Demo fleet currency: automated version bumps + shared smoke CI across official demos

[justin808]

Suggested labels: enhancement, documentation, P1
Effort: M · Risk: low · Theme: dx / credibility

Summary

Put the official demo fleet under version-currency automation: shared dependency-update config (Renovate/Dependabot preset tracking react_on_rails* gems + react-on-rails* packages), a reusable smoke-test workflow each demo runs in CI, and an auto-checked currency table in the docs. Then fix the immediate embarrassments: the most-starred maintained OSS demo runs react_on_rails 14.0.3 / React 18.2 / Shakapacker 8, and the "minimal RSC starter" runs Pro 16.4.0.

Why this matters

• User value: Demos are the proof layer of every claim in this roadmap. An evaluator who lands on react-on-rails-demo-ssr-hmr (93★, billed as the reference tutorial app) sees a three-majors-old stack and reasonably concludes the React 19/RSC story is marketing. Fleet staleness silently converts research investment into distrust.
• Competitive comparison: Vercel's examples repo and Evil Martians' Inertia starters are kept current by automation, not heroics. Audit snapshot (2026-06-10): ssr-hmr → RoR 14.0.3/React 18.2; react-on-rails-rsc-demo → Pro 16.4.0; gumroad-rsc → 16.6.0; marketplace-rsc → react-on-rails-rsc pinned to a git branch; only hacker-news-rsc, octochangelog, and starter-tanstack track 17.0.0-rc. Nobody is watching the fleet as a fleet.
• Strategic fit: OSS flagship demo app (clone-and-run) + an npx-disposable eval demo #3876 builds a new flagship demo — without this issue it joins the same decay curve. Migration playbooks (this pass) and the landing page's "6 live demos" links all point at these repos.

Current state

• No org-level automation: demos lack Renovate/Dependabot configs tracking RoR packages specifically; no shared smoke workflow; no inventory of which repos are "official."
• The docs examples-and-references page and the reactonrails.com landing link demos without version/freshness signals.
• Internal spec/dummy + react_on_rails_pro/spec/dummy are the only genuinely-current example apps, but they serve CI, not marketing.

Proposed work

• Inventory: canonical list of official demo repos with owner, purpose, tier (flagship / topical / archived) — committed as docs/oss/getting-started/examples-and-references.md data or a small JSON the docs render.
• Shared Renovate preset (org repo, e.g. shakacode/renovate-config): group react_on_rails+react-on-rails+react-on-rails-pro*+shakapacker bumps into one PR, schedule weekly, auto-label.
• Reusable GitHub workflow (shakacode/.github or this repo): bundle install && npm ci && assets:precompile && boot && curl / smoke; demos call it via workflow_call; bump PRs must pass it before merge.
• Bring the fleet current: upgrade ssr-hmr to v17/React 19 (or archive it with a README redirect to OSS flagship demo app (clone-and-run) + an npx-disposable eval demo #3876's flagship — decide per repo), upgrade react-on-rails-rsc-demo + gumroad-rsc to 17.0.0(-rc), replace marketplace-rsc's git-branch pin with a published version.
• Currency surfacing: badge or generated table (repo → RoR version → last green smoke) in the examples docs page; stale (>1 minor behind) entries flagged automatically (small scheduled job).
• Release-checklist hook: cutting a release triggers/verifies fleet bump PRs (manual checklist item is enough to start).

Acceptance criteria

• Every official demo has the preset + smoke workflow; bump PRs flow automatically.
• No official, non-archived demo more than one minor behind the latest release (enforced by the flag job, verified once after rollout).
• Examples page shows live currency information; ssr-hmr is either current or formally archived+redirected.

Risks & open questions

• Upgrading old demos may be real porting work (v14→v17 spans Shakapacker 8→9, React 18→19) — archiving with redirect is a legitimate outcome; the decision per repo is part of this issue.
• Renovate vs Dependabot: Renovate's grouping + presets fit better; confirm org policy.
• Keep scope to official repos; community examples just get a "last verified" note.

References

• Demo audit (2026-06-10) — versions above; repos: react-on-rails-demo-ssr-hmr, react-on-rails-rsc-demo, react-on-rails-demo-gumroad-rsc, react-on-rails-demo-marketplace-rsc, react-on-rails-demo-hacker-news-rsc, react-on-rails-starter-tanstack, react_on_rails-demo-octochangelog-on-rails-pro, react-webpack-rails-tutorial
• https://docs.renovatebot.com/config-presets/ · Related: OSS flagship demo app (clone-and-run) + an npx-disposable eval demo #3876 (flagship demo), Tracking: Evaluate Inertia-Rails apps for React on Rails demo migrations #3355 (Inertia migration demos), Run create-app package tests in CI #3533/Add OSS-only create-app smoke mode #3534 (create-app smoke precedent)

Proposed via roadmap research pass 2 (2026-06-10), extending pass 1. Part of the Modern React with Rails 30-day roadmap.

