Merge branch 'main' into fix/60657

Author: dukenv0307

.github/actions/composite/announceFailedWorkflowInSlack/action.yml

@@ -13,7 +13,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: 8398a7/action-slack@v3
+    - uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e
       name: Job failed Slack notification
       with:
         status: custom

.github/actions/composite/setupNode/action.yml

@@ -23,7 +23,7 @@ runs:
       shell: bash
       run: jq 'del(.version, .packages[""].version)' package-lock.json > normalized-package-lock.json
 
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e #v4
       with:
         node-version-file: '.nvmrc'
         cache: npm

.github/workflows/androidBump.yml

@@ -9,9 +9,8 @@ on:
 jobs:
   android_bump:
     runs-on: ubuntu-latest
-
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
 
       - name: Setup Node
         uses: ./.github/actions/composite/setupNode
@@ -47,3 +46,22 @@ jobs:
           echo "HALTED: ${{ steps.checkAndroidStatus.outputs.HALTED }}"
           echo "ROLLOUT_PERCENTAGE: ${{ steps.checkAndroidStatus.outputs.ROLLOUT_PERCENTAGE }}"
           bundle exec fastlane android update_hybrid_rollout rollout:${{ steps.checkAndroidStatus.outputs.ROLLOUT_PERCENTAGE }}
+
+      - name: Warn deployers if Android rollout percentage could not be updated
+        if: ${{ failure() }}
+        # v3
+        uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e
+        with:
+          status: custom
+          custom_payload: |
+            {
+              channel: '#deployer',
+              attachments: [{
+                color: "#DB4545",
+                pretext: `<!subteam^S4TJJ3PSL>`,
+                text: `💥 Android rollout percentage could not be updated. <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run> 💥`,
+              }]
+            }
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

.github/workflows/deploy.yml

@@ -201,18 +201,33 @@ jobs:
         env:
           BROWSERSTACK: ${{ secrets.BROWSERSTACK }}
 
+      - name: Install bundletool
+        run: |
+          readonly BUNDLETOOL_VERSION="1.18.1"
+          readonly BUNDLETOOL_URL="https://github.com/google/bundletool/releases/download/${BUNDLETOOL_VERSION}/bundletool-all-${BUNDLETOOL_VERSION}.jar"
+
+          # Download jar from GitHub Release
+          curl -L -o bundletool.jar "$BUNDLETOOL_URL"
+
+          # Validate checksum
+          readonly EXPECTED_SHA="675786493983787ffa11550bdb7c0715679a44e1643f3ff980a529e9c822595c"
+          SHA="$(sha256sum bundletool.jar | cut -d ' ' -f1)"
+          if [[ "$SHA" != "$EXPECTED_SHA" ]]; then
+            echo "SHA mismatch: expected $EXPECTED_SHA but got $ACTUAL_SHA"
+            exit 1
+          fi
+
       - name: Generate APK from AAB
         run: |
-          json=$(curl -s https://api.github.com/repos/google/bundletool/releases/latest)
-          downloadUrl=$(echo "$json" | jq -r ".assets | .[].browser_download_url")
-          curl "$downloadUrl" -4 -sL -o 'bundletool.jar'
+          # Generate apks using bundletool
           java -jar bundletool.jar build-apks --bundle=${{ env.aabPath }} --output=Expensify.apks \
             --mode=universal \
             --ks=upload-key.keystore \
             --ks-pass=pass:${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEYSTORE_PASSWORD }} \
             --ks-key-alias=${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEYSTORE_ALIAS }} \
             --key-pass=pass:${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEY_PASSWORD }}
-          
+
+          # Unzip just the universal apk
           unzip -p Expensify.apks universal.apk > Expensify.apk
 
