs weekly with grouped updates and major-version ignores; a new workflow runs reusable smoke checks for pull requests, main pushes, schedules, and manual dispatches.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• Follow-up: Exercise GitHub Actions changes from PR #4751 react_on_rails#4752 — Both changes involve the demo fleet smoke workflow and its reusable smoke execution.

Possibly related PRs

• shakacode/react-on-rails-starter-tanstack#192 — Both update the React on Rails dependency pins in Gemfile and package.json.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description has useful content, but it does not follow the required template sections for Summary, Validation Tier, Test Plan, or Starter Checklist.	Rewrite it using the repository template and add the missing Summary, Validation Tier, Test Plan, and Starter Checklist entries.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly reflects the main change: promoting the TanStack starter to React on Rails 17.0.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/final-17-0-0

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/dependabot.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/demo-fleet-smoke.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

Gemfile

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

• 1 others

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0a00955d98

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

✅ Review App Deleted

Review app for PR #201 is deleted

🎮 Control Plane Console
📋 View Workflow Logs