build(ci): add weekly dependency refresh, grouped Dependabot and app CI gate

.github/dependabot.yml

@@ -0,0 +1,158 @@
+version: 2
+
+# Minor and patch bumps inside each app's existing ranges are handled by the weekly
+# refresh workflow (deps-weekly-refresh.yml), which updates every lockfile in one PR.
+# Dependabot only opens what the refresh can't do: majors, and security fixes.
+
+updates:
+  # Node and Next.js apps
+  - package-ecosystem: npm
+    directories:
+      - "/claims-source-app"
+      - "/interaction-hook-app"
+      - "/manual-revocation-check"
+      - "/verifier-web-tutorial"
+      - "/webhook-app"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Pacific/Auckland
+    open-pull-requests-limit: 8
+    commit-message:
+      prefix: "build(deps)"
+      prefix-development: "build(deps-dev)"
+    groups:
+      security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+      # Version-locked to each other, so they move together.
+      next-react-major:
+        patterns:
+          - "next"
+          - "eslint-config-next"
+          - "react"
+          - "react-dom"
+          - "@types/react"
+          - "@types/react-dom"
+        update-types:
+          - major
+      # Same dependency across several apps lands in one PR.
+      majors:
+        group-by: dependency-name
+        patterns:
+          - "*"
+        update-types:
+          - major
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-minor
+          - version-update:semver-patch
+
+  # React Native (Expo) tutorials, starter and complete
+  - package-ecosystem: npm
+    directories:
+      - "/react-native-in-person-verifier-tutorial/react-native-in-person-verifier-tutorial-complete"
+      - "/react-native-in-person-verifier-tutorial/react-native-in-person-verifier-tutorial-starter"
+      - "/react-native-mdocs-holder-tutorial/react-native-mdocs-holder-tutorial-complete"
+      - "/react-native-mdocs-holder-tutorial/react-native-mdocs-holder-tutorial-starter"
+      - "/react-native-remote-verification-tutorial/react-native-remote-verification-tutorial-complete"
+      - "/react-native-remote-verification-tutorial/react-native-remote-verification-tutorial-starter"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Pacific/Auckland
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "build(deps)"
+      prefix-development: "build(deps-dev)"
+    groups:
+      security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+      rn-tooling-major:
+        group-by: dependency-name
+        patterns:
+          - "*"
+        update-types:
+          - major
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-minor
+          - version-update:semver-patch
+      # Expo SDK, React Native and MATTR SDK majors are upgraded deliberately, together
+      # with the matching Learn tutorial (`npx expo install --fix`), never one at a time.
+      - dependency-name: "expo"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "expo-*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@expo/*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react-dom"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react-native"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@mattrglobal/*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: gradle
+    directories:
+      - "/android-holder-tutorial-sample-app"
+      - "/android-in-person-verifier-tutorial-sample-app"
+      - "/android-remote-verification-tutorial-sample-app"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Pacific/Auckland
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: "build(deps)"
+    groups:
+      android:
+        group-by: dependency-name
+        patterns:
+          - "*"
+    ignore:
+      # Resolved from each app's local `repo/` folder, which isn't committed.
+      - dependency-name: "global.mattr.mobilecredential:*"
+
+  - package-ecosystem: docker
+    directories:
+      - "/claims-source-app"
+      - "/webhook-app"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Pacific/Auckland
+    open-pull-requests-limit: 2
+    commit-message:
+      prefix: "build(deps)"
+    groups:
+      docker:
+        group-by: dependency-name
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Pacific/Auckland
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: "build(ci)"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/ci-apps.yml

