Chore/deterministic ci installs

.github/pull_request_template.md

@@ -0,0 +1,29 @@
+## CHANGELOG
+REPLACE_ME_WITH_CHANGELOG
+
+## SUMMARY
+REPLACE_ME_WITH_SUMMARY_OF_THE_CHANGES
+
+## FUNCTIONAL AUTOMATION CHANGES PR
+- [ ] Yes
+  - If Yes, PR : 
+- [ ] No
+  - If No, Reason: 
+
+## AUTOMATION TEST REPORT URL
+REPLACE_ME_WITH_TEST_REPORT_URL
+
+## AREAS OF IMPACT
+REPLACE_ME_WITH_AREAS_OF_IMPACT_OR_NA
+
+## TYPE OF CHANGE
+- [ ] 🐞 Bugfix
+- [ ] 🌟 Feature
+- [ ] ✨ Enhancement
+- [ ] 🧪 Unit Test Cases
+- [ ] 📔 Documentation
+- [ ] ⚙️ Chore - Build Related / Configuration / Others
+
+
+## DOCUMENTATION
+REPLACE_ME_WITH_DOCUMENTATION_LINK_OR_NA

.github/scripts/README.md

@@ -0,0 +1,31 @@
+# Scripts
+
+## Generate changelog
+
+Lists PRs merged into a branch (excludes "Parent branch sync" and bot-authored PRs).
+
+**Prerequisites:** `jq`, and GitHub credentials as env vars.
+
+### Set credentials (once per terminal)
+
+```bash
+export GH_USERNAME=your-github-username
+export GH_PAT=your-github-personal-access-token
+```
+
+### Commands
+
+From repo root:
+
+| What you want | Command |
+|---------------|---------|
+| PRs merged into **current branch** (last 30 days) | `./.github/scripts/generate-changelog.sh` |
+| PRs merged into **master** (last 30 days) | `./.github/scripts/generate-changelog.sh master` |
+| PRs merged into **master** since a date | `./.github/scripts/generate-changelog.sh master "merged:>=2025-01-01"` |
+
+### Arguments
+
+1. **Branch** (optional) — default: current branch  
+2. **Date filter** (optional) — default: last 30 days (e.g. `merged:>=2025-01-01`)
+
+Output includes a GitHub search URL to verify results.

.github/scripts/generate-changelog.sh

@@ -0,0 +1,84 @@
+#!/bin/bash
+
+set -e
+
+# Check required environment variables
+if [[ -z "$GH_USERNAME" ]]; then
+  echo "❌ Error: Environment variable GH_USERNAME not found"
+  exit 1
+fi
+
+if [[ -z "$GH_PAT" ]]; then
+  echo "❌ Error: Environment variable GH_PAT not found"
+  exit 1
+fi
+
+# Optional: Branch name (defaults to current branch if not provided)
+SOURCE_BRANCH="${1:-$(git branch --show-current)}"
+# Optional: Date filter (defaults to last 30 days if not provided)
+DATE_FILTER="${2:-merged:>=$(date -u -v-30d +%Y-%m-%d 2>/dev/null || date -u -d '30 days ago' +%Y-%m-%d)}"
+
+# Repo is set per-repo when this file is pushed (placeholder replaced by upload script)
+REPO="chargebee/chargebee-react-native"
+
+echo "🔍 Searching for PRs merged into $SOURCE_BRANCH..."
+
+# GitHub API call with error handling
+HTTP_STATUS=$(curl -s -w "%{http_code}" -G -u "$GH_USERNAME:$GH_PAT" \
+  "https://api.github.com/search/issues" \
+  --data-urlencode "q=NOT \"Parent branch sync\" in:title is:pr repo:$REPO is:merged base:$SOURCE_BRANCH merged:$DATE_FILTER -author:app/distributed-gitflow-app" \
+  -o /tmp/curl_output.json \
+  2>/tmp/curl_error.log)
+
+CURL_EXIT_CODE=$?
+
+echo "🌐 API call status: $HTTP_STATUS"
+
+if [ $CURL_EXIT_CODE -ne 0 ]; then
+  echo "❌ Error: curl request failed with exit code $CURL_EXIT_CODE"
+  echo "Error details: $(cat /tmp/curl_error.log)"
+  exit 1
+fi
+
+if [ "$HTTP_STATUS" -ne 200 ]; then
+  echo "❌ Error: API returned HTTP status $HTTP_STATUS"
+  echo "Response: $(cat /tmp/curl_output.json)"
+  exit 1
+fi
+
+PR_LIST_RESPONSE=$(cat /tmp/curl_output.json)
+
+# Clean invalid control characters from JSON response
+if ! echo "$PR_LIST_RESPONSE" | jq . >/dev/null 2>&1; then
+  echo "⚠️  Invalid JSON detected — cleaning control characters..."
+  PR_LIST_RESPONSE=$(echo "$PR_LIST_RESPONSE" | tr -d '\000-\037')
+
+  if ! echo "$PR_LIST_RESPONSE" | jq . >/dev/null 2>&1; then
+    echo "$PR_LIST_RESPONSE" > /tmp/invalid_json_debug.json
+    echo "❌ Error: JSON is still invalid after cleaning control characters"
+    echo "💡 Use 'cat /tmp/invalid_json_debug.json' to inspect the JSON"
+    exit 1
+  fi
+fi
+
+PR_MERGED_COUNT=$(echo "$PR_LIST_RESPONSE" | jq '.total_count')
+
+# Color codes
+GREEN='\033[0;32m'
+YELLOW='\033[0;33m'
+NOCOLOR='\033[0m'
+
+echo "=============================================================================="
+echo -e "Found ${GREEN}$PR_MERGED_COUNT${NOCOLOR} PR(s) merged into $SOURCE_BRANCH (filter: $DATE_FILTER)"
+echo "=============================================================================="
+echo -e "## ${GREEN}CHANGELOG${NOCOLOR}"
+echo "$PR_LIST_RESPONSE" | jq -r '.items[] | (.title) + " (" + (.user.login) + ") [#" + (.number | tostring) + "]"' | sort
+printf "\n"
+echo "=============================================================================="
+echo -e "${GREEN}GitHub Search URL (to verify, if required)${NOCOLOR}"
+BRANCH_ENCODED=$(echo "$SOURCE_BRANCH" | sed 's/ /%20/g')
+echo "https://github.com/$REPO/pulls?q=NOT+%22Parent+branch+sync%22+in%3Atitle+is%3Apr+is%3Amerged+base%3A$BRANCH_ENCODED+merged%3A$DATE_FILTER+-author%3Aapp%2Fdistributed-gitflow-app"
+echo "=============================================================================="
+
+# Clean up temporary files
+rm -f /tmp/curl_output.json /tmp/curl_error.log