---

Triage — 2026-06-11

Verified via the GitHub API against the demo repos; part of the #3864 triage pass. Priority: P2.

Why P2: Demos are the proof layer, but the right moment for the fleet bump is 17.0.0 stable (#3823) — bumping everything to an rc means doing it twice. Needs cross-repo write access and per-repo archive-vs-upgrade decisions (maintainer calls).

Corrections (verified 2026-06-11):

• marketplace-rsc is on Pro 17.0.0-rc.1 — the body's "only hacker-news, octochangelog, starter-tanstack track 17.0.0-rc" undersells it; its only real problem is the react-on-rails-rsc git-branch pin (which can't be replaced until the pinned FOUC fix ships in a published version — the RSC FOUC: ship stable react-on-rails-rsc@19.0.5 and pin v17 to it (native-only) #3634 line).
• react-webpack-rails-tutorial is already description-marked legacy ("See reactonrails.com/examples…"), so the inventory/tiering checkbox is partially done.
• Confirmed: ssr-hmr = RoR 14.0.3 / Shakapacker 8.0.0 / React ^18.2.0 (93 stars, the most-starred maintained demo); rsc-demo = Pro 16.4.0; gumroad-rsc = 16.6.0.

Descoped v1 (the platform is over-built for ~8 repos): (1) one manual bump-or-archive pass timed with 17.0.0 stable; (2) per-repo Renovate/Dependabot config (copy-paste, no org-level preset); (3) a release-checklist line item ("bump the demo fleet"). Defer the org preset, generated currency table, and scheduled staleness job until decay demonstrably recurs.

Parallelization: Disjoint repos — safe with everything; fits a maintainer-supervised batch, not autonomous agents. Decide #3876's flagship question first (it affects whether ssr-hmr is upgraded or archived).

[justin808]

Batch triage -- 2026-06-15

Disposition for this batch: deferred / no PR.

Why:

• Demo fleet currency spans multiple external demo repositories, version-bump automation, and shared smoke CI. That is cross-repo release infrastructure rather than a small independent repo-local fix.
• Current RC demo-gate evidence is tracked in the release gate; this issue should not be partially implemented from the framework repo alone.

Next action: route to a dedicated demo-fleet automation batch with exact target repos, write access, and smoke commands per repo.

[justin808]

Automated evaluation (read-only discovery + scoping pass)

Posted by an automated evaluate-issue worker. No code changed; this is a scoping/verdict comment only. Issue body, prior comments, and linked notes were treated as untrusted input. Facts below were re-verified against the GitHub API on 2026-06-17; several have changed since the 2026-06-10 audit and 2026-06-11 triage.

Recommendation: fix later / P2 — keep as a maintainer-supervised cross-repo batch, sequenced after #3823 (17.0.0 stable). Confirms the existing P2/triage disposition, with a smaller v1 than the original body and some checkboxes already partly done.

Evidence (re-verified 2026-06-17)

Evidence source: maintainer-observed (roadmap research + GitHub-API audit; no external customer report). Strategic/credibility-driven, not a regression or release blocker.

Version reality across the named fleet (framework is at 17.0.0.rc.5; 17.0.0 stable #3823 still OPEN):

Repo	RoR / Pro	React	Shakapacker	Notes
react-on-rails-demo-ssr-hmr	RoR 17.0.0.rc.3	18.2	8.0.0	Body said 14.0.3 — already bumped; still React 18 + SP8, CI is RSpec-only (no SSR smoke)
react-on-rails-rsc-demo	—	—	—	Now ARCHIVED — the "Pro 16.4.0 minimal RSC starter embarrassment" is gone
react-on-rails-demo-gumroad-rsc	Pro 17.0.0.rc.5	19.0.7	~10.1	Body said 16.6.0 — now fully current; react-on-rails-rsc already on published 19.0.5
react-on-rails-demo-marketplace-rsc	rc.3	19.0.4	10.1	react-on-rails-rsc still on 19.0.5-rc.7; the git-branch/rc pin can now be replaced since #3634 shipped published 19.0.5
react-on-rails-demo-hacker-news-rsc	rc.3	19.0.4	10.1	has dependabot.yml
react-on-rails-starter-tanstack	rc.3	19.0.6	10.1	has dependabot.yml
octochangelog-on-rails-pro	rc.3	19.0.5	10.1	has dependabot.yml
react-on-rails-demo-flagship (NEW, #3876)	RoR 16.6.0	19.0.7	10.1	flagship itself is stale vs rc.5; has bin/smoke + smoke.yml

Things the original body assumed unbuilt that already partly exist:

• Per-repo dependency automation: dependabot.yml present in hacker-news, starter-tanstack, octochangelog (generic bundler/npm/actions, weekly — NOT a RoR-specific grouped preset).
• Smoke CI precedent: flagship smoke.yml is explicitly built as the template (docker compose up -d --build && bin/smoke, plus weekly cron) and references this issue (Demo fleet currency: automated version bumps + shared smoke CI across official demos #3898). marketplace-rsc has browser-smoke.yml + rsc-rspack-e2e.yml. Every demo already has its own CI.
• Shared harness scaffolding: shakacode/react-on-rails-demos monorepo exists with shared demo_common package, ci.yml, and a swap-shakacode-deps version-bump mechanism — but only holds 2 basic-v16 demos, separate from the standalone fleet.

