[tristanheilman]

What does this PR do?

Stops a new Expo patch release from failing the required Quality check on commits that didn't change, and reports patch drift separately.

• The Check Expo project health step now runs npm run doctor with EXPO_OFFLINE=1, so doctor compares installed packages against the installed SDK's own version map instead of Expo's live list.
• A new Expo SDK drift workflow runs the live npx expo install --check on PRs that change package.json or package-lock.json, and on demand. It isn't meant to be a required check.

No dependencies, Dependabot settings or app code change.

Locally, plain npx expo-doctor still runs the live check, so it will fail whenever Expo has shipped a patch the lockfile doesn't have yet. That's expected and doesn't mean a change is broken. I'd recommend a follow-up policy PR that points CONTRIBUTING.md and the PR template at EXPO_OFFLINE=1 npx expo-doctor, the same check Quality runs, and says a drift failure from the plain command is fine.

Why was this required?

npm run doctor, the command Quality runs, fails on main (9b5de01) today with no change to the repo. It passes 20/21 and fails "Check that packages match versions required by installed Expo SDK": Expo published SDK 57 patches on Oct 6, and expo, expo-constants, expo-linking, expo-router and expo-sqlite are now behind. Open PRs inherit the failure.

The version check prefers Expo's live versions API over the installed expo package's map, so its result changes whenever Expo ships a patch. Expo has shipped SDK 57 patches roughly weekly (Sep 11, 18, 24, 29 and Oct 6). #14 and #22 realigned the versions by hand, #28 is the third attempt, and Dependabot's #30 is already behind again.

With EXPO_OFFLINE=1 the check still catches a real mismatch: installing expo-linking@56 makes it fail with "Major version mismatches". It just stops failing on patches published after the commit. Expo prints "Dependency validation is unreliable in offline-mode" because it skips those live overrides; the drift workflow covers that. Cap runs both its doctor and expo install --check steps offline the same way. I considered doctor's EXPO_DOCTOR_SKIP_DEPENDENCY_VERSION_CHECK, but it drops the version check from Quality entirely.

Expo SDK drift should stay out of the Protect main ruleset. It's path-filtered, and GitHub leaves a required check from a skipped workflow pending, which would block every other PR.

Automated tests

No tests apply: this changes CI configuration only. Run locally on macOS with Node 24.21:

• npm run doctor as Quality ran it before: 20/21, fails the version check.
• EXPO_OFFLINE=1 npm run doctor as Quality now runs it: 21/21. The npx expo-doctor box below refers to this; plain npx expo-doctor reports the drift until the Expo patches are bumped.
• npx expo install --check, the drift step: exits 1 on this branch, 0 after npx expo install --fix.
• npm run lint, npm run format:check and npm run typecheck: pass.
• npm run test:ci: 18 suites, 262 tests pass.
• npm run bundle:check: iOS, Android and web exports pass.
• actionlint on both workflow files: no findings.

Expo SDK drift will fail on this PR, since the PR changes that workflow and main is behind. That's the check doing its job.

Manual (human) testing

I ran npm run doctor on this branch with and without EXPO_OFFLINE=1 and got the 20/21 failure and the 21/21 pass above. No app code changed; the app from this branch loads and runs in Expo Go on an iPhone 16 Pro Max (iOS 26.6.2).

Server/API contract impact

None.

AI assistance

Claude Code helped investigate the failure (reading the expo-doctor and Expo CLI source, and comparing how other Expo projects run the check), drafted both workflow changes and this description, and ran the validation listed above. I reviewed every changed line, re-ran the doctor checks myself, and can explain and defend the change.

Checklist

• This PR has one coherent objective and contains no unrelated changes
• New or changed behavior has automated tests, or I explained why none apply
• I documented manual human testing with the actual platform/build used
• I documented any OpenFlight server contract impact
• I disclosed substantive AI assistance and personally reviewed every change
• npm ci succeeds
• npx expo-doctor passes
• npx tsc --noEmit passes
• npm test -- --ci --runInBand passes
• npx expo export --platform all succeeds when application code changed
• Documentation was updated where required
• No policy documents are mixed into a product-feature PR
• No unrelated generated files, formatting, or dependency updates are included