.github/workflows/build.yml

@@ -14,19 +14,19 @@ jobs:
         run: corepack enable
       - name: Cache node modules
         id: cache-nodemodules
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         env:
           cache-name: cache-node-modules
         with:
           path: node_modules
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-name }}-
             ${{ runner.os }}-build-
             ${{ runner.os }}-
       - name: Install dependencies
         if: steps.cache-nodemodules.outputs.cache-hit != 'true'
-        run: yarn install
+        run: yarn install --frozen-lockfile
       - name: Linter
         run: yarn run eslint
       - name: Yarn Tests

.github/workflows/pr-lint.yml

@@ -0,0 +1,13 @@
+name: Common PR Lint
+
+on:
+  pull_request:
+    branches: [master, main,staging, dev,develop]
+    types: [ready_for_review, reopened, review_requested, review_request_removed, opened, edited]
+
+jobs:
+  pr-lint:
+    name: Common PR Lint Checks
+    if: github.base_ref == 'main' || github.base_ref == 'master'
+    uses: chargebee/cb-cicd-pipelines/.github/workflows/pr-lint.yml@main
+    secrets: inherit

.github/workflows/pr-size-check.yml

@@ -0,0 +1,81 @@
+name: PR Size Check
+on:
+  pull_request:
+    types: [ reopened, opened, synchronize, edited, labeled, unlabeled ]
+    branches:
+      - master
+
+
+jobs:
+  pre-approval-comment:
+    name: Announce pending bypass approval
+    if: ${{ github.event.pull_request.user.login != 'distributed-gitflow-app[bot]' &&
+      !startsWith(github.head_ref, 'revert-') &&
+      !startsWith(github.head_ref, 'parent-branch-sync/') &&
+      contains(github.event.pull_request.labels.*.name, 'pr-size-exception') }}
+    runs-on: graviton-small-runner
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const issue_number = context.payload.pull_request.number;
+
+            const marker = '<!-- pr-size-bypass-pending -->';
+            const pending = `${marker}
+              🛑 The \`pr-size-exception\` label is present. This workflow is **waiting for approvals** from the **[cb-Billing-CAB-reviewers](https://github.com/orgs/chargebee/teams/cb-billing-cab-approvers)**.`;
+
+            // create a new comment when the workflow runs
+            await github.rest.issues.createComment({ owner, repo, issue_number, body: pending });
+  pr-size-check:
+    name: Check PR size
+    if: ${{ (github.base_ref == 'master') && github.event.pull_request.user.login != 'distributed-gitflow-app[bot]' && !startsWith(github.head_ref, 'revert-') && !startsWith(github.head_ref, 'parent-branch-sync/') }}
+    runs-on: graviton-small-runner
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
+    env:
+      BYPASS_LABEL: pr-size-exception
+    environment: ${{ contains(github.event.pull_request.labels.*.name, 'pr-size-exception') && 'cb-billing-reviewers' || '' }}
+    steps:
+      - uses: chargebee/cb-cicd-pipelines/.github/actions/pr-size-check@v4.20.3
+        if: ${{ !contains(github.event.pull_request.labels.*.name, env.BYPASS_LABEL) }}
+        with:
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+          errorSize: 250
+          warningSize: 200
+          excludePaths: |
+            .github/**
+            .cursor/**
+
+
+      - name: Ensure required check passes when bypassed
+        if: ${{ contains(github.event.pull_request.labels.*.name, env.BYPASS_LABEL) }}
+        run: echo "Bypass active — marking job successful."
+
+      - name: Configure OIDC authentication
+        if: ${{ contains(github.event.pull_request.labels.*.name, env.BYPASS_LABEL) }}
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::127322177288:role/OIDC_S3
+          role-session-name: GithubActionsSession
+          role-duration-seconds: 900
+          aws-region: us-east-1
+
