ci(validation): harden post-release checks

.github/dependabot.yml

@@ -7,7 +7,7 @@ updates:
       day: monday
       time: '03:00'
       timezone: Asia/Shanghai
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 3
     groups:
       development-dependencies:
         dependency-type: development
@@ -22,7 +22,14 @@ updates:
       day: monday
       time: '03:30'
       timezone: Asia/Shanghai
-    open-pull-requests-limit: 3
+    open-pull-requests-limit: 2
+    groups:
+      ruby-toolchain:
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch
 
   - package-ecosystem: github-actions
     directory: /
@@ -31,4 +38,11 @@ updates:
       day: monday
       time: '04:00'
       timezone: Asia/Shanghai
-    open-pull-requests-limit: 3
+    open-pull-requests-limit: 2
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch

.github/workflows/ci.yml

@@ -61,13 +61,17 @@ jobs:
                   site=true
                   web=true
                   ;;
+                .github/workflows/registry-canary.yml|scripts/test-registry-consumers.mjs)
+                  quality=true
+                  web=true
+                  ;;
                 src/**|assets/**)
                   android=true
                   ios=true
                   quality=true
                   web=true
                   ;;
-                cpp/fuzz/**|scripts/test-native-fuzz.sh)
+                cpp/fuzz/**|scripts/test-native-fuzz.sh|cpp/benchmark/**|scripts/benchmark-native.mjs|.github/workflows/native-benchmark.yml)
                   quality=true
                   ;;
                 cpp/**)
@@ -84,6 +88,10 @@ jobs:
                   android=true
                   quality=true
                   ;;
+                compatibility/ios-api/**|scripts/test-rn-ios-compatibility.sh)
+                  ios=true
+                  quality=true
+                  ;;
                 ios/**|example/ios/**|*.podspec)
                   ios=true
                   quality=true
@@ -190,15 +198,15 @@ jobs:
 
       - name: Upload Android reports
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: Android-Build-Reports-new-arch-${{ matrix.new-arch }}
           path: example/android/**/build/reports
           if-no-files-found: ignore
           retention-days: 7
 
       - name: Upload APK
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: app-release-${{ github.sha }}-new-arch-${{ matrix.new-arch }}
           path: example/android/app-release-${{ github.sha }}-new-arch-${{ matrix.new-arch }}.apk
@@ -256,7 +264,7 @@ jobs:
 
       - name: Upload instrumentation reports
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: New-Arch-Runtime-Test-Reports-${{ matrix.api-level }}
           path: |
@@ -316,12 +324,12 @@ jobs:
       - name: Set up Ruby
         uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
         with:
-          ruby-version: '3.0'
+          ruby-version: '3.3'
           bundler-cache: true
           working-directory: example
 
       - name: Cache Pods
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             example/ios/Pods
@@ -354,17 +362,65 @@ jobs:
         run: |
           set -o pipefail
           cd example/ios
-          xcodebuild -workspace BsDiffPatchExample.xcworkspace -scheme BsDiffPatchExample -configuration Release -sdk iphonesimulator -destination "platform=iOS Simulator,id=$SIMULATOR_UDID" -resultBundlePath "$RUNNER_TEMP/ios-tests.xcresult" test | bundle exec xcpretty
+          xcodebuild \
+            -workspace BsDiffPatchExample.xcworkspace \
+            -scheme BsDiffPatchExample \
+            -configuration Release \
+            -sdk iphonesimulator \
+            -destination "platform=iOS Simulator,id=$SIMULATOR_UDID" \
+            -resultBundlePath "$RUNNER_TEMP/ios-tests.xcresult" \
+            EXPECTED_NEW_ARCH=${{ matrix.new-arch }} \
+            GCC_PREPROCESSOR_DEFINITIONS='$(inherited) EXPECTED_NEW_ARCH=$(EXPECTED_NEW_ARCH)' \
+            test | bundle exec xcpretty
 
       - name: Upload iOS test results
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: iOS-Test-Results-new-arch-${{ matrix.new-arch }}
           path: ${{ runner.temp }}/ios-tests.xcresult
           if-no-files-found: ignore
           retention-days: 7
 
