style(address-book): DS migration demo — saved-addresses view (stacked on #2837)

.github/workflows/android-release.yml

@@ -18,6 +18,22 @@ name: Android Release (Play)
 # Plus the production NEXT_PUBLIC_* the static export bakes in (see the env step).
 
 on:
+    workflow_call:
+        inputs:
+            versionName:
+                description: 'Resolved <major>.<build>.0 version to ship'
+                required: true
+                type: string
+            track:
+                description: 'Play track'
+                required: false
+                default: 'internal'
+                type: string
+            pushDebug:
+                description: 'Enable OneSignal verbose logging in this build'
+                required: false
+                default: false
+                type: boolean
     push:
         tags: ['v*']
     workflow_dispatch:
@@ -29,7 +45,7 @@ on:
                 type: choice
                 options: [internal, alpha, beta, production]
             versionName:
-                description: 'versionName override (optional; defaults to package.json)'
+                description: 'Break-glass <major>.<build>.0 version (required; there is no package.json fallback)'
                 required: false
                 type: string
             pushDebug:
@@ -42,7 +58,16 @@ permissions:
     contents: read
 
 concurrency:
-    group: android-release-${{ github.ref }}
+    # A break-glass `v*` tag push runs outside release-native.yml's mutex, so it joins
+    # `production-release` here (which serialises iOS and Android for that path only —
+    # the price of not racing a concurrent OTA). When release-native.yml calls this
+    # workflow the parent already holds the mutex, and github.event_name is the
+    # caller's `workflow_dispatch`, so the called run keeps its own group instead of
+    # deadlocking against its parent. A direct dispatch of this workflow is
+    # indistinguishable from that, so it sits outside the mutex — deepest break-glass.
+    group: >-
+        ${{ github.event_name == 'push' && 'production-release'
+        || format('android-release-{0}', github.ref) }}
     cancel-in-progress: false
 
 jobs:
@@ -109,27 +134,30 @@ jobs:
                   NEXT_PUBLIC_SAFARI_WEB_ID=${{ vars.NEXT_PUBLIC_SAFARI_WEB_ID }}
                   NEXT_PUBLIC_ONESIGNAL_WEBHOOK=${{ vars.NEXT_PUBLIC_ONESIGNAL_WEBHOOK }}
                   EOF
-                  if [ "${{ github.event.inputs.pushDebug }}" = "true" ]; then
+                  if [ "${{ inputs.pushDebug }}" = "true" ]; then
                       echo "NEXT_PUBLIC_ONESIGNAL_DEBUG=true" >> .env.production.local
                   fi
 
             - name: Resolve release versionName
               id: version
               env:
-                  INPUT_VERSION: ${{ github.event.inputs.versionName || '' }}
+                  INPUT_VERSION: ${{ inputs.versionName || '' }}
               run: |
-                  # versionName: manual dispatch input wins; else the tag name minus
-                  # its leading 'v' (v1.0.10 -> 1.0.10); else package.json (the same
-                  # fallback build.gradle uses). Resolved once, up front, so the OTA
-                  # floor check and the bundle publish below see the exact version
-                  # the binary ships with. Keep in lockstep with ios-release.yml.
+                  # release-native.yml resolves the version and passes it here, so the
+                  # input wins; a break-glass tag push falls back to the tag name minus
+                  # its leading 'v' (v1.1.0 -> 1.1.0). Either way it is validated against
+                  # the release scheme before the build starts. Resolved once, up front,
+                  # so the OTA floor check and the bundle publish below see the exact
+                  # version the binary ships with. Keep in lockstep with ios-release.yml.
                   VERSION_NAME="$INPUT_VERSION"
                   if [ -z "$VERSION_NAME" ] && [ "$GITHUB_REF_TYPE" = "tag" ]; then
                       VERSION_NAME="${GITHUB_REF_NAME#v}"
                   fi
                   if [ -z "$VERSION_NAME" ]; then
-                      VERSION_NAME="$(node -p "require('./package.json').version")"
+                      echo "::error::no versionName — call this from release-native.yml, or push a vX.Y.0 tag" >&2
+                      exit 1
                   fi
+                  node scripts/release-version.mjs validate "$VERSION_NAME" --kind native
                   echo "name=$VERSION_NAME" >> "$GITHUB_OUTPUT"
                   echo "Release versionName: $VERSION_NAME"
 
@@ -180,7 +208,7 @@ jobs:
                   serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
                   packageName: me.peanut.wallet
                   releaseFiles: android/app/build/outputs/bundle/release/app-release.aab
-                  tracks: ${{ github.event.inputs.track || 'internal' }}
+                  tracks: ${{ inputs.track || 'internal' }}
                   status: completed
                   # Staged production rollout: set status: inProgress + userFraction: 0.1,
                   # then promote in Play Console once crash/error rates look clean.

