chore: add React Doctor advisory scanning

.github/workflows/ci.yml

@@ -35,6 +35,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2

.github/workflows/react-doctor.yml

@@ -0,0 +1,34 @@
+name: React Doctor
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  statuses: write
+
+concurrency:
+  group: react-doctor-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  react-doctor:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: React Doctor
+        uses: millionco/react-doctor@0b4f4f4bd248a154e64eb508a48347f71154b3f3 # v2
+        with:
+          project: 'package,example'
+          blocking: none
+          scope: full

CONTRIBUTING.md

@@ -32,6 +32,30 @@ Thank you for your interest in contributing!
 | `bun run build` | Build the library with react-native-builder-bob |
 | `bun run nitrogen` | Run Nitrogen codegen (when specs are ready) |
 | `bun run format` | Format all files with Prettier |
+| `bun run doctor` | Run React Doctor locally |
+
+## React Doctor
+
+[React Doctor](https://www.react.doctor/docs) scans React and React Native code for security risks, performance regressions, effect misuse, and architecture issues. It complements ESLint — it does not replace lint, typecheck, or build checks.
+
+Run locally from the monorepo root:
+
+```bash
+bun run doctor
+# or
+npx react-doctor@latest
+```
+
+Both `package/` (library) and `example/` (Expo app) are included in scans.
+
+### CI behavior
+
+React Doctor runs in a separate GitHub Actions workflow (`.github/workflows/react-doctor.yml`):
+
+- **Pull requests:** posts a summary comment with a health score and inline review comments on changed lines. During the initial advisory rollout, findings are reported but do not block merges (`blocking: none`, `scope: full`).
+- **Pushes to `main`:** records the health score trend without failing the branch.
+
+After the baseline is documented and critical findings are addressed, CI will switch to blocking new errors on changed files only.
 
 ## Commit messages
 

package.json

@@ -12,6 +12,7 @@
     "nitrogen": "bun run --filter react-native-nitro-maps nitrogen",
     "example": "bun run --filter react-native-nitro-maps-example",
     "format": "prettier --write .",
+    "doctor": "npx react-doctor@latest",
     "commitlint": "commitlint",
     "prepare": "husky"
   },