Skip to content

feat: optimize update lavamoat policies#41479

Open
itsyoboieltr wants to merge 16 commits intomainfrom
feat/optimize-update-lavamoat-policies
Open

feat: optimize update lavamoat policies#41479
itsyoboieltr wants to merge 16 commits intomainfrom
feat/optimize-update-lavamoat-policies

Conversation

@itsyoboieltr
Copy link
Copy Markdown
Contributor

@itsyoboieltr itsyoboieltr commented Apr 3, 2026

Description

  • Instead of re-running all policy generation builds from scratch (~5 parallel build jobs), the @metamaskbot update-policies workflow now extracts the diffs directly from the failed validate-lavamoat-policies CI logs and applies them
  • Removes all build jobs, cache logic, and dummy env vars — replaces 7 jobs with 2 lightweight ones
  • Expected to reduce policy update time from minutes to seconds

How it works

  1. Finds the latest main.yml CI run for the PR's head commit
  2. Downloads logs from any failed "Validate LavaMoat" jobs
  3. Extracts the git diff output, applies the patches
  4. Commits and pushes

Changelog

CHANGELOG entry:

Related issues

Fixes: MetaMask/MetaMask-planning#7150

Manual testing steps

  1. Create a PR that introduces a LavaMoat policy change
  2. Wait for CI to run and the validate step to fail
  3. Comment @metamaskbot update-policies
  4. Verify policies are committed correctly and match what the old workflow would have produced

Screenshots/Recordings

Not applicable

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Moderate risk because it rewires the @metamaskbot update-policies automation to depend on selecting the correct CI run and applying downloaded patch artifacts, which could fail silently or apply unexpected diffs if mis-scoped.

Overview
Reworks the @metamaskbot update-policies workflow to stop re-generating policies locally and instead locate the PR’s main.yml CI run, download the LavaMoat policy diff artifacts, git apply them, and commit/push the result.

Updates validate-lavamoat-policies.yml to emit .patch artifacts on working-tree-dirty failures, enabling the update workflow to apply those exact diffs; also adds concurrency control and clearer PR comments for “validation still running”, “no changes”, and failure cases.

Reviewed by Cursor Bugbot for commit 77a349d. Bugbot is set up for automated code reviews on this repo. Configure here.

@itsyoboieltr itsyoboieltr self-assigned this Apr 3, 2026
@itsyoboieltr itsyoboieltr added team-extension-platform Extension Platform team no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed skip-release-validation labels Apr 3, 2026
@github-project-automation github-project-automation bot moved this to Needs dev review in PR review queue Apr 3, 2026
@itsyoboieltr itsyoboieltr requested review from a team and HowardBraham as code owners April 3, 2026 11:48
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 3, 2026

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@github-actions github-actions bot added the size-M label Apr 3, 2026
@metamaskbotv2
Copy link
Copy Markdown
Contributor

metamaskbotv2 bot commented Apr 3, 2026

Builds ready [39b66d1]
⚡ Performance Benchmarks (Total: 🟢 6 pass · 🟡 12 warn · 🔴 0 fail)

Baseline (latest main): f34f804 | Date: 9/10/58222 | Pipeline: 23946200193 | Baseline logs

Interaction Benchmarks
Benchmarkchrome-browserify
loadNewAccount🟡 [Show logs]
confirmTx🟡 [Show logs]
bridgeUserActions🟡 [Show logs]

📈 Results compared to the previous 5 runs on main

  • bridgeUserActions/bridge_load_asset_picker: +12%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🟡 loadNewAccount/FCP: p75 2.5s
  • 🟡 confirmTx/FCP: p75 2.5s
  • 🟡 bridgeUserActions/INP: p75 208ms
  • 🟡 bridgeUserActions/FCP: p75 2.5s
Startup Benchmarks
Benchmarkchrome-browserifychrome-webpackfirefox-browserifyfirefox-webpack
startupStandardHome🟢 [Show logs]🟢 [Show logs]🟢 [Show logs]🟢 [Show logs]
startupPowerUserHome🟡 [Show logs]🟡 [Show logs]🟡 [Show logs]🟡 [Show logs]

