feat: automate app-modules release and app-monorepo sync

[huhuanming]

Problem

app-modules needs automatic preview packages for ordinary merged changes, while stable releases must use the version explicitly reviewed in source. npm acceptance alone is not enough to prove that a version is available to consumers.

Release policy

• A merged same-repository PR that does not change a publishable workspace version gets a CI-only next-patch -alpha.<workflow run number> version across all publishable workspaces and exact internal dependencies, then publishes under npm next. The preview version is not committed to main and does not update app-monorepo.
• A merged same-repository PR that changes a publishable workspace version publishes the exact synchronized stable version from the PR under npm latest. The workflow does not bump versions or update CHANGELOG. Source PR approval is also release approval for a version-changing PR.
• A merged fork PR is skipped with a workflow-summary notice and can be released manually.

Publishing and downstream sync

• Publish only missing packages; if the exact version already exists under another tag, move the selected dist-tag instead of attempting an invalid republish.
• Poll the npm registry every 45 seconds for at most 10 checks. Continue only after every package version and selected dist-tag are visible.
• For latest only, update all app-modules pins on app-monorepo x, including mobile npm aliases, components dependencies, and root dependency/resolution pins; refresh the lockfile, check the module-ID registry, and open an app-monorepo PR. Do not auto-merge it.

Validation

• 30 Node tests pass; git diff --check passes.
• The workflow passes actionlint, excluding only the local actionlint schema warning for the currently supported GitHub Actions queue: max setting.
• Preview smoke test from stable 3.0.152: all 41 packages became 3.0.153-alpha.999, the four exact internal dependency pins followed the preview version, Yarn refreshed the lockfile, and dist-tag validation passed.
• Read-only registry check: all 41 stable 3.0.152 packages exist and would be retagged from next to latest without republishing.
• Earlier app-monorepo dry run: 41 mobile pins, 4 components pins, and 2 root pins update with no unrelated lines changed.

Required setup and boundaries

• Install a dedicated GitHub App on app-monorepo with Contents write and Pull requests write. Configure APP_RELEASE_APP_ID and APP_RELEASE_PRIVATE_KEY in app-modules; keep NPM_TOKEN available for npm publishing. These credentials and live end-to-end publishing were not verified in this PR.
• module-id:update requires a fresh Union Build module-ID map. The dependency PR checks the existing registry, but new native runtime modules still need map generation and a registry update before that PR merges.

[sidmorizon]

@codex review

[sidmorizon]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-20T14:23:18.233772Z	cdd5bbb	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[sidmorizon]

Cursor Cloud Agent review session ↗

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cdd5bbbdba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sidmorizon]

View Devin Review ↗️

[sidmorizon]

Claude review session: https://claude.ai/code/session_01GN4VAXu1Jw39qQ51fL1Yrr

[sidmorizon]

Local Codex CLI review

Open the review session in Slack

The review runs in a read-only local worktree and continues in this session when the PR receives a substantive commit.