chore: group the react/next bumps, and make the local gates match CI

[msalvatti]

Two independent bits of repo tooling.

dependabot.yml — group react / react-dom / next. They are peer dependencies of one another and of the published package, so one PR per package moves a single dev dependency out of the range its siblings still declare: the install under test resolves to a combination no consumer could have, and the green check means nothing about the bump. The group also covers @types/react, @types/react-dom and @testing-library/react, all of which track React's version — @testing-library/react v16 declares react and react-dom as peers, so it moves with them or it is the next thing to break. The three currently-open individual PRs (#99, #87, #84) are closed in favour of the grouped one Dependabot will open on its next run.

scripts/verify-like-ci.sh — the gates CI runs, with CI's commands. A local check that merely resembles CI passes while CI fails. That happened three times in one review round: cargo hack without -D warnings, --all-features standing in for the feature matrix, and examples/ (a separate Cargo workspace, own lockfile) never built. Every command in the script is copied from a workflow step, with the step named above it.

The first revision of this file fell into its own trap, which the review caught — see the thread replies. The npm gate ran pnpm typecheck against a package locked by package-lock.json, and the examples gate ran cargo check where CI runs a build, clippy-as-error, and production builds of react-vite and nextjs. Both are now the CI steps verbatim, and examples is split into examples-rust / examples-web so neither half can be mistaken for the whole job.

Only coverage (opt-in, several minutes) and mutation (post-merge on main only) are omitted, and the header says so.

[Copilot]

Pull request overview

This PR improves repo maintenance and developer ergonomics by (1) reducing noisy/invalid Dependabot update combinations for React/Next peer-related packages, and (2) adding a local verification script intended to run the same gates (and flags) as CI to prevent “passes locally, fails in CI” loops.

Changes:

• Adds a scripts/verify-like-ci.sh helper to run CI-like checks locally, with named “gates”.
• Updates Dependabot config to group React/React DOM/Next (and related type packages) into a single update PR.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
scripts/verify-like-ci.sh	Introduces a local “CI-equivalent” verification script with multiple gates (fmt/clippy/test/hack/doc/examples/npm/coverage).
.github/dependabot.yml	Adds a Dependabot group to bump React/Next-related dependencies together.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

scripts/verify-like-ci.sh:32

• GATES defaulting is broken: GATES=("${@:-${ALL_GATES[@]}}") collapses all defaults into a single array element when no args are passed, so the loop sees one gate like "fmt clippy …" and exits as unknown. Use an explicit if $# -eq 0 branch to preserve array elements.

ALL_GATES=(fmt clippy test hack doc examples npm)
GATES=("${@:-${ALL_GATES[@]}}")

scripts/verify-like-ci.sh:81

• This npm gate doesn’t match CI: .github/workflows/ci.yml runs npm ci, npm run build:wasm, npm run build, npx tsc --noEmit, npm run lint, npx typedoc --emit none, then npm test (ci.yml:347-367). The script uses pnpm and different subcommands, so it can pass locally while CI fails (and requires pnpm to be installed).

gate_npm() {
  (cd packages/rust-auth && pnpm -s typecheck && pnpm -s lint && pnpm -s test:cov)
}

scripts/verify-like-ci.sh:77

• gate_examples is much weaker than the CI gate: the workflow’s examples job does cargo build --locked + cargo clippy … -D warnings, then builds the npm package and the frontend examples (react-vite + nextjs) (ci.yml:395-424). cargo check alone won’t catch clippy failures or the JS example build failures CI enforces.

gate_examples() { (cd examples && cargo check --workspace --locked); }

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

scripts/verify-like-ci.sh:133

• In gate_examples_web, the AUTH_* env vars are only applied to npm run build, but in CI they’re set for the entire “Build the nextjs example” step (so they also apply to npm ci). This means verify-like-ci.sh is not actually running the same command environment as CI for that gate.

    (cd examples/nextjs &&
      npm ci --no-audit --no-fund &&
      AUTH_ACCESS_TOKEN_SECRET=an-edge-ci-secret-key-0123456789abcdef \
        AUTH_BACKEND_URL=http://127.0.0.1:8080 \
        npm run build)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

scripts/verify-like-ci.sh:34

• The header claims coverage + mutation are "the only two CI gates this script omits" and that "Nothing else is omitted", but .github/workflows/ci.yml defines additional PR jobs (e.g. ts-rs-drift, wasm-*, supply-chain, invariants, public-api, fuzz-smoke, dogfood, e2e-browser). As written, the script can’t be described as running all CI gates; either include those jobs as gates here or update the header to accurately describe the subset it covers.

# Deliberately NOT in the default run, and the only two CI gates this script omits:
#   coverage   — available by name; several minutes, and the figure only matters pre-merge.
#   mutation   — never runs on a PR (post-merge on main only); use `cargo mutants` directly.
# Nothing else is omitted. A gate that cannot run in your environment must FAIL here rather
# than be skipped, because "it did not run" and "it passed" have to stay distinguishable.