📈 Results compared to the previous 5 runs on main

  • startupStandardHome/domContentLoaded: -12%
  • startupStandardHome/domInteractive: +13%
  • startupStandardHome/backgroundConnect: +15%
  • startupStandardHome/initialActions: -38%
  • startupStandardHome/loadScripts: -16%
  • startupStandardHome/setupStore: +14%
  • startupPowerUserHome/uiStartup: -10%
  • startupPowerUserHome/domInteractive: -18%
  • startupPowerUserHome/backgroundConnect: +153%
  • startupPowerUserHome/setupStore: +17%
  • startupStandardHome/uiStartup: -13%
  • startupStandardHome/load: -13%
  • startupStandardHome/domContentLoaded: -13%
  • startupStandardHome/backgroundConnect: -33%
  • startupStandardHome/firstReactRender: -24%
  • startupStandardHome/loadScripts: -13%
  • startupStandardHome/numNetworkReqs: -29%
  • startupPowerUserHome/domInteractive: -18%
  • startupStandardHome/domInteractive: -59%
  • startupStandardHome/initialActions: +25%
  • startupStandardHome/numNetworkReqs: -18%
  • startupPowerUserHome/uiStartup: -11%
  • startupPowerUserHome/backgroundConnect: -36%
  • startupPowerUserHome/setupStore: +46%
  • startupStandardHome/domInteractive: -35%
  • startupStandardHome/backgroundConnect: -12%
  • startupStandardHome/initialActions: -44%
  • startupStandardHome/setupStore: -63%
  • startupStandardHome/numNetworkReqs: -16%
  • startupPowerUserHome/backgroundConnect: -18%
  • startupPowerUserHome/setupStore: +12%
  • startupPowerUserHome/numNetworkReqs: -43%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🔴 startupPowerUserHome/INP: p75 624ms
  • 🔴 startupPowerUserHome/INP: p75 656ms
  • 🟡 startupPowerUserHome/LCP: p75 3.5s
  • 🟡 startupPowerUserHome/INP: p75 248ms
  • 🟡 startupPowerUserHome/LCP: p75 3.7s
User Journey Benchmarks
Benchmarkchrome-browserify
onboardingImportWallet🟢 [Show logs]
onboardingNewWallet🟢 [Show logs]
assetDetails🟡 [Show logs]
solanaAssetDetails🟡 [Show logs]
importSrpHome🟡 [Show logs]
sendTransactions🟡 [Show logs]
swap🟡 [Show logs]

📈 Results compared to the previous 5 runs on main

  • onboardingImportWallet/srpButtonToSrpForm: -11%
  • onboardingImportWallet/metricsToWalletReadyScreen: -33%
  • onboardingImportWallet/doneButtonToHomeScreen: -75%
  • onboardingImportWallet/openAccountMenuToAccountListLoaded: +32%
  • onboardingImportWallet/total: -41%
  • onboardingNewWallet/skipBackupToMetricsScreen: -17%
  • onboardingNewWallet/doneButtonToAssetList: -36%
  • onboardingNewWallet/total: -30%
  • assetDetails/assetClickToPriceChart: -71%
  • assetDetails/total: -71%
  • solanaAssetDetails/assetClickToPriceChart: -64%
  • solanaAssetDetails/total: -64%
  • importSrpHome/openAccountMenuAfterLogin: -67%
  • importSrpHome/homeAfterImportWithNewWallet: -38%
  • importSrpHome/total: -32%
  • sendTransactions/openSendPageFromHome: +55%
  • sendTransactions/reviewTransactionToConfirmationPage: +17%
  • sendTransactions/total: +17%
  • swap/openSwapPageFromHome: -87%
  • swap/fetchAndDisplaySwapQuotes: +32%
  • swap/total: +14%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🟡 assetDetails/INP: p75 208ms
  • 🟡 assetDetails/FCP: p75 2.4s
  • 🟡 solanaAssetDetails/FCP: p75 2.3s
  • 🟡 importSrpHome/INP: p75 216ms
  • 🟡 importSrpHome/FCP: p75 2.5s
  • 🟡 sendTransactions/FCP: p75 2.5s
  • 🟡 swap/FCP: p75 2.5s
🌐 Dapp Page Load Benchmarks