.github/workflows/capgo-deploy.yml

@@ -2,36 +2,38 @@ name: Deploy OTA Update (Capgo)
 
 on:
     # Production OTA reaches every shipped iOS and Android install, so it is opt-in
-    # per release and never a side effect of pushing code: it fires on an `ota-*`
-    # tag and nothing else. Pushing to mobile-release builds and lands code; tagging
-    # is the separate, deliberate act that says "ship this JS to everyone", and the
-    # tag is a permanent record of exactly which commit went out.
+    # per release and never a side effect of pushing code. Normally this workflow is
+    # called by release-ota.yml, which resolves the bundle version and tags the
+    # commit afterwards; `dev` still auto-ships to staging, which reaches no
+    # production device.
     #
-    # One deliberate exception to "tags only": a NATIVE release whose versionName
-    # is ahead of the newest production bundle auto-publishes a matching bundle
-    # from its own commit (see android-release.yml / ios-release.yml). Without
-    # that, Capgo's disable_auto_update_under_native rule makes every device on
-    # the new binary refuse all existing bundles — OTA silently dead for the
-    # fleet while CI stays green (TASK-21793).
+    # One deliberate exception: a NATIVE release whose versionName is ahead of the
+    # newest production bundle auto-publishes a matching bundle from its own commit
+    # (see android-release.yml / ios-release.yml). Without that, Capgo's
+    # disable_auto_update_under_native rule makes every device on the new binary
+    # refuse all existing bundles — OTA silently dead for the fleet while CI stays
+    # green (TASK-21793).
     #
-    #   git tag ota-1.0.48 && git push origin ota-1.0.48
+    # An `ota-*` tag push stays as a break-glass path, naming its own bundle
+    # (ota-1.1.4 -> 1.1.4) and validated against the release scheme. Deliberately
+    # NOT `v*`: ios-release.yml and android-release.yml claim that prefix for native
+    # store builds, and a JS-only OTA must not be able to trigger those.
     #
-    # The bundle version is taken from the tag (ota-1.0.48 -> 1.0.48), so each
-    # shipped bundle is named by the tag that shipped it and two OTAs can never
-    # collide on one version. `ota-1.0.48-hotfix1` is a valid follow-up on the same
-    # native build.
-    #
-    # Deliberately NOT `v*`: ios-release.yml and android-release.yml already claim
-    # that prefix for native store builds, and a JS-only OTA must not be able to
-    # trigger those or vice versa.
-    #
-    # `dev` still auto-ships to staging, which reaches no production device.
-    #
-    # NOTE: the tag is currently the only approval step. The job declares the
-    # Production environment below, but that environment has no protection rules
-    # (verified 2026-08-06 via `gh api repos/:owner/:repo/environments`), so it
-    # gates nothing yet — adding required reviewers there makes the tag push queue
-    # for a second human, with no change to this file.
+    # NOTE: running the workflow is currently the only approval step. The job
+    # declares the Production environment below, but that environment has no
+    # protection rules (verified 2026-08-06 via `gh api repos/:owner/:repo/environments`),
+    # so it gates nothing yet — adding required reviewers there makes a production
+    # deploy queue for a second human, with no change to this file.
+    workflow_call:
+        inputs:
+            channel:
+                description: 'Capgo channel to deploy to'
+                required: true
+                type: string
+            version:
+                description: 'Resolved bundle version to upload'
+                required: true
+                type: string
     push:
         branches: [dev]
         tags: ['ota-*']
@@ -51,8 +53,17 @@ permissions:
     contents: read
 
 concurrency:
-    group: capgo-deploy-${{ github.ref }}
-    cancel-in-progress: true
+    # Two separate hazards, one expression. A routine merge to dev must never cancel a
+    # production write mid-flight, so the channel is part of the group and production
+    # never cancels. And a break-glass `ota-*` tag push runs outside release-ota.yml's
+    # mutex, so it joins `production-release` here — while a CALLED run must not, since
+    # release-ota.yml is already holding that mutex and would deadlock against its own
+    # child (github.event_name is the caller's `workflow_dispatch`, not `push`).
+    group: >-
+        ${{ (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/ota-'))
+        && 'production-release'
+        || format('capgo-deploy-{0}-{1}', inputs.channel || 'staging', github.ref) }}
+    cancel-in-progress: ${{ inputs.channel != 'production' && !startsWith(github.ref, 'refs/tags/ota-') }}
 
