Restructure for the monorepo setup

[kiftio]

Restructure for monorepo

Folds the previously-imported subtrees (swift/ and android/) into a single coherent monorepo with shared CI scaffolding, a single contribution flow, and per-platform release pipelines that can run independently.

The subtree imports themselves are already on main from the previous push — this PR is everything that sits on top of that: structural moves, merged .github, and rewritten workflows.

What's changing

SwiftPM root setup

SwiftPM consumers reference the repo URL and look for Package.swift at the repo root — there's no consumer-side path override. So Package.swift and Package.resolved move to the repo root, with path: "swift/Sources/..." redirects on each target so the actual sources can stay under swift/. This keeps every existing SwiftPM consumer of Shopify/checkout-sheet-kit-swift working unchanged once we point them at the new repo URL.

The same constraint forces .swiftlint.yml to root (the SwiftLintPlugin invoked by the test targets only looks adjacent to Package.swift); included: is updated to swift/Sources and swift/Tests. .swiftformat, Mintfile, Gemfile, the podspec, and the lint scripts all stay under swift/ — they're not subject to the same constraint.

Repo-root file consolidation

• LICENSE, .gitattributes, .ruby-version promoted to root (byte-identical between the two source repos — verified before deduping).
• .gitignore merged at root from the union of both source-repo ignore patterns.
• README.md is a stub for now; platform READMEs stay at swift/README.md and android/README.md.
• Podspec license file path adjusted from LICENSE → ../LICENSE.

Single .github/

• CODEOWNERS, CODE_OF_CONDUCT.md, ISSUE_TEMPLATE/* promoted to root (identical or near-identical between repos).
• CONTRIBUTING.md rewritten with shared sections (CoC, what we'll/won't merge, general flow) plus per-platform sections for prerequisites, formatting, and the release process.
• pull_request_template.md rewritten with shared "what changes" / "how to test" plus collapsible per-platform release checklists.

Workflows

Workflows live under .github/workflows/ with swift- / android- prefixes:

New name	Replaces
swift-test-package.yml	test-package.yml
swift-build-samples.yml	build-samples.yml
swift-test-workflow.yml	test-workflow.yml (callable)
swift-lint.yml	lint.yml
swift-deploy.yml	deploy.yml
swift-update-linters.yml	update-linters.yml
android-test.yml	test.yml
android-deploy.yml	publish.yml
android-license-headers.yml	check_license_headers.yml
cla.yml	(deduped from both)
stale.yml	(deduped from both)

Each platform workflow gets:

• A paths: filter scoped to its subtree so an Android-only PR doesn't fire Swift CI and vice versa.
• defaults.run.working-directory: swift or android so existing ./gradlew … / ./Scripts/… invocations work unchanged.
• Updated cache keys / config paths (hashFiles('swift/Mintfile'), BUNDLE_GEMFILE: …/swift/Gemfile, etc.).

Release tag scheme — important for reviewers

Both source repos publish on release: published. In a single repo that means every release would fire both deploy workflows. The convention this PR introduces:

• Swift releases use bare semver (3.8.1) — required for SwiftPM from: constraint resolution.
• Android releases use android/X.Y.Z (android/3.0.1).

Each deploy workflow gates on tag prefix:

# swift-deploy.yml
if: ${{ github.event_name == 'workflow_dispatch' || !startsWith(github.event.release.tag_name, 'android/') }}

# android-deploy.yml
if: ${{ github.event_name == 'workflow_dispatch' || startsWith(github.event.release.tag_name, 'android/') }}

This is the smallest change that lets both pipelines coexist on a single shared trigger.

Single dependabot config

One .github/dependabot.yml with four ecosystems: github-actions (root), swift (root, since Package.swift is at root), gradle (/android), and gradle (/android/samples/MobileBuyIntegration). Existing version pins (Kotlin 1.9.x, Mockito 4.x, JUnit 4.x, etc.) and the Apollo grouping are preserved.

Placeholders

react-native/README.md and e2e/README.md are one-line placeholders so the layout matches the eventual structure. No content yet.

What's not changing

• Publishing destinations (CocoaPods trunk, Maven Central) and credentials.
• Library names (ShopifyCheckoutSheetKit, com.shopify:checkout-sheet-kit) — rename to "checkout kit" is a follow-up.
• Public API surface on either platform.
• The Android :lib module structure or the Swift target layout.
• Sample app gradle wrapper — samples/MobileBuyIntegration/ remains a self-contained gradle project.

Verified locally

• swift package describe parses the manifest, resolves both products / both test targets / both deps.
• (cd android && ./gradlew :lib:tasks) resolves the project and lists the expected tasks.
• git blame swift/Sources/ShopifyCheckoutSheetKit/CheckoutBridge.swift traces back to 2023 commits — history preserved across the subtree boundary.
• No tracked secrets (upload-keystore.jks, local.properties, .env — none in git ls-files).
• Workflows pass .github/workflows/*.yml YAML lint locally.

CI on this PR will exercise each workflow against its corresponding subtree.

Follow-ups (intentionally not in this PR)

1. Library rename to "checkout kit" — touches podspec name, Maven artifactId, package names, READMEs.
2. Repo URLs in publish metadata — android/lib/build.gradle POM/SCM URLs and the podspec s.homepage / s.source still point at the old per-platform repos. Update once the new repo is the canonical source.
3. Pre-existing: android/lib/build.gradle:19 reads CHECKOUT_SHEET_KIT_VERSION env with a hardcoded "3.6.0" default; the publish workflow doesn't set it. Worth flagging to the Android team — not introduced here.
4. Top-level dev.yml that delegates to per-platform dev (currently you cd swift/ or cd android/ to use dev).
5. Shared composite GitHub Actions for Mint/Ruby/Java setup once both pipelines run side-by-side and the duplication is visible.
6. e2e and react-native content — folded in later per the migration plan.

[shopify-bumperbot]

🔍 Denylist Analysis Results

Discovered 3 packages. These include both those that are net-new and those that have been explicitly approved or denied for use.

.github/workflows/swift-update-linters.yml

---

✅ Known Packages - Approved for Use (1)

Package	Version	Details
actions/checkout	de0fac2e4500dabe0009e67214ff5f5447ce83dd	Package policy allows this version

Package.resolved

---

🔄 New Packages Entering the Supply Chain (2)

Package	Version	Details
github.com/lukepistrol/swiftlintplugin	0.63.1	Package is pending decision (Shopify/package-allowlist#45590)
github.com/nalexn/viewinspector	0.10.3	Package is pending decision (Shopify/package-allowlist#45591)

---

For any questions or to provide feedback, please reach out to #help-bumperbot.

Generated by Bumperbot.

[kiftio]

• Add ECP support to Android Checkout Kit #21
• Rename occurrences of CSK to Checkout Kit #10
• Restructure for the monorepo setup #9 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.