Current Commit: 39b66d1 | Date: 4/3/2026

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.05s (±41ms) 🟡 | historical mean value: 1.03s ⬆️ (historical data)
  • domContentLoaded-> current mean value: 735ms (±39ms) 🟢 | historical mean value: 723ms ⬆️ (historical data)
  • firstContentfulPaint-> current mean value: 87ms (±10ms) 🟢 | historical mean value: 86ms ⬆️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.05s 41ms 1.01s 1.35s 1.08s 1.35s
domContentLoaded 735ms 39ms 707ms 1.02s 768ms 1.02s
firstPaint 87ms 10ms 72ms 164ms 96ms 164ms
firstContentfulPaint 87ms 10ms 72ms 164ms 96ms 164ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs
  • background: 58 Bytes (0%)
  • ui: 5 Bytes (0%)
  • common: 20 Bytes (0%)

@metamaskbotv2
Copy link
Copy Markdown
Contributor

metamaskbotv2 bot commented Apr 9, 2026

Builds ready [a3a95b3]
⚡ Performance Benchmarks (Total: 🟢 7 pass · 🟡 12 warn · 🔴 0 fail)

Baseline (latest main): f34f804 | Date: 9/10/58222 | Pipeline: 24211025544 | Baseline logs

Interaction Benchmarks · Samples: 5
Benchmarkchrome-browserify
loadNewAccount🟡 [Show logs]
confirmTx🟡 [Show logs]
bridgeUserActions🟡 [Show logs]

📈 Results compared to the previous 5 runs on main

  • bridgeUserActions/bridge_load_asset_picker: -36%
  • bridgeUserActions/bridge_search_token: +40%
  • bridgeUserActions/total: +16%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🟡 loadNewAccount/FCP: p75 2.5s
  • 🟡 confirmTx/FCP: p75 2.5s
  • 🟡 bridgeUserActions/FCP: p75 2.5s
Startup Benchmarks · Samples: 100
Benchmarkchrome-browserifychrome-webpackfirefox-browserifyfirefox-webpack
startupStandardHome🟢 [Show logs]🟢 [Show logs]🟢 [Show logs]🟢 [Show logs]
startupPowerUserHome🟡 [Show logs]🟡 [Show logs]🟡 [Show logs]🟡 [Show logs]

📈 Results compared to the previous 5 runs on main

  • startupStandardHome/domContentLoaded: -10%
  • startupStandardHome/domInteractive: +16%
  • startupStandardHome/backgroundConnect: +17%
  • startupStandardHome/initialActions: -38%
  • startupStandardHome/loadScripts: -14%
  • startupStandardHome/setupStore: +14%
  • startupPowerUserHome/domInteractive: -11%
  • startupPowerUserHome/backgroundConnect: +84%
  • startupPowerUserHome/setupStore: +28%
  • startupPowerUserHome/numNetworkReqs: +16%
  • startupStandardHome/uiStartup: -12%
  • startupStandardHome/load: -13%
  • startupStandardHome/domContentLoaded: -12%
  • startupStandardHome/firstPaint: +12%
  • startupStandardHome/backgroundConnect: -33%
  • startupStandardHome/firstReactRender: -28%
  • startupStandardHome/loadScripts: -12%
  • startupStandardHome/setupStore: -14%
  • startupStandardHome/numNetworkReqs: -29%
  • startupPowerUserHome/domInteractive: -18%
  • startupPowerUserHome/numNetworkReqs: +26%
  • startupStandardHome/domInteractive: -59%
  • startupStandardHome/initialActions: -38%
  • startupStandardHome/numNetworkReqs: -16%
  • startupPowerUserHome/backgroundConnect: -30%
  • startupStandardHome/domInteractive: -32%
  • startupStandardHome/backgroundConnect: -20%
  • startupStandardHome/initialActions: -44%
  • startupStandardHome/setupStore: -57%
  • startupPowerUserHome/domInteractive: -11%
  • startupPowerUserHome/backgroundConnect: -38%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🔴 startupPowerUserHome/INP: p75 720ms
  • 🔴 startupPowerUserHome/INP: p75 792ms
  • 🟡 startupPowerUserHome/LCP: p75 3.4s
  • 🟡 startupPowerUserHome/LCP: p75 3.7s
User Journey Benchmarks · Samples: 5 · mock API
Benchmarkchrome-browserify
onboardingImportWallet🟢 [Show logs]
onboardingNewWallet🟢 [Show logs]
assetDetails🟡 [Show logs]
solanaAssetDetails🟡 [Show logs]
importSrpHome🟡 [Show logs]
sendTransactions🟡 [Show logs]
swap🟡 [Show logs]