       - name: Upload Android APK build artifact
@@ -254,7 +269,7 @@ jobs:
               attachments: [{
                 color: "#DB4545",
                 pretext: `<!subteam^S4TJJ3PSL>`,
-                text: `💥 Android HybridApp production deploy failed. No need to do anything, Jules will <https://stackoverflowteams.com/c/expensify/questions/5738|manually submit> ${{ needs.prep.outputs.APP_VERSION }} in the <https://play.google.com/console/u/0/developers/8765590895836334604/app/4974129597497161901/releases/overview|Google Play Store>. 💥`,
+                text: `💥 Android HybridApp production <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|deploy run> failed. Please <https://stackoverflowteams.com/c/expensify/questions/5738|manually submit> ${{ needs.prep.outputs.APP_VERSION }} in the <https://play.google.com/console/u/0/developers/8765590895836334604/app/4974129597497161901/releases/overview|Google Play Store>. 💥 But first check the workflow, it's likely that the release was successful and <https://github.com/Expensify/Expensify/issues/488492|this error> is occuring)`,
               }]
             }
         env:
@@ -623,7 +638,7 @@ jobs:
           gh release create ${{ needs.prep.outputs.TAG }} ${{ github.ref == 'refs/heads/staging' && '--prerelease' || '' }} \
             --repo ${{ github.repository }} \
             --title ${{ needs.prep.outputs.TAG }} \
-            --notes-start-tag ${{ steps.get_last_prod_version.outputs.LAST_PROD_VERSION }} \
+            ${{ github.ref == 'refs/heads/production' && format('--notes-start-tag {0}', steps.get_last_prod_version.outputs.LAST_PROD_VERSION) || '' }} \
             --generate-notes \
             --verify-tag \
             --target ${{ github.ref }}

.github/workflows/e2ePerformanceTests.yml

@@ -28,7 +28,7 @@ jobs:
       DELTA_REF: ${{ steps.getDeltaRef.outputs.DELTA_REF }}
       IS_PR_MERGED: ${{ steps.getPullRequestDetails.outputs.IS_MERGED }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
         with:
           fetch-depth: 0  # Fetches the entire history
 
@@ -106,7 +106,7 @@ jobs:
     if: ${{ always() }}
     name: Run E2E tests in AWS device farm
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
         with:
           # The OS_BOTIFY_COMMIT_TOKEN is a personal access token tied to osbotify (we need a PAT to access the artifact API)
           token: ${{ secrets.OS_BOTIFY_COMMIT_TOKEN }}
@@ -315,7 +315,7 @@ jobs:
     if: ${{ always() && needs.prep.outputs.IS_PR_MERGED != 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
 
       - name: Delete temporary merge branch created for delta ref
         run: git push -d origin ${{ needs.prep.outputs.DELTA_REF }}

.github/workflows/preDeploy.yml

@@ -25,7 +25,7 @@ jobs:
     if: ${{ always() }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
 
       - name: Announce failed workflow in Slack
         if: ${{ needs.typecheck.result == 'failure' || needs.lint.result == 'failure' || needs.test.result == 'failure' }}
@@ -47,7 +47,7 @@ jobs:
       SHOULD_DEPLOY: ${{ fromJSON(steps.shouldDeploy.outputs.SHOULD_DEPLOY) }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
 
       - name: Get merged pull request
         id: getMergedPullRequest

.github/workflows/proposalPolice.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     if: "!contains(fromJSON('[\"OSBotify\", \"imgbot[bot]\", \"melvin-bot[bot]\"]'), github.actor)"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
 
       # Checks if the comment is created and follows the template OR
       # if the comment is edited and if proposal template is followed.

.github/workflows/remote-build-android.yml

@@ -2,6 +2,8 @@ name: Remote Build Android
 
 on:
   workflow_dispatch:
+  push:
+    branches-ignore: [staging, production]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/reviewerChecklist.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.actor != 'OSBotify' && github.actor != 'imgbot[bot]'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
 
       - name: reviewerChecklist.js
         uses: ./.github/actions/javascript/reviewerChecklist

.github/workflows/test.yml

@@ -50,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Storybook tests
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
 
       - uses: ./.github/actions/composite/setupNode
 

.github/workflows/typecheck.yml

@@ -16,7 +16,7 @@ jobs:
     if: ${{ github.actor != 'OSBotify' || github.event_name == 'workflow_call' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
 
       - uses: ./.github/actions/composite/setupNode
         with:

.github/workflows/validateDocsRoutes.yml

@@ -11,7 +11,7 @@ jobs:
     if: github.actor != 'OSBotify' && github.actor != 'imgbot[bot]'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
 
       - uses: ./.github/actions/composite/setupNode
 

.github/workflows/verifySignedCommits.yml

@@ -9,7 +9,7 @@ jobs:
   verifySignedCommits:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
 
       - name: Verify signed commits
         uses: ./.github/actions/javascript/verifySignedCommits

Mobile-Expensify

@@ -114,8 +114,8 @@ android {
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
         multiDexEnabled rootProject.ext.multiDexEnabled
-        versionCode 1009014001
-        versionName "9.1.40-1"
+        versionCode 1009014200
+        versionName "9.1.42-0"
         // Supported language variants must be declared here to avoid from being removed during the compilation.
         // This also helps us to not include unnecessary language variants in the APK.
         resConfigs "en", "es"

android/app/build.gradle

@@ -54,9 +54,9 @@ If your business operates out of the U.K., you can enable global reimbursements
 This is a signed document authorizing a client’s bank to pull payments via direct debit.
 
 1. Expensify will send you a **Direct Debit Authorization** form to sign.
-3. Send the signed authorization form to your bank.
-4. Return the signed authorization form to Expensify.
-5. Once the account is set up for direct debits (typically takes 10 to 12 business days to complete), communicate to Expensify support that is complete.
+2. Send the signed authorization form to your bank.
+3. Return the signed authorization form to Expensify.
+4. Once the account is set up for direct debits (typically takes 10 to 12 business days to complete), communicate to Expensify support that is complete.
 
 ---
 

docs/articles/expensify-classic/bank-accounts-and-payments/payments/Global-Reimbursement-UK.md

@@ -1,25 +1,34 @@
 ---
 title: Set Time and Distance Rates
-description: Set rates for hourly and Distance expenses
-keywords: [Expensify Classic, distance rates, time rates]
+description: Configure default hourly and mileage reimbursement rates at the workspace level for consistent billing and expense tracking.
+keywords: [Expensify Classic, distance rates, mileage rates, time tracking, hourly rates, workspace settings]
 ---
 <div id="expensify-classic" markdown="1">
 
-You can set default rates at the workspace level to track employees' billable time and mileage expenses. Configuring these settings will ensure consistent reimbursement calculations and accurate billing for your team. 
+Set default rates at the workspace level to track billable time and mileage expenses. This ensures accurate and consistent reimbursement for your team.
 
 ---
 
-# Set Time and Distance Rates  
-
-Head to **Settings > Workspace > [Workspace Name] > Distance rates:** 
-   - **For distance:**  
-      - If desired, adjust your **unit** (miles or kilometers) and your **default category**. These options will apply to all of your distance rates.  
-      - To add a new rate, click **Add a Mileage Rate**.  
-      - To edit an existing rate:  
-         - Click the toggle to enable or disable the rate.  
-         - Click the **name** or **rate** field to make changes.  
-   - **For time:**  
-      - Click the **enable** toggle to enable hourly rate expenses.  
-      - Enter the **default hourly rate**.  
+# Distance Rates
+
+To configure mileage reimbursement:
+
+1. Go to **Settings > Workspaces > [Workspace Name] > Distance rates**
+2. Adjust your **unit** (miles or kilometers) and your **default category**—these apply to all distance rates.
+3. Click **Add a Mileage Rate** to create a new rate.
+
+## Edit an Existing Rate
+1. Toggle the switch to enable or disable the rate.
+2. Click the **name** or **rate** field to make changes.
+
+---
+
+# Time Expenses
+
+To enable hourly rate reimbursement:
+
+1. Go to **Settings > Workspaces > [Workspace Name] > Distance rates**
+2. Toggle **Enable hourly rate expenses**
+3. Enter the **default hourly rate**
 
 </div>

docs/articles/expensify-classic/reports/Set-default-report-title.md renamed to docs/articles/expensify-classic/reports/Set-Custom-Report-Names.md

