chore(release): 1.1.0-rc.0 (SDKS-5327, SDKS-5436) by tsdamas · Pull Request #71 · ForgeRock/ping-react-native-sdk

tsdamas · 2026-09-11T23:47:03Z

Summary

Release candidate for the 1.1.0 SDK drop. This PR migrates security scanning from the retired Mend GitHub App to orchestrated Mend CLI workflows, remediates transitive CVEs via dependency resolutions, makes rn-davinci publishable, and hardens the E2E suites (Detox on Android, XCUITest on iOS/BrowserStack) with new DaVinci hook coverage and session-isolation fixes.

Changes

Security scanning (Mend CLI migration)

Add three reusable sub-workflows wired into ci.yml, replacing the retired Mend GitHub App integration (SDKS-5436):
- mend-prepare-workspace.yml — builds a pruned workspace containing only packages/* (the published SDKs) with a generated root manifest that preserves packageManager, engines, and resolutions, then re-resolves the real yarn.lock so scanned versions match what CI tests.
- mend-sca-scan.yml — dependency scan of the pruned workspace; publishes severity counts, a badge, and the "Mend SCA Report" check run.
- mend-sast-scan.yml — SAST + secrets scan with JSON report parsing and a "Mend SAST Report" check run.
Both scan workflows skip fork PRs
SAST raw output (which can contain matched secret values) is deliberately excluded from job summaries and check-run text; it is only available as a 1-day-retention artifact.
.whitesource: set reopenClosedIssues: true so closed dependency findings re-open when reintroduced.

Dependencies

Remediate transitive CVE findings: bump js-yaml resolution to 4.3.2 and add decode-uri-component at 0.5.0, with lockfile re-resolution.

E2E: new DaVinci hook coverage

Add PingTestRunner/e2e/use-davinci.test.ts (Detox) and UseDaVinciUITests.swift (XCUITest) covering the useDaVinci + useDaVinciForm hook API: form rendering, login via next(), and post-login token/userinfo/refresh/revoke/logout state transitions.
Extend UseDaVinciScenario.tsx: surface client-configuration errors through a use-davinci-error marker instead of tearing down the RN tree, keep a successReached panel visible after revoke()/logoutUser() clear the node, and add a -PING_AUTOSTART debug aid.

E2E: session isolation and stability

iOS AppDelegate: with the new -PING_CLEAR_STORAGE launch arg, wipe HTTP cookie stores, WKWebsiteDataStore, and keychain items before RN boots, so each launch starts without a stale SSO session (the SDK's persisted cookies previously let the server resume a prior interaction and return SuccessNode instead of the login form).
Rename DaVinci launch args to the PINGONE_* namespace across scenarios, Detox tests, and the iOS BrowserStack workflow; add the PINGONE_* secrets to browserstack-e2e-ios.yml and pass them into the XCUITest build payload.
Give every DaVinci submit button a label-derived testID (davinci-submit-{label}) so multi-button flows (Sign On / Register / Trouble) can be targeted precisely; the first submit keeps the shared davinci-submit-btn alias.
Detox fixes: noRetryArgs so retries re-run only failed suites, explicit detoxExpect re-assertions after every waitFor (BrowserStack derives verdicts from expect calls, not polling), 10s spacing between consecutive shared-account logins on Android, an Android-correct submit selector (uppercase button text breaks by.text('Sign On')), reloadReactNative in journey callback test setups, longer net timeouts, and explicit waits around first-call RSA key generation in device-id tests.
XCUITest fixes: new EnvFileLoader reads the PingTestRunner .env for local runs (process env still wins on BrowserStack), shared login-spacing helper, and tapWhenReady/label-based submit targeting.

CI / build reliability

Raise the BrowserStack Android e2e timeout (55 → 60 min), iOS e2e timeout (60 → 70 min), Gradle daemon heap for the Android prep job (2 GB → 4 GB), and the local gradle.properties heap to match.
Update AGENTS.md CI table entry for the new Mend CLI scan scope.