📈 Results compared to the previous 5 runs on main

  • onboardingImportWallet/srpButtonToSrpForm: -83%
  • onboardingImportWallet/metricsToWalletReadyScreen: -21%
  • onboardingImportWallet/doneButtonToHomeScreen: -75%
  • onboardingImportWallet/openAccountMenuToAccountListLoaded: +23%
  • onboardingImportWallet/total: -42%
  • onboardingNewWallet/srpButtonToPwForm: -78%
  • onboardingNewWallet/skipBackupToMetricsScreen: -69%
  • onboardingNewWallet/agreeButtonToOnboardingSuccess: -32%
  • onboardingNewWallet/doneButtonToAssetList: -30%
  • onboardingNewWallet/total: -30%
  • assetDetails/assetClickToPriceChart: -55%
  • assetDetails/total: -55%
  • solanaAssetDetails/assetClickToPriceChart: -67%
  • solanaAssetDetails/total: -67%
  • importSrpHome/openAccountMenuAfterLogin: -75%
  • importSrpHome/homeAfterImportWithNewWallet: -69%
  • importSrpHome/total: -60%
  • sendTransactions/openSendPageFromHome: -22%
  • sendTransactions/selectTokenToSendFormLoaded: -25%
  • sendTransactions/reviewTransactionToConfirmationPage: +34%
  • sendTransactions/total: +31%
  • swap/openSwapPageFromHome: -96%
  • swap/fetchAndDisplaySwapQuotes: +31%
  • swap/total: +12%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🟡 assetDetails/INP: p75 232ms
  • 🟡 assetDetails/FCP: p75 2.6s
  • 🟡 solanaAssetDetails/FCP: p75 2.6s
  • 🟡 solanaAssetDetails/LCP: p75 2.5s
  • 🟡 importSrpHome/INP: p75 216ms
  • 🟡 importSrpHome/FCP: p75 2.5s
  • 🟡 sendTransactions/INP: p75 232ms
  • 🟡 sendTransactions/FCP: p75 2.5s
  • 🟡 swap/FCP: p75 2.6s
Dapp Page Load Benchmarks · Samples: 100
Benchmarkchrome-browserify
dappPageLoad🟢 [Show logs]
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 79 Bytes (0%)
  • ui: 16 Bytes (0%)
  • common: 6.77 KiB (0.05%)

@itsyoboieltr itsyoboieltr requested a review from a team as a code owner April 9, 2026 20:52
Copy link
Copy Markdown

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 8f29b1f. Configure here.

@itsyoboieltr
Copy link
Copy Markdown
Contributor Author

@metamaskbot update-policies

@metamaskbot
Copy link
Copy Markdown
Collaborator

Policy update failed. You can review the logs or retry the policy update here

This reverts commit 78f553d.
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Apr 9, 2026

@metamaskbotv2
Copy link
Copy Markdown
Contributor

metamaskbotv2 bot commented Apr 9, 2026

Builds ready [77a349d]
⚡ Performance Benchmarks (Total: 🟢 7 pass · 🟡 12 warn · 🔴 0 fail)

