Move LHN row data reads into the rows

.github/actions/javascript/getDeployPullRequestList/getDeployPullRequestList.ts

@@ -84,8 +84,9 @@ async function run() {
         }
         core.setOutput('MOBILE_EXPENSIFY_PR_LIST', mobileExpensifyPRList);
     } catch (error) {
-        console.error((error as Error).message);
-        core.setFailed(error as Error);
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(message);
+        core.setFailed(error instanceof Error ? error : message);
     }
 }
 

.github/actions/javascript/getDeployPullRequestList/index.js

@@ -26716,8 +26716,9 @@ async function run() {
     }
     setOutput("MOBILE_EXPENSIFY_PR_LIST", mobileExpensifyPRList);
   } catch (error2) {
-    console.error(error2.message);
-    setFailed(error2);
+    const message = error2 instanceof Error ? error2.message : String(error2);
+    console.error(message);
+    setFailed(error2 instanceof Error ? error2 : message);
   }
 }
 if (import.meta.main) {

.github/workflows/buildAdHoc.yml

@@ -127,8 +127,8 @@ jobs:
         # v6
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::949552126497:role/app-adhoc-web-deploy-gh-actions
+          role-session-name: gh-${{ github.run_id }}-${{ github.run_attempt }}
           aws-region: us-east-1
 
       - name: Deploy to S3

.github/workflows/buildAndroid.yml

@@ -156,8 +156,10 @@ jobs:
         # v6
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::949552126497:role/app-rock-cache-gh-actions
+          role-session-name: gh-${{ github.run_id }}-${{ github.run_attempt }}
+          # Match the 6h job timeout because Rock does not refresh credentials before uploading
+          role-duration-seconds: 21600
           aws-region: us-east-1
 
       - name: Rock Remote Build - Android

.github/workflows/buildIOS.yml

@@ -237,8 +237,10 @@ jobs:
         # v6
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::949552126497:role/app-rock-cache-gh-actions
+          role-session-name: gh-${{ github.run_id }}-${{ github.run_attempt }}
+          # Match the 6h job timeout because Rock does not refresh credentials before uploading
+          role-duration-seconds: 21600
           aws-region: us-east-1
 
       - name: Prepare provisioning profiles JSON

.github/workflows/deploy.yml

@@ -201,6 +201,8 @@ jobs:
   androidBuild:
     name: Build Android HybridApp
     needs: [prep]
+    # Preserve the default token scopes while adding OIDC access for the called workflow
+    permissions: write-all
     if: ${{ fromJSON(needs.prep.outputs.SHOULD_BUILD_NATIVE) }}
     uses: ./.github/workflows/buildAndroid.yml
     with:
@@ -429,6 +431,8 @@ jobs:
   iosBuild:
     name: Build iOS HybridApp
     needs: [prep]
+    # Preserve the default token scopes while adding OIDC access for the called workflow
+    permissions: write-all
     if: ${{ fromJSON(needs.prep.outputs.SHOULD_BUILD_NATIVE) }}
     uses: ./.github/workflows/buildIOS.yml
     with:
@@ -703,6 +707,8 @@ jobs:
     name: Deploy Web to S3
     needs: [prep, webBuild, buildStorybook]
     if: ${{ always() && needs.webBuild.result == 'success' }}
+    # Preserve the default token scopes while adding OIDC access
+    permissions: write-all
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Checkout
@@ -735,8 +741,8 @@ jobs:
         # v6
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::949552126497:role/app-${{ env.DEPLOY_ENV }}-web-deploy-gh-actions
+          role-session-name: gh-${{ github.run_id }}-${{ github.run_attempt }}
           aws-region: us-east-1
 
