Wire Jumbo into monorepo CI, audit, and docs.

Register the Pos app as a first-class private submodule: dedicated lint/knip/typecheck/Jest CI, dependency audit, task-registry start capability, and docs/README ownership.

Co-authored-by: Babacar Diop <princemuichkine@users.noreply.github.com>

Author: cursoragent

.github/workflows/app-ci-jumbo.yml

@@ -0,0 +1,70 @@
+name: lomi · ci · jumbo
+
+on:
+  push:
+    branches: [main, develop]
+    paths:
+      - "apps/jumbo/**"
+      - "packages/shared/**"
+      - "packages/queries/**"
+      - "tooling/scripts/install-app-with-packages.mjs"
+      - ".github/workflows/app-ci-jumbo.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "apps/jumbo/**"
+      - "packages/shared/**"
+      - "packages/queries/**"
+      - "tooling/scripts/install-app-with-packages.mjs"
+      - ".github/workflows/app-ci-jumbo.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/jumbo
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Checkout jumbo submodule
+        working-directory: .
+        env:
+          TOKEN: ${{ secrets.REPO_CHECKOUT_PAT }}
+        run: bash .github/scripts/init-submodules.sh apps/jumbo
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: pnpm
+          cache-dependency-path: |
+            apps/jumbo/pnpm-lock.yaml
+            packages/shared/package.json
+            packages/queries/package.json
+
+      - name: Install Jumbo + shared packages
+        working-directory: .
+        run: node tooling/scripts/install-app-with-packages.mjs apps/jumbo
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Format
+        run: pnpm format
+
+      - name: Knip
+        run: pnpm knip
+
+      - name: Typecheck
+        run: pnpm exec tsc --noEmit --incremental false
+
+      - name: Test
+        run: pnpm exec jest --ci --watchman=false

.github/workflows/app-security-audit.yml

@@ -1,21 +1,23 @@
 name: lomi · security · dependency audit
 
 # Full installs are expensive: run on lockfile changes, weekly, or manually.
-# dashboard/checkout live in private submodule repos — check them out explicitly.
+# dashboard/checkout/jumbo live in private submodule repos — check them out explicitly.
 on:
   push:
     branches: [main, develop]
     paths:
       - "apps/api"
       - "apps/dashboard/pnpm-lock.yaml"
       - "apps/checkout/pnpm-lock.yaml"
+      - "apps/jumbo/pnpm-lock.yaml"
       - ".github/workflows/app-security-audit.yml"
   pull_request:
     branches: [main]
     paths:
       - "apps/api"
       - "apps/dashboard/pnpm-lock.yaml"
       - "apps/checkout/pnpm-lock.yaml"
+      - "apps/jumbo/pnpm-lock.yaml"
       - ".github/workflows/app-security-audit.yml"
   schedule:
     - cron: "30 8 * * 1"
@@ -93,3 +95,26 @@ jobs:
           node-version: "22"
       - name: pnpm audit (high and critical)
         run: pnpm --ignore-workspace audit --audit-level high
+
+  audit-jumbo:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/jumbo
+    steps:
+      - uses: actions/checkout@v5
+      - name: Checkout jumbo submodule
+        uses: actions/checkout@v5
+        with:
+          repository: lomiafrica/jumbo
+          ref: main
+          token: ${{ secrets.REPO_CHECKOUT_PAT }}
+          path: apps/jumbo
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - name: pnpm audit (high and critical)
+        run: pnpm --ignore-workspace audit --audit-level high

.gitmodules

@@ -24,6 +24,7 @@
 [submodule "apps/jumbo"]
 	path = apps/jumbo
 	url = https://github.com/lomiafrica/jumbo.git
+	branch = main
 [submodule "apps/customers"]
 	path = apps/customers
 	url = https://github.com/lomiafrica/customers.git

README.md

@@ -61,6 +61,7 @@ We are progressively open-sourcing the monorepo toward **eventual self-hosting**
 - **Proprietary**:
   - API service: **[apps/api](./apps/api)** (`lomiafrica/api`)
   - Admin dashboard: **[apps/admin](./apps/admin)**
+  - Merchant phone app (lomi. Pos): **[apps/jumbo](./apps/jumbo)** (`lomiafrica/jumbo`)
 
 All open-source repositories will be merged into the monorepo in the coming months.
 

apps/docs/content/docs/resources/open-source.fr.mdx

@@ -29,6 +29,7 @@ Certains composants relèvent exclusivement de notre **licence commerciale**, po
 | Site de documentation | ✅ Open source (`apps/docs`) |
 | Tableau de bord marchand, checkout, storefront | 🔒 Produit hébergé (ouverture progressive du code) |
 | Admin | 🔒 Propriétaire |
+| Application marchande lomi. Pos | 🔒 Propriétaire (`apps/jumbo`) |
 
 <Callout type="warn">
   **Pas d’auto-hébergement aujourd’hui.** Le traitement des paiements repose sur l’infrastructure hébergée de lomi., Merchant of Record, accords prestataires, conformité et stack opérationnelle. Un clone local sert au **développement et à la contribution**, pas à exploiter votre propre processeur de paiement.
@@ -87,6 +88,7 @@ Ce qui est ouvert aujourd’hui :
 
 - **Propriétaire** :
   - Tableau de bord admin : **`apps/admin`**
+  - Application marchande lomi. Pos : **`apps/jumbo`** (`lomiafrica/jumbo`)
 
 - **Produit hébergé (code pas entièrement public)** :
   - Checkout : **`apps/checkout`**

apps/docs/content/docs/resources/open-source.mdx

@@ -29,6 +29,7 @@ Certain components are covered exclusively by our **commercial license**, design
 | Documentation website | ✅ Open source (`apps/docs`) |
 | Merchant dashboard, checkout, storefront | 🔒 Hosted product (source opening progressively) |
 | Admin | 🔒 Proprietary |
+| Merchant phone app (lomi. Pos) | 🔒 Proprietary (`apps/jumbo`) |
 
 <Callout type="warn">
   **Not self-hostable today.** Running payment processing requires lomi.’s hosted infrastructure, Merchant of Record, provider agreements, compliance, and operational stack. Local clones are for **development and contribution**, not for operating your own payment processor.
@@ -87,6 +88,7 @@ What is open today:
 
 - **Proprietary**:
   - Admin dashboard: **`apps/admin`**
+  - Merchant phone app (lomi. Pos): **`apps/jumbo`** (`lomiafrica/jumbo`)
 
 - **Hosted product (source not fully public yet)**:
   - Checkout: **`apps/checkout`**

tooling/tasks.json

@@ -285,14 +285,15 @@
       "capabilities": [
         "install",
         "dev",
+        "start",
         "lint",
         "format",
         "knip",
         "types:generate"
       ],
       "owner": "mobile",
       "risk": "medium",
-      "notes": "dev is the Expo bundler. start remains an Expo-compatible alias."
+      "notes": "dev is the Expo bundler. start is an Expo-compatible alias. Typecheck and Jest run from monorepo CI until jumbo adds matching package scripts."
     },
     {
       "id": "cli",