Docs

packages/external-idp/README.md: clarify native vs. browser fallback per orchestration type (Journey is native-only except Apple Sign-In on Android; DaVinci falls back to the browser when a native provider SDK is not linked).

Testing

yarn packages:build, lint, typecheck, and unit tests pass locally.
Mend workflows exercised on this PR (SCA + SAST check runs present).
Detox Android and XCUITest iOS suites validated against live DaVinci and Journey environments on BrowserStack, including the new use-davinci scenarios.

coderabbitai · 2026-09-11T23:47:21Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 6469dc1c-964c-4f39-8581-d7699de7a07b

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-09-11T23:52:33Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.09%. Comparing base (b61a748) to head (61f0b60).

❌ Your project check has failed because the head coverage (71.09%) is below the target coverage (80.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff            @@
##               main      #71   +/-   ##
=========================================
  Coverage     71.09%   71.09%           
  Complexity      239      239           
=========================================
  Files           209      209           
  Lines         24592    24592           
  Branches       1175     1175           
=========================================
  Hits          17483    17483           
  Misses         6937     6937           
  Partials        172      172

Flag	Coverage Δ
android	`16.04% <ø> (ø)`
ios	`80.97% <ø> (ø)`
javascript	`70.48% <ø> (ø)`

Components	Coverage Δ
Bridge glue	`51.51% <ø> (ø)`
Pure logic	`80.86% <ø> (ø)`

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b61a748...61f0b60. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-09-11T23:52:49Z

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-09-24 00:02 UTC

…file re-resolution

…eporting

… fallback by orchestration type

…avoid login hang

…tests to avoid racing slow native bridge calls on BrowserStack

tsdamas · 2026-09-22T03:30:44Z

+  /// store is cleared. HTTPCookieStorage and keychain deletion are synchronous;
+  /// WKWebsiteDataStore removal is asynchronous and gates the completion.
+  private static func clearAuthStorage(completion: @escaping () -> Void) {
+    HTTPCookieStorage.shared.removeCookies(since: Date.distantPast)


The flagged rule is CWE-200 ("exposes sensitive information to an actor not explicitly authorized"), which Mend pattern-matches against cookie-store APIs is a false-positive. Nothing is read, logged, transmitted, or persisted here- no data crosses to any actor. The call's entire purpose is the opposite of exposure: destroying stale SSO cookies before test flows.

rodrigoareis

LGTM

…r scope in README

mend-for-github-com · 2026-09-22T22:14:56Z

❌ Suppression request failed: the comment text exceeds the maximum allowed length. Please shorten your comment and retry the /mend code suppress command.

Support token: a9299cce7f4e40bd988a3eca7a5bbb95

tsdamas · 2026-09-22T22:16:47Z

+  /// store is cleared. HTTPCookieStorage and keychain deletion are synchronous;
+  /// WKWebsiteDataStore removal is asynchronous and gates the completion.
+  private static func clearAuthStorage(completion: @escaping () -> Void) {
+    HTTPCookieStorage.shared.removeCookies(since: Date.distantPast)


/mend code suppress false-positive 14e8a0c4-ac8d-40ba-9aa0-458d297fc109 Nothing is read, logged, transmitted, or persisted here- no data crosses to any actor. The call's entire purpose is the opposite of exposure: destroying stale SSO cookies before test flows.

mend-for-github-com · 2026-09-22T22:16:50Z

✔️ Suppression completed

We successfully suppressed the finding.

CWE: CWE-200: Insecure Data Storage
Location: AppDelegate.swift:73

Support token: 138e74ee86774523a2d3698d70ccc719

pingidentity-gaurav

LGTM

tsdamas added the wip Working in progress, do not review. label Sep 11, 2026

tsdamas changed the title ~~chore(release): 1.1.0-rc.0 defect fixes~~ chore(release): 1.1.0-rc.0 Sep 16, 2026

