Make Dependabot updates safe, fix stale AutoFill UniFFI bindings

.github/dependabot.yml

@@ -1,14 +1,26 @@
-# Dependabot keeps dependencies patched across all three ecosystems the app
-# ships from: the JS frontend (npm, repo root), the Rust backend (cargo,
-# src-tauri/), and the CI/release workflows themselves (github-actions).
+# Dependabot keeps dependencies patched across the ecosystems the app ships
+# from: the JS frontend (npm, repo root), the Rust backend (cargo,
+# src-tauri/), the browser extension (npm, extension/), and the CI/release
+# workflows themselves (github-actions).
 # All PRs target main (the default branch); release branches are cut from it.
+#
+# Each PR is tested against main alone, never alongside the others, so merging
+# several in a row can still break main. Safe bumps are therefore grouped into
+# one PR per ecosystem, and anything that can break the API arrives on its own
+# PR, to be landed together with the code it needs.
+#
+# A dependency joins the first group it matches, so the release-train groups
+# come before the catch-all ones.
 version: 2
 updates:
   # JS/TS frontend — package.json / bun.lock at the repo root.
   - package-ecosystem: npm
     directory: /
     schedule:
       interval: weekly
+    # A release has a week to be yanked before it is proposed.
+    cooldown:
+      default-days: 7
     target-branch: main
     open-pull-requests-limit: 10
     labels:
@@ -24,12 +36,20 @@ updates:
       tauri-js:
         patterns:
           - '@tauri-apps/*'
+      npm-minor-patch:
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch
 
   # Rust backend — src-tauri/Cargo.toml + Cargo.lock.
   - package-ecosystem: cargo
     directory: /src-tauri
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     target-branch: main
     open-pull-requests-limit: 10
     labels:
@@ -45,6 +65,14 @@ updates:
       passkey-rs:
         patterns:
           - 'passkey-*'
+      # Patch only: Dependabot calls 0.29 -> 0.32 a minor update, but below
+      # 1.0 Cargo treats it as breaking (uniffi, passkey-rs and
+      # windows-registry all broke this way), so minors arrive one per PR.
+      cargo-patch:
+        patterns:
+          - '*'
+        update-types:
+          - patch
     ignore:
       # passkey-rs requires p256 ^0.13. 0.14 would link a second copy and
       # break the COSE key bridge. Lift once passkey-rs moves to p256 0.14.
@@ -59,14 +87,46 @@ updates:
       # bump leaves two rand generations and breaks every RNG handoff.
       - dependency-name: rand
         versions: ['>=0.9']
+      # libc 0.2.190 gates mach_task_self() to macOS, but num_threads 0.1.7
+      # (via time -> tauri) still calls it on iOS, so the iOS build fails.
+      # Drop once a later libc or num_threads release builds for iOS again.
+      - dependency-name: libc
+        versions: ['0.2.190']
+
+  # Browser extension — extension/package.json + package-lock.json. A fork of
+  # KeePassXC-Browser with dev-only tooling, so one monthly PR is enough.
+  - package-ecosystem: npm
+    directory: /extension
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 7
+    target-branch: main
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - javascript
+    groups:
+      extension:
+        patterns:
+          - '*'
 
   # GitHub Actions used by ci.yml / release.yml / codeql.yml.
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     target-branch: main
     open-pull-requests-limit: 10
     labels:
       - dependencies
       - ci
+    groups:
+      actions-minor-patch:
+        patterns:
+          - '*'
+        update-types:
+          - minor
+          - patch

.github/workflows/ci.yml

@@ -220,6 +220,23 @@ jobs:
         working-directory: src-tauri
         run: cargo clippy --target aarch64-apple-ios-sim --all-targets -- -D warnings
 
+      # The AutoFill extension's Swift bindings are committed, and UniFFI checks
+      # them against the library on load: a stale copy builds fine and then
+      # aborts the extension at its first Rust call. A doc-comment edit
+      # (114c3458) and a uniffi bump (#563) each shipped one.
+      - name: AutoFill UniFFI bindings are current
+        run: |
+          set -euo pipefail
+          sh src-tauri/crates/autofill/bindgen.sh
+          # status, not diff: a deleted file comes back untracked, which diff misses.
+          generated=src-tauri/gen/apple/Sources/autofill/generated
+          if [ -n "$(git status --porcelain -- "$generated")" ]; then
+            git status --short -- "$generated"
+            git diff -- "$generated"
+            echo '::error::Stale UniFFI bindings: run src-tauri/crates/autofill/bindgen.sh and commit what it writes'
+            exit 1
+          fi
+
       # Malformed XML in any of these only surfaces at build or upload time
       # otherwise, and a dropped privacy manifest is not an error at all — App
       # Store Connect just rejects the submission by email days later.

src-tauri/crates/autofill/bindgen.sh

@@ -14,6 +14,10 @@
 # `uniffi-bindgen` binary in this crate (the version the runtime is). Built for
 # the host — the bindings are the same for every target. Honours
 # CARGO_TARGET_DIR like any cargo command.
+#
+# CI re-runs this and fails on any difference (the `ios` job in ci.yml), so the
+# output must not depend on the machine: `--no-format` keeps whatever
+# swift-format the local Xcode ships out of it.
 set -eu
 
 cd "$(dirname "$0")/../.."
@@ -23,4 +27,4 @@ out=gen/apple/Sources/autofill/generated
 cargo build -p rowel-autofill
 cargo run -q -p rowel-autofill --features bindgen --bin uniffi-bindgen -- \
   generate --library "$target_dir/debug/librowel_autofill.a" \
-  --language swift --out-dir "$out"
+  --language swift --no-format --out-dir "$out"