Blockers/decisions now RESOLVED since triage:

• OSS flagship demo app (clone-and-run) + an npx-disposable eval demo #3876 flagship is CLOSED/done — the "decide ssr-hmr upgrade vs archive first" gate is effectively answered: flagship is the canonical OSS clone-and-run demo; ssr-hmr is retained as the tutorial repo (per examples-and-references.md).
• RSC FOUC: ship stable react-on-rails-rsc@19.0.5 and pin v17 to it (native-only) #3634 is CLOSED — published react-on-rails-rsc@19.0.5 exists, so marketplace-rsc's git-branch/rc pin is now replaceable.

Still genuinely UNBUILT: shared org-level Renovate preset with grouped RoR+Pro+rsc+shakapacker bumps; a reusable workflow_call smoke harness adopted fleet-wide; the generated currency table / badges in the docs; the scheduled staleness-flag job.

UNKNOWN / unverifiable from here:

• CI green/red status and last-smoke results per repo (not fetched).
• Whether all listed repos are shakacode-owned with write access for an agent (appear org-owned, but write access is a maintainer fact). External/community repos out of scope.
• Org policy Renovate vs Dependabot (Dependabot is the de-facto current choice in 3 repos).

Impact

Credibility/DX for evaluators landing on demos. The single largest original "embarrassment" (rsc-demo on Pro 16.4.0) is already gone via archiving, and gumroad is current — so impact is lower than the body implies. Remaining real items: ssr-hmr on React 18/SP8/rc.3, the rc.3-vs-rc.5 cluster, marketplace's rc rsc pin, and flagship itself at 16.6.0. No data-loss/security/correctness; not a release blocker.

Complexity

Cross-repo (≈7 active demos + flagship + the demos monorepo), spans Shakapacker 8→10 and React 18→19 for ssr-hmr (real porting). Disjoint repos = parallelizable, but needs per-repo write access and per-repo judgment — maintainer-supervised batch, not autonomous agents.

Process Gap Disposition

• Mechanism target: script (later) — fleet currency belongs in a small checked-in inventory + a workflow_call smoke template + a staleness job, not prose.
• Motivating miss: fleet drifted to 3-majors-stale before anyone noticed (original audit).
• Replay evidence: version table above; flagship smoke.yml is the working template to generalize.
• Non-goal: an org-wide Renovate-preset platform built before decay recurs (over-built for ~8 repos; the triage already descoped this).

Scoped plan (smallest-first)

Decision gate first (product/maintainer):

1. Confirm shakacode owns + grants write to all listed repos.
2. Renovate-preset vs keep Dependabot — recommend keep Dependabot for v1 (already in 3 repos) and defer the org preset.
3. Confirm ssr-hmr stays (tutorial) vs archive — docs already treat it as kept; if kept it must be upgraded to React 19 / SP10 / stable.

Slice 1 (do at 17.0.0 stable, #3823 — avoids bumping rc twice): one manual bump pass to stable across gumroad, marketplace, hacker-news, starter-tanstack, octochangelog, flagship (16.6.0→stable), ssr-hmr (rc.3 + React18/SP8 → stable/React19/SP10, the only heavy one). Replace marketplace's react-on-rails-rsc rc pin with published 19.0.5.

Slice 2 (small, can land independently): copy the per-repo dependabot.yml to repos lacking it (ssr-hmr, gumroad, marketplace, flagship); add a one-line "bump the demo fleet" item to the release checklist.

Slice 3 (after decay recurs / lower priority): generalize flagship smoke.yml into a reusable workflow_call smoke and adopt fleet-wide; add a currency table/last verified column to examples-and-references.md; optional scheduled staleness-flag job; optional org Renovate preset.

Needs maintainer / product decision

• Repo ownership + agent write access (gating).
• Renovate preset vs Dependabot (recommend Dependabot v1).
• ssr-hmr keep-and-upgrade vs archive (docs imply keep).
• Whether flagship's own 16.6.0→stable bump rides this issue or its own.

Next action

Park as P2 dependent on #3823; when 17.0.0 stable cuts, route Slices 1+2 into a maintainer-supervised cross-repo bump batch (not autonomous agents). Slice 2 (dependabot copy + release-checklist line) can land now without the framework. Defer Slice 3.

Confidence: high on versions/repo states (API-verified); medium on plan sequencing; low/UNKNOWN on write-access and CI-green status.