 jobs:
     deploy:
@@ -68,7 +79,7 @@ jobs:
         # Keep the two in sync — every branch that resolves to `production` needs to
         # appear here, or its deploy would reach all users with no approval.
         environment: >-
-            ${{ ((github.event_name == 'workflow_dispatch' && github.event.inputs.channel == 'production')
+            ${{ (inputs.channel == 'production'
             || startsWith(github.ref, 'refs/tags/ota-')) && 'Production' || '' }}
         steps:
             - uses: actions/checkout@v7
@@ -102,8 +113,8 @@ jobs:
                   # Keep in lockstep with the `environment:` expression above — a ref
                   # that resolves to production here but is missing there would ship to
                   # every device with nobody approving it.
-                  if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-                    echo "name=${{ github.event.inputs.channel }}" >> $GITHUB_OUTPUT
+                  if [ -n "${{ inputs.channel }}" ]; then
+                    echo "name=${{ inputs.channel }}" >> $GITHUB_OUTPUT
                   elif [ "$GITHUB_REF_TYPE" = "tag" ] && case "$GITHUB_REF_NAME" in ota-*) true;; *) false;; esac; then
                     echo "name=production" >> $GITHUB_OUTPUT
                   else
@@ -114,28 +125,35 @@ jobs:
               id: version
               env:
                   CHANNEL: ${{ steps.channel.outputs.name }}
+                  INPUT_VERSION: ${{ inputs.version || '' }}
               run: |
-                  # Capgo defaults the bundle version to package.json's, which only
-                  # moves on a native release, so a lane shipping on every merge
-                  # collides the moment two merges share a version ("Version x already
-                  # exists"). That silently killed dev -> staging: dev sat on 1.0.8 and
-                  # every deploy after the first failed, which looks identical to no
-                  # deploy at all.
-                  #
-                  # Production takes its version from the ota-* tag, so the bundle is
-                  # named by the tag that shipped it and re-shipping the same JS on the
-                  # same native build just needs a new tag (ota-1.0.48-hotfix1) rather
-                  # than a package.json bump.
+                  # release-ota.yml resolves the production version off the channel's
+                  # current bundle and passes it here, so the input wins. A break-glass
+                  # `ota-*` tag still names its own bundle, validated against the
+                  # release scheme so an off-scheme tag cannot ship.
                   #
-                  # Every other lane derives <major>.<minor>.<commit count>. A short-SHA
-                  # suffix would look equivalent and is not: 1.0.8-abc1234 is a semver
-                  # prerelease, sorts BELOW plain 1.0.8, and Capgo's
-                  # disable_auto_update_under_native makes every device on the 1.0.8
-                  # binary refuse it — uploaded, listed, never installed.
-                  if [ "$CHANNEL" = "production" ] && [ "$GITHUB_REF_TYPE" = "tag" ]; then
+                  # Every other lane derives <major>.<build>.<commit count>. The commit
+                  # count is what keeps staging out of production's way: the two share
+                  # one bundle namespace, production counts OTAs in single digits, and a
+                  # version collision no-ops under --version-exists-ok — uploaded,
+                  # listed, shipped to nobody. A short-SHA suffix would look equivalent
+                  # and is not: 1.1.0-abc1234 is a semver prerelease, sorts BELOW plain
+                  # 1.1.0, and Capgo's disable_auto_update_under_native makes every
+                  # device on the 1.1.0 binary refuse it.
+                  if [ -n "$INPUT_VERSION" ]; then
+                      VERSION="$INPUT_VERSION"
+                  elif [ "$GITHUB_REF_TYPE" = "tag" ]; then
                       VERSION="${GITHUB_REF_NAME#ota-}"
+                      node scripts/release-version.mjs validate "$VERSION" --kind ota
+                  elif [ "$CHANNEL" = "production" ]; then
+                      # A bare dispatch to production would land a staging-shaped
+                      # version on the production channel and drag its OTA counter into
+                      # the commit-count band, where the next resolved version collides
+                      # with a bundle that already exists.
+                      echo "::error::a production deploy needs a resolved version — use the Release OTA workflow" >&2
+                      exit 1
                   else
-                      VERSION="$(node scripts/capgo-bundle-version.mjs)"
+                      VERSION="$(node scripts/release-version.mjs staging)"
                   fi
                   echo "name=$VERSION" >> "$GITHUB_OUTPUT"
                   echo "Uploading as bundle version $VERSION"

.github/workflows/content-publish-automerge.yml

@@ -131,7 +131,7 @@ jobs:
 
                   # Key off the `ci-success` check run, NOT `workflow_run.conclusion`.
                   # `ci-success` is the single check the "Protect Prod" ruleset gates
-                  # on; the run conclusion also folds in advisory jobs (e2e). Gate on
+                  # on; the run conclusion also folds in advisory jobs (ds-shots). Gate on
                   # exactly what the ruleset gates on.
                   #
                   # `Tests` runs on `pull_request` (and `push` for dev/main), so a