+  ios-rn-compatibility:
+    name: iOS RN API Compatibility (${{ matrix.react-native }})
+    needs: changes
+    if: needs.changes.outputs.ios == 'true'
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: true
+      max-parallel: 2
+      matrix:
+        include:
+          - react-native: '0.73.11'
+            node: '18'
+            runner: macos-14
+          - react-native: '0.74.7'
+            node: '18'
+            runner: macos-14
+          - react-native: '0.86.0'
+            node: '22'
+            runner: macos-15
+    steps:
+      - name: Checkout the code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: ${{ matrix.node }}
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
+        with:
+          ruby-version: '3.3'
+          bundler-cache: true
+          working-directory: example
+
+      - name: Compile Pod against React Native iOS APIs
+        run: sh scripts/test-rn-ios-compatibility.sh ${{ matrix.react-native }}
+
   web-test:
     name: Web WASM and Browser Test
     needs: changes
@@ -447,6 +503,7 @@ jobs:
         android-api-level-test,
         android-rn-compatibility,
         ios-build-test,
+        ios-rn-compatibility,
         web-test,
         site-test,
       ]

.github/workflows/native-benchmark.yml

@@ -0,0 +1,44 @@
+name: Native Core Benchmark
+
+on:
+  schedule:
+    - cron: '23 5 * * 3'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: native-core-benchmark
+  cancel-in-progress: true
+
+jobs:
+  benchmark:
+    name: Native core (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-14]
+    steps:
+      - name: Checkout the code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version-file: .nvmrc
+
+      - name: Run deterministic benchmark
+        env:
+          BENCHMARK_OUTPUT: native-core-${{ runner.os }}.json
+        run: node scripts/benchmark-native.mjs
+
+      - name: Upload benchmark report
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: native-core-${{ runner.os }}
+          path: native-core-${{ runner.os }}.json
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/pages.yml

@@ -55,7 +55,7 @@ jobs:
         run: yarn site:test:browser
 
       - name: Configure GitHub Pages
-        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Upload GitHub Pages artifact
         uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4

.github/workflows/registry-canary.yml

@@ -0,0 +1,43 @@
+name: Registry Consumer Canary
+
+on:
+  schedule:
+    - cron: '41 4 * * 3'
+  workflow_dispatch:
+    inputs:
+      package_spec:
+        description: npm package spec to validate
+        required: false
+        default: react-native-bs-diff-patch@latest
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: registry-canary
+  cancel-in-progress: true
+
+jobs:
+  consumer:
+    name: ${{ matrix.consumer }} consumer
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        consumer: [vite, expo]
+    steps:
+      - name: Checkout the code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '22'
+          registry-url: https://registry.npmjs.org
+
+      - name: Test published package consumer
+        env:
+          PACKAGE_SPEC: ${{ inputs.package_spec || 'react-native-bs-diff-patch@latest' }}
+        run: node scripts/test-registry-consumers.mjs ${{ matrix.consumer }}

benchmarks/native-core.json

@@ -0,0 +1,35 @@
+{
+  "generatedAt": "2026-07-19T07:41:42.795Z",
+  "runtime": {
+    "cpu": "Apple M3 Pro",
+    "compiler": "Apple clang version 17.0.0 (clang-1700.6.3.2)",
+    "platform": "darwin-arm64"
+  },
+  "workload": {
+    "description": "Deterministic files with one changed byte per 4 KiB",
+    "memoryMetric": "Peak resident set size for one diff and patch process"
+  },
+  "results": [
+    {
+      "sizeMiB": 1,
+      "diffMs": 149.7,
+      "patchMs": 4.8,
+      "patchBytes": 110,
+      "peakRssKiB": 21616
+    },
+    {
+      "sizeMiB": 10,
+      "diffMs": 4103.3,
+      "patchMs": 34.3,
+      "patchBytes": 118,
+      "peakRssKiB": 198224
+    },
+    {
+      "sizeMiB": 50,
+      "diffMs": 31852.3,
+      "patchMs": 199.7,
+      "patchBytes": 203,
+      "peakRssKiB": 983408
+    }
+  ]
+}

compatibility/ios-api/Podfile

@@ -0,0 +1,26 @@
+require Pod::Executable.execute_command('node', ['-p',
+  'require.resolve(
+    "react-native/scripts/react_native_pods.rb",
+    {paths: [process.argv[1]]},
+  )', __dir__]).strip
+
+platform :ios, min_ios_version_supported
+prepare_react_native_project!
+
+target 'BsDiffPatchExample' do
+  config = use_native_modules!
+
+  use_react_native!(
+    :path => config[:reactNativePath],
+    :app_path => "#{Pod::Config.instance.installation_root}/..",
+    :hermes_enabled => false
+  )
+
+  post_install do |installer|
+    react_native_post_install(
+      installer,
+      config[:reactNativePath],
+      :mac_catalyst_enabled => false
+    )
+  end
+end

compatibility/ios-api/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "react-native-bs-diff-patch-ios-compatibility",
+  "version": "0.0.0",
+  "private": true
+}