@@ -0,0 +1,70 @@
+---
+title: Prohibited Expenses Rule
+description: Learn how to enable and use the Prohibited expenses rule to automatically flag receipts with restricted items such as alcohol, gambling, or tobacco.
+keywords: [prohibited expenses, receipt violation, SmartScan, alcohol, gambling, expense rules, workspace settings, line item compliance]
+---
+<div id="new-expensify" markdown="1">
+
+Enable the **Prohibited expenses** rule to automatically flag receipts containing restricted purchases like alcohol, gambling, or tobacco. This rule uses Expensify’s AI-powered SmartScan to detect violations at the line-item level and notify admins for review.
+
+# Prohibited Expense Rule
+
+The Prohibited expenses rule allows Workspace Admins to enforce compliance by flagging receipts that contain restricted items. SmartScan analyzes individual line items and applies violations when prohibited categories are detected.
+
+## How it works
+
+Once enabled, this rule uses AI to review receipt line items during SmartScan. If a prohibited item is found, the expense is flagged for review.
+
+- Available in both Expensify Classic and New Expensify.
+- Configuration is only available in New Expensify.
+- Automatically flags receipts for manual review by a Workspace Admin or approver.
+
+## How to enable the rule
+
+To turn on the Prohibited expenses rule:
+
+1. Go to **Settings** > **Workspaces** > click _Workspace Name_ > **Rules** > **Expenses**.
+2. Scroll to the section titled **Prohibited expenses**.
+3. Toggle on the rule.
+4. Select the prohibited categories you want to monitor:
+   - Adult entertainment
+   - Alcohol
+   - Gambling
+   - Hotel incidentals
+   - Tobacco
+
+**Note:** This rule is disabled by default. Admins must enable it and choose which categories to apply.
+
+## What happens when a prohibited item is detected?
+
+If a SmartScan detects a prohibited item:
+
+- A violation is added to the expense.
+- The expense displays the messages:
+  - `"Receipt Issue Found"`
+  - `"Prohibited expense: Alcohol"` (or the relevant flagged category).
+- The expense requires manual review by the approver.
+
+---
+
+# FAQ
+
+## Who can enable the Prohibited Expenses Rule?
+
+Only Workspace Admins can enable or adjust this rule in New Expensify.
+
+## Will violations appear in Expensify Classic?
+
+Yes. Even though configuration is handled in New Expensify, violations appear in both **Expensify Classic** and **New Expensify** when viewing expenses.
+
+If the Domain Group setting, **Strictly enforce expense workspace rules** is enabled, it will block the submission of the expense with the prohibited item violation. 
+
+## Will SmartScan still work if the rule is off?
+
+Yes. SmartScan will still extract the merchant, date, and amount. However, it will not flag line items for violations unless the rule is enabled.
+
+## Is this rule part of SmartScan?
+
+Yes. Once enabled, the rule works seamlessly with SmartScan to detect prohibited line items in all scanned receipts.
+
+</div>

docs/articles/expensify-classic/workspaces/Set-time-and-distance-rates.md

@@ -30,6 +30,22 @@ Once Rules are enabled, you can customize individual expense settings:
 - **Billable default**: Set expenses as billable or non-billable by default.
 - **eReceipts**: Enable eReceipts for most USD credit transactions. This is available when the Default currency set in the Overview is set to USD.
 
+# Configure Prohibited Expense Rule
+
+To flag restricted expense types for manual review:
+
+1. Go to **Settings** > **Workspaces** > click **Workspace Name** > **Rules** > **Expenses**.
+2. Scroll to the **Prohibited expenses** section.
+3. Toggle on the feature, then select the types of restricted items to flag:
+   - Alcohol  
+   - Gambling  
+   - Tobacco  
+   - Hotel incidentals  
+   - Adult entertainment  
+4. If an uploaded receipt contains any of the flagged items, the expense will be marked for manual review.
+
+**Note:** Prohibited expense violations appear in both New Expensify and Expensify Classic. However, a Workspace Admin must enable the rules in **New Expensify** for them to take effect.
+
 # Configure expense report rules
 
 1. Click **Rules** in the left menu.