+      - name: Record bypass approval to S3
+        if: ${{ contains(github.event.pull_request.labels.*.name, env.BYPASS_LABEL) }}
+        run: |
+          REPO="${{ github.repository }}"
+          PR_LINK="https://github.com/${{ github.repository }}/pull/${{ github.event.pull_request.number }}"
+          DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+          WF_ID="${{ github.run_id }}"
+          S3_KEY="${REPO}/datas/${WF_ID}.json"
+          printf '{"repo":"%s","date":"%s","pr_link":"%s","wf_id":"%s"}\n' "$REPO" "$DATE" "$PR_LINK" "$WF_ID" | \
+            aws s3 cp - "s3://prsizebypassdata/${S3_KEY}" --content-type application/json
+          echo "Recorded to s3://prsizebypassdata/${S3_KEY}"

.github/workflows/release.yml

@@ -4,6 +4,10 @@ on:
     branches: 
       - master
       - next
+    paths-ignore:
+      - 'CHANGELOG.md'
+      - 'package-lock.json'
+      - 'package.json'
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -26,14 +30,14 @@ jobs:
           cache-name: cache-node-modules
         with:
           path: node_modules
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-build-${{ env.cache-name }}-
             ${{ runner.os }}-build-
             ${{ runner.os }}-
       - name: Install dependencies
         if: steps.cache-nodemodules.outputs.cache-hit != 'true'
-        run: yarn install
+        run: yarn install --frozen-lockfile
       - name: Initialize NPM config
         run: |
             npm config set registry=https://registry.npmjs.com/
@@ -51,7 +55,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Release package
         if: github.ref == 'refs/heads/master'
-        run: npm run release -- --ci -VV
+        run: npm run release -- --ci -VV 
         env: 
           NPM_TOKEN: ${{ secrets.RN_SDK_NPM_WRITE_TOKEN_2 }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  

.github/workflows/secret.scan.yml

@@ -0,0 +1,32 @@
+name: CB Secret PR Scan
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  scan:
+    name: Secret PR Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get the file name changed in the PR
+        id: pr_files
+        run: |
+          changed_files=$(curl -s -H "Authorization: token ${{
+          secrets.GITHUB_TOKEN }}" \
+            -H "Accept: application/vnd.github.v3+json" \
+            https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files | jq -r '.[].filename')
+          echo "Changed files: $changed_files"
+
+          echo "CHANGED_FILES<<EOF"$'\n'"$changed_files"$'\n'EOF >> $GITHUB_OUTPUT
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
+          GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          GITLEAKS_LICENSE: '${{ secrets.GITLEAKS_LICENSE }}'
+          GITLEAKS_ENABLE_SUMMARY: false

CHANGELOG.md

@@ -161,4 +161,4 @@
 * handles subscription and plan id as mandatory in purchase product api ([aa0bf7c](https://github.com/chargebee/chargebee-react-native/commit/aa0bf7cecec105b7ea8e3350e70a5fa88617c35d))
 
 ### BREAKING CHANGES
-* Adds In-App Purchase support
+* Adds In-App Purchase support

README.md

@@ -1,3 +1,7 @@
+> [!WARNING]  
+> **Chargebee React Native SDK** is part of Chargebee's legacy Mobile Subscription Solution and will not include the latest enhancements. We recommend using Chargebee's new [Omnichannel Subscriptions](https://www.chargebee.com/docs/billing/2.0/mobile-subscriptions/omnichannel-subscription-overview) solution for improved reliability and unified mobile subscriptions experience. 
+If you are a new customer, or considering to migrate new solution, please reach out to support@chargebee.com or contact your Technical Success Manager (TSM) for guidance.
+
 ![Latest Release](https://github.com/chargebee/chargebee-react-native/actions/workflows/release.yml/badge.svg?branch=master)
 
 > [!NOTE]