tsdamas added 9 commits September 16, 2026 19:18

fix(deps): remediate transitive CVE findings via resolutions and lock…

1adf353

…file re-resolution

chore(mend): change config to reopen closed dependency issues

7546e8c

chore(rn-davinci): flip package from private to public

d8c5db8

chore(mend): migrate from github integration - poc

aeebfbf

fix(mend): move SCAN_DIR to job env and cache CLI install

939773c

fix(mend): move SCAN_DIR to job

c1c6f2f

chore(mend): split scan into orchestrated sub-workflows with result r…

cd7a5e0

…eporting

chore(mend): define secrets in sub-workflows

f4e372e

chore(e2e): improvements to iOS e2e automated testing

cf46577

tsdamas force-pushed the 1.1.0-rc.0 branch from 763a91c to cf46577 Compare September 17, 2026 02:20

tsdamas commented Sep 17, 2026

View reviewed changes

Comment thread PingTestRunner/ios/PingTestRunner/AppDelegate.swift

tsdamas added 7 commits September 17, 2026 09:52

fix(e2e): fix ios automated tests

9229a4e

chore(e2e): detox e2e improvements

bfe0299

chore(ci): increase e2e timeout

c4a741b

chore(external-idp): docs(rn-external-idp): clarify native vs browser…

4464296

… fallback by orchestration type

fix(e2e): fix davinci submit selector and space logins on android to …

0bbe0ef

…avoid login hang

fix(e2e): wait for result elements in device-id, storage, and logger …

94e0d8c

…tests to avoid racing slow native bridge calls on BrowserStack

fix(ci): raise Gradle daemon heap for BrowserStack Android prep

6f9de93

tsdamas changed the title ~~chore(release): 1.1.0-rc.0~~ chore(release): 1.1.0-rc.0 (SDKS-5327, SDKS-5436) Sep 22, 2026

tsdamas removed the wip Working in progress, do not review. label Sep 22, 2026

tsdamas requested review from pingidentity-gaurav and rodrigoareis September 22, 2026 03:29

tsdamas commented Sep 22, 2026

View reviewed changes

rodrigoareis approved these changes Sep 22, 2026

View reviewed changes

chore(rn-fido): clarify android.useFido2Client and client-level logge…

61f0b60

…r scope in README

tsdamas commented Sep 22, 2026

View reviewed changes

pingidentity-gaurav approved these changes Sep 23, 2026

View reviewed changes

tsdamas merged commit 70b2e1b into main Sep 24, 2026
26 of 27 checks passed

Navigation Menu

Repository navigation

chore(release): 1.1.0-rc.0 (SDKS-5327, SDKS-5436) - #71

chore(release): 1.1.0-rc.0 (SDKS-5327, SDKS-5436)#71
tsdamas merged 17 commits into
mainfrom
1.1.0-rc.0

tsdamas commented Sep 11, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 11, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Sep 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 11, 2026 •

edited

Loading

Uh oh!

Uh oh!

tsdamas Sep 22, 2026

Uh oh!

rodrigoareis left a comment

Uh oh!

mend-for-github-com Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

tsdamas Sep 22, 2026

Uh oh!

mend-for-github-com Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

pingidentity-gaurav left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Conversation

tsdamas commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Security scanning (Mend CLI migration)

Dependencies

E2E: new DaVinci hook coverage

E2E: session isolation and stability

CI / build reliability

Docs

Testing

Uh oh!

coderabbitai Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

tsdamas Sep 22, 2026

Choose a reason for hiding this comment

Uh oh!

rodrigoareis left a comment

Choose a reason for hiding this comment

Uh oh!

mend-for-github-com Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tsdamas Sep 22, 2026

Choose a reason for hiding this comment

Uh oh!

mend-for-github-com Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pingidentity-gaurav left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

tsdamas commented Sep 11, 2026 •

edited

Loading

coderabbitai Bot commented Sep 11, 2026 •

edited

Loading

codecov Bot commented Sep 11, 2026 •

edited

Loading

github-actions Bot commented Sep 11, 2026 •

edited

Loading

mend-for-github-com Bot commented Sep 22, 2026 •

edited

Loading

mend-for-github-com Bot commented Sep 22, 2026 •

edited

Loading