       - name: Deploy to S3

.github/workflows/remote-build-android.yml

@@ -47,6 +47,8 @@ jobs:
 
   build:
     needs: [prep, resolveRefs]
+    # Preserve the default token scopes while adding OIDC access
+    permissions: write-all
     runs-on: ${{ github.repository_owner == 'Expensify' && 'blacksmith-16vcpu-ubuntu-2404' || 'blacksmith-2vcpu-ubuntu-2404' }}
     strategy:
       fail-fast: false
@@ -82,8 +84,10 @@ jobs:
         # v6
         uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::949552126497:role/app-rock-cache-gh-actions
+          role-session-name: gh-${{ github.run_id }}-${{ github.run_attempt }}
+          # Match the 6h job timeout because Rock does not refresh credentials before uploading
+          role-duration-seconds: 21600
           aws-region: us-east-1
 
       - name: Rock Remote Build - Android

.github/workflows/remote-build-ios.yml

@@ -47,6 +47,8 @@ jobs:
 
   build:
     needs: [prep, resolveRefs]
+    # Preserve the default token scopes while adding OIDC access
+    permissions: write-all
     runs-on: ${{ github.repository_owner == 'Expensify' && 'blacksmith-12vcpu-macos-latest' || 'macos-latest' }}
     strategy:
       fail-fast: false
@@ -94,8 +96,10 @@ jobs:
         # v6
         uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::949552126497:role/app-rock-cache-gh-actions
+          role-session-name: gh-${{ github.run_id }}-${{ github.run_attempt }}
+          # Match the 6h job timeout because Rock does not refresh credentials before uploading
+          role-duration-seconds: 21600
           aws-region: us-east-1
 
       - name: Rock Remote Build - iOS

.github/workflows/testBuild.yml

@@ -63,6 +63,8 @@ jobs:
 
   buildApps:
     needs: [prep, resolveRefs]
+    # Preserve the default token scopes while adding OIDC access for the called workflow
+    permissions: write-all
     uses: ./.github/workflows/buildAdHoc.yml
     with:
       # Fall back to App main when nothing is resolved (test builds default to the latest NewDot).

.github/workflows/testBuildOnPush.yml

@@ -70,6 +70,8 @@ jobs:
 
   buildApps:
     needs: [prep]
+    # Preserve the default token scopes while adding OIDC access for the called workflow
+    permissions: write-all
     uses: ./.github/workflows/buildAdHoc.yml
     with:
       APP_REF: ${{ needs.prep.outputs.APP_REF }}

.github/workflows/verifyHybridApp.yml

@@ -75,6 +75,10 @@ jobs:
 
   verify_android:
     name: Verify Android HybridApp builds on main
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
     if: ${{ !github.event.pull_request.head.repo.fork && github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' }}
     cache-mode: read
     uses: ./.github/workflows/buildAndroid.yml
@@ -85,6 +89,10 @@ jobs:
 
   verify_ios:
     name: Verify iOS HybridApp builds on main
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
     if: ${{ !github.event.pull_request.head.repo.fork && github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' }}
     cache-mode: read
     uses: ./.github/workflows/buildIOS.yml

.storybook/mockPaths.ts

@@ -8,6 +8,9 @@ const dirname = path.dirname(filename);
 /* eslint-disable @typescript-eslint/naming-convention */
 export default {
     '@react-native-community/netinfo': path.resolve(dirname, '../__mocks__/@react-native-community/netinfo.ts'),
-    '@react-navigation/native': path.resolve(dirname, '../__mocks__/@react-navigation/native'),
+    // The static mock, plus a story-owned route stack so a whole flow can mount
+    '@react-navigation/native': path.resolve(dirname, './mocks/react-navigation-native.ts'),
+    // Modal backdrops read the stack card animation, which no story mounts
+    '@react-navigation/stack': path.resolve(dirname, './mocks/react-navigation-stack.ts'),
 };
 /* eslint-enable @typescript-eslint/naming-convention */