@@ -0,0 +1,86 @@
+name: CI apps
+
+# Installs each changed JS app from its lockfile, then builds the Next.js apps and
+# type-checks the complete React Native apps. The native Android and iOS apps aren't
+# built: their MATTR SDKs are added locally and aren't available in CI. The React Native
+# apps install a private MATTR SDK, so they're only checked when an NPM_TOKEN secret exists.
+
+on:
+  pull_request:
+    branches: [master]
+  # Started by deps-weekly-refresh.yml for its PR branch.
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  changed:
+    runs-on: ubuntu-latest
+    outputs:
+      apps: ${{ steps.apps.outputs.apps }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: List changed apps
+        id: apps
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          BASE_SHA=${BASE_SHA:-$(git merge-base origin/master HEAD)}
+          apps=$(git ls-files '*package-lock.json' '*yarn.lock' | xargs -n1 dirname | while read -r dir; do
+            if ! git diff --quiet "$BASE_SHA"...HEAD -- "$dir"; then echo "$dir"; fi
+          done | jq -R . | jq -sc .)
+          echo "apps=$apps" >> "$GITHUB_OUTPUT"
+          echo "Changed apps: $apps"
+
+  check:
+    needs: changed
+    if: needs.changed.outputs.apps != '[]'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        app: ${{ fromJSON(needs.changed.outputs.apps) }}
+    defaults:
+      run:
+        working-directory: ${{ matrix.app }}
+    env:
+      COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      NEXT_TELEMETRY_DISABLED: "1"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+
+      - name: Skip without registry access
+        id: access
+        if: startsWith(matrix.app, 'react-native-') && env.NPM_TOKEN == ''
+        run: echo "::notice::No NPM_TOKEN secret for the private MATTR SDK, skipping ${{ matrix.app }}"
+
+      - name: Install
+        if: steps.access.conclusion == 'skipped'
+        run: |
+          if [ -n "$NPM_TOKEN" ]; then export YARN_NPM_AUTH_TOKEN="$NPM_TOKEN"; fi
+          if [ -f yarn.lock ]; then
+            corepack yarn install --immutable --mode=skip-build
+          else
+            npm ci --ignore-scripts --no-audit --no-fund
+          fi
+
+      - name: Build
+        if: steps.access.conclusion == 'skipped' && hashFiles(format('{0}/package-lock.json', matrix.app)) != ''
+        run: npm run build --if-present
+
+      - name: Type-check
+        if: steps.access.conclusion == 'skipped' && startsWith(matrix.app, 'react-native-') && endsWith(matrix.app, '-complete')
+        run: corepack yarn tsc --noEmit

.github/workflows/deps-weekly-refresh.yml

@@ -0,0 +1,63 @@
+name: Weekly dependency refresh
+
+# Re-resolves every app's lockfile to the newest versions its package.json ranges allow,
+# and opens (or updates) a single PR listing what changed.
+
+on:
+  schedule:
+    # Monday 09:00 NZDT (08:00 NZST)
+    - cron: "0 20 * * 0"
+  workflow_dispatch:
+
+concurrency:
+  group: deps-weekly-refresh
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: write
+
+jobs:
+  refresh:
+    if: github.repository == 'mattrglobal/sample-apps'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    env:
+      COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+
+      - name: Refresh lockfiles
+        id: refresh
+        run: node scripts/deps/refresh.mjs --report "$RUNNER_TEMP/deps-report.md"
+
+      - name: Open or update the PR
+        id: pr
+        if: steps.refresh.outputs.changed == 'true'
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          branch: deps/weekly-refresh
+          base: master
+          add-paths: |
+            **/package-lock.json
+            **/yarn.lock
+          commit-message: "build(deps): weekly in-range dependency refresh"
+          title: "build(deps): weekly in-range dependency refresh"
+          body-path: ${{ runner.temp }}/deps-report.md
+          sign-commits: true
+          delete-branch: true
+
+      # Pushes made with GITHUB_TOKEN don't trigger pull_request workflows, so start the
+      # app checks on the PR branch directly. They report on the PR's head commit.
+      - name: Run app checks on the PR
+        if: steps.pr.outputs.pull-request-operation == 'created' || steps.pr.outputs.pull-request-operation == 'updated'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh workflow run ci-apps.yml --repo "$GITHUB_REPOSITORY" --ref deps/weekly-refresh

README.md

@@ -14,6 +14,17 @@ A collection of developer apps and API tooling that you can use to interface wit
 * [Credential templates](/credential-templates/README.md)
 * [Postman Collection](/postman/README.md)
 
+## Dependency updates
+
+Every Monday morning (NZ time) two things run:
+
+* **Weekly refresh** (`.github/workflows/deps-weekly-refresh.yml`) re-resolves every JS app's lockfile to the newest versions its `package.json` ranges allow, transitive dependencies included, and opens or updates one PR from `deps/weekly-refresh`. It never edits `package.json`, and skips releases newer than 3 days. Merging it clears the chain of transitive bumps that would otherwise arrive one PR at a time.
+* **Dependabot** (`.github/dependabot.yml`) only opens what the refresh can't do: major upgrades, grouped by dependency across apps, and security fixes. It also covers the Android Gradle apps, the Dockerfiles and GitHub Actions.
+
+Expo, React Native and MATTR SDK majors in the React Native tutorials are excluded from automation, and the refresh leaves the MATTR SDK lock entries as they are. Upgrade them together with the matching Learn tutorial using `npx expo install --fix`. If a refresh would move a package that has a `patches/` file, that app's lockfile is left alone and the PR says so. Regenerate the patch against the new version to unblock it.
+
+To run the refresh locally: `node scripts/deps/refresh.mjs --only <app-dir>`.
+
 ---
 
 <p align="center"><a href="https://mattr.global" target="_blank"><img height="40px" src ="./docs/assets/mattr-logo-tm.svg"></a></p><p align="center">Copyright © MATTR Limited. <a href="./LICENSE">Some rights reserved.</a><br/>“MATTR” is a trademark of MATTR Limited, registered in New Zealand and other countries.</p>