From 50548b9db9f9e194b7c8d6098406864d1a00744e Mon Sep 17 00:00:00 2001
From: rory <rory@expensify.com>
Date: Wed, 8 Apr 2026 16:02:07 -0700
Subject: [PATCH 1/4] Don't start versionBump if PR to CP is not valid and
 merged

---
 .github/workflows/cherryPick.yml | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/cherryPick.yml b/.github/workflows/cherryPick.yml
index ab42c398621ea..264338ea2f893 100644
--- a/.github/workflows/cherryPick.yml
+++ b/.github/workflows/cherryPick.yml
@@ -34,9 +34,33 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  validate:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Validate PR URL
+        if: ${{ inputs.PULL_REQUEST_URL != '' }}
+        run: |
+          if [[ "${{ inputs.PULL_REQUEST_URL }}" != *"github.com"* ]]; then
+            echo "::error::❌ Invalid PR URL: ${{ inputs.PULL_REQUEST_URL }}"
+            exit 1
+          else
+            echo "PR URL is valid: ${{ inputs.PULL_REQUEST_URL }}"
+          fi
+
+      - name: Verify PR is merged
+        if: ${{ inputs.PULL_REQUEST_URL != '' }}
+        run: |
+          if [[ gh pr view "${{  inputs.PULL_REQUEST_URL }}" --json mergedAt | jq --exit-status '.mergedAt' ]]; then
+            echo "PR is merged: ${{ inputs.PULL_REQUEST_URL }}"
+          else
+            echo "::error::❌ PR is not merged: ${{ inputs.PULL_REQUEST_URL }}"
+            exit 1
+          fi
+
   createNewVersion:
     uses: ./.github/workflows/createNewVersion.yml
     secrets: inherit
+    needs: [validate]
     with:
       # In order to submit a new build for production review, it must have a higher PATCH version than the previously-submitted build.
       # The typical case is that with each staging deploy, we bump the BUILD version, and with each prod deploy we bump the PATCH version.
@@ -59,14 +83,6 @@ jobs:
           echo "REPO_FULL_NAME=$(echo '${{ inputs.PULL_REQUEST_URL }}' | sed -E 's|https?://github.com/([^/]+/[^/]+)/pull/.*|\1|')" >> "$GITHUB_OUTPUT"
           echo "PR_NUMBER=$(echo '${{ inputs.PULL_REQUEST_URL }}' | sed -E 's|.*/pull/([0-9]+).*|\1|')" >> "$GITHUB_OUTPUT"
 
-      - name: Verify pull request URL
-        if: ${{ inputs.PULL_REQUEST_URL != '' }}
-        run: |
-          if [[ "${{ steps.getPRInfo.outputs.REPO_FULL_NAME }}" != ${{ github.repository }} ]] && [[ ! "${{ steps.getPRInfo.outputs.REPO_FULL_NAME }}" =~ Expensify/Mobile-Expensify* ]]; then
-            echo "::error::❌ Cherry picks are only supported for the Expensify/App and Expensify/Mobile-Expensify repositories. Found: ${{ steps.getPRInfo.outputs.REPO_FULL_NAME }}"
-            exit 1
-          fi
-
       - name: Set conflict branch name
         if: ${{ inputs.PULL_REQUEST_URL != '' }}
         id: getBranchName

From 7ae0ba456854a0d612841502250823c81ddf3f08 Mon Sep 17 00:00:00 2001
From: rory <rory@expensify.com>
Date: Wed, 8 Apr 2026 16:06:16 -0700
Subject: [PATCH 2/4] Fix actionlint

---
 .github/workflows/cherryPick.yml | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/cherryPick.yml b/.github/workflows/cherryPick.yml
index 264338ea2f893..a74e320072865 100644
--- a/.github/workflows/cherryPick.yml
+++ b/.github/workflows/cherryPick.yml
@@ -37,14 +37,13 @@ jobs:
   validate:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - name: Validate PR URL
+      - name: Validate pull request URL
         if: ${{ inputs.PULL_REQUEST_URL != '' }}
         run: |
-          if [[ "${{ inputs.PULL_REQUEST_URL }}" != *"github.com"* ]]; then
-            echo "::error::❌ Invalid PR URL: ${{ inputs.PULL_REQUEST_URL }}"
+          REPO_FULL_NAME=$(echo '${{ inputs.PULL_REQUEST_URL }}' | sed -E 's|https?://github.com/([^/]+/[^/]+)/pull/.*|\1|')
+          if [[ "$REPO_FULL_NAME" != ${{ github.repository }} ]] && [[ ! "$REPO_FULL_NAME" =~ Expensify/Mobile-Expensify* ]]; then
+            echo "::error::❌ Cherry picks are only supported for the Expensify/App and Expensify/Mobile-Expensify repositories. Found: $REPO_FULL_NAME"
             exit 1
-          else
-            echo "PR URL is valid: ${{ inputs.PULL_REQUEST_URL }}"
           fi
 
       - name: Verify PR is merged

From b91e90e2b56363a4e0a19ee8726aa36f124719a2 Mon Sep 17 00:00:00 2001
From: rory <rory@expensify.com>
Date: Wed, 8 Apr 2026 16:09:00 -0700
Subject: [PATCH 3/4] Remove unnecessary square brackets

---
 .github/workflows/cherryPick.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cherryPick.yml b/.github/workflows/cherryPick.yml
index a74e320072865..e588af8f62c4e 100644
--- a/.github/workflows/cherryPick.yml
+++ b/.github/workflows/cherryPick.yml
@@ -49,7 +49,7 @@ jobs:
       - name: Verify PR is merged
         if: ${{ inputs.PULL_REQUEST_URL != '' }}
         run: |
-          if [[ gh pr view "${{  inputs.PULL_REQUEST_URL }}" --json mergedAt | jq --exit-status '.mergedAt' ]]; then
+          if gh pr view "${{  inputs.PULL_REQUEST_URL }}" --json mergedAt | jq --exit-status '.mergedAt'; then
             echo "PR is merged: ${{ inputs.PULL_REQUEST_URL }}"
           else
             echo "::error::❌ PR is not merged: ${{ inputs.PULL_REQUEST_URL }}"

From aa04f9bfc1f6c3b21b9283168942fca784203f06 Mon Sep 17 00:00:00 2001
From: rory <rory@expensify.com>
Date: Wed, 8 Apr 2026 16:11:01 -0700
Subject: [PATCH 4/4] Remove errant space

---
 .github/workflows/cherryPick.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cherryPick.yml b/.github/workflows/cherryPick.yml
index e588af8f62c4e..4141c4d8012f4 100644
--- a/.github/workflows/cherryPick.yml
+++ b/.github/workflows/cherryPick.yml
@@ -49,7 +49,7 @@ jobs:
       - name: Verify PR is merged
         if: ${{ inputs.PULL_REQUEST_URL != '' }}
         run: |
-          if gh pr view "${{  inputs.PULL_REQUEST_URL }}" --json mergedAt | jq --exit-status '.mergedAt'; then
+          if gh pr view "${{ inputs.PULL_REQUEST_URL }}" --json mergedAt | jq --exit-status '.mergedAt'; then
             echo "PR is merged: ${{ inputs.PULL_REQUEST_URL }}"
           else
             echo "::error::❌ PR is not merged: ${{ inputs.PULL_REQUEST_URL }}"