.storybook/mocks/navigationStoryLoader.cjs

@@ -0,0 +1,11 @@
+const path = require('path');
+
+/**
+ * Rewrites the App's Navigation module for Storybook so navigate and goBack land on the story's route stack.
+ * A loader is used because `@libs` is a prefix alias that no alias entry for a single module can outrank.
+ */
+module.exports = function navigationStoryLoader(source) {
+    const routerPath = JSON.stringify(path.resolve(__dirname, './storyRouter.tsx'));
+    const renamed = source.replace(/export default \{/, 'const navigationForStorybook = {');
+    return `import {withStoryRouter} from ${routerPath};\n${renamed}\nexport default withStoryRouter(navigationForStorybook);\n`;
+};

.storybook/mocks/react-navigation-native.ts

@@ -0,0 +1,86 @@
+import {useEffect} from 'react';
+
+import {useStoryRouter} from './storyRouter';
+
+const noop = () => {};
+
+const staticRoute = {key: 'story', name: 'StoryFlow', params: {}};
+const staticNavigation = {
+    navigate: noop,
+    goBack: noop,
+    setParams: noop,
+    canGoBack: () => false,
+    getState: () => ({routes: []}),
+    isFocused: () => true,
+    addListener: () => noop,
+};
+
+/** Inside a StoryRouterProvider the route comes from the story's stack. Elsewhere no story mounts a navigator. */
+function useRoute() {
+    const router = useStoryRouter();
+    return router ? {...staticRoute, params: router.current} : staticRoute;
+}
+
+function useNavigation() {
+    const router = useStoryRouter();
+    if (!router) {
+        return staticNavigation;
+    }
+    return {...staticNavigation, setParams: router.setParams, goBack: router.pop, canGoBack: () => true};
+}
+
+const useIsFocused = () => true;
+const useTheme = () => ({});
+const useLocale = () => ({});
+const useNavigationState = () => undefined;
+const usePreventRemove = noop;
+const triggerTransitionEnd = noop;
+const useFocusEffect = (callback: () => (() => void) | void) => {
+    useEffect(() => callback(), [callback]);
+};
+function Link() {
+    return null;
+}
+function LinkingContext() {
+    return null;
+}
+function NavigationContainer() {
+    return null;
+}
+function ServerContainer() {
+    return null;
+}
+function ThemeProvider() {
+    return null;
+}
+const DarkTheme = {};
+const DefaultTheme = {};
+const useLinkBuilder = () => null;
+const useLinkProps = () => null;
+const useLinkTo = () => null;
+const useScrollToTop = () => null;
+
+// Everything a story does not override comes from the navigation core
+export * from '@react-navigation/core';
+export {
+    useRoute,
+    useNavigation,
+    useIsFocused,
+    useTheme,
+    useLocale,
+    useNavigationState,
+    usePreventRemove,
+    triggerTransitionEnd,
+    useFocusEffect,
+    Link,
+    LinkingContext,
+    NavigationContainer,
+    ServerContainer,
+    ThemeProvider,
+    DarkTheme,
+    DefaultTheme,
+    useLinkBuilder,
+    useLinkProps,
+    useLinkTo,
+    useScrollToTop,
+};

.storybook/mocks/react-navigation-stack.ts

@@ -0,0 +1,27 @@
+// useCardAnimation returns React Native Animated values, not Reanimated ones
+// eslint-disable-next-line no-restricted-imports
+import {Animated} from 'react-native';
+
+// The alias points the package name at this file, so the real module has to be reached by path, which has no declaration
+// @ts-expect-error -- see above
+// eslint-disable-next-line import/no-relative-packages
+export * from '../../node_modules/@react-navigation/stack/lib/module/index.js';
+
+const presented = new Animated.Value(1);
+const idle = new Animated.Value(0);
+
+/** No story mounts a stack screen, so every modal is treated as fully presented */
+function useCardAnimation() {
+    return {
+        current: {progress: presented},
+        next: undefined,
+        closing: idle,
+        swiping: idle,
+        inverted: presented,
+        index: 0,
+        layouts: {screen: {width: 0, height: 0}},
+        insets: {top: 0, right: 0, bottom: 0, left: 0},
+    };
+}
+
+export {useCardAnimation};