Baseline (latest main): f34f804 | Date: 9/10/58222 | Pipeline: 24214022521 | Baseline logs

Interaction Benchmarks · Samples: 5
Benchmarkchrome-browserify
loadNewAccount🟡 [Show logs]
confirmTx🟡 [Show logs]
bridgeUserActions🟡 [Show logs]

📈 Results compared to the previous 5 runs on main

  • loadNewAccount/load_new_account: -74%
  • loadNewAccount/total: -74%
  • bridgeUserActions/bridge_load_page: -12%
  • bridgeUserActions/bridge_load_asset_picker: -14%
  • bridgeUserActions/bridge_search_token: -25%
  • bridgeUserActions/total: -17%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🟡 loadNewAccount/FCP: p75 2.5s
  • 🟡 confirmTx/FCP: p75 2.6s
  • 🟡 bridgeUserActions/FCP: p75 2.5s
Startup Benchmarks · Samples: 100
Benchmarkchrome-browserifychrome-webpackfirefox-browserifyfirefox-webpack
startupStandardHome🟢 [Show logs]🟢 [Show logs]🟢 [Show logs]🟢 [Show logs]
startupPowerUserHome🟡 [Show logs]🟡 [Show logs]🟡 [Show logs]🟡 [Show logs]

📈 Results compared to the previous 5 runs on main

  • startupStandardHome/uiStartup: -10%
  • startupStandardHome/load: -13%
  • startupStandardHome/domContentLoaded: -15%
  • startupStandardHome/domInteractive: +16%
  • startupStandardHome/backgroundConnect: +13%
  • startupStandardHome/initialActions: -38%
  • startupStandardHome/loadScripts: -17%
  • startupStandardHome/numNetworkReqs: -21%
  • startupPowerUserHome/uiStartup: -15%
  • startupPowerUserHome/load: -11%
  • startupPowerUserHome/domInteractive: -20%
  • startupPowerUserHome/backgroundConnect: +84%
  • startupPowerUserHome/numNetworkReqs: -42%
  • startupStandardHome/uiStartup: -13%
  • startupStandardHome/load: -12%
  • startupStandardHome/domContentLoaded: -12%
  • startupStandardHome/firstPaint: +18%
  • startupStandardHome/backgroundConnect: -26%
  • startupStandardHome/firstReactRender: -24%
  • startupStandardHome/loadScripts: -11%
  • startupStandardHome/setupStore: -14%
  • startupStandardHome/numNetworkReqs: -29%
  • startupPowerUserHome/domInteractive: -12%
  • startupPowerUserHome/numNetworkReqs: +45%
  • startupStandardHome/domInteractive: -60%
  • startupStandardHome/initialActions: -38%
  • startupStandardHome/setupStore: +14%
  • startupStandardHome/numNetworkReqs: -18%
  • startupPowerUserHome/backgroundConnect: -22%
  • startupPowerUserHome/setupStore: +39%
  • startupStandardHome/domInteractive: -33%
  • startupStandardHome/backgroundConnect: -16%
  • startupStandardHome/initialActions: -44%
  • startupStandardHome/setupStore: -60%
  • startupStandardHome/numNetworkReqs: -18%
  • startupPowerUserHome/uiStartup: -12%
  • startupPowerUserHome/domInteractive: -14%
  • startupPowerUserHome/backgroundConnect: -29%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🔴 startupPowerUserHome/INP: p75 688ms
  • 🔴 startupPowerUserHome/INP: p75 728ms
  • 🟡 startupPowerUserHome/LCP: p75 3.7s
  • 🟡 startupPowerUserHome/LCP: p75 3.4s
User Journey Benchmarks · Samples: 5 · mock API
Benchmarkchrome-browserify
onboardingImportWallet🟢 [Show logs]
onboardingNewWallet🟢 [Show logs]
assetDetails🟡 [Show logs]
solanaAssetDetails🟡 [Show logs]
importSrpHome🟡 [Show logs]
sendTransactions🟡 [Show logs]
swap🟡 [Show logs]

📈 Results compared to the previous 5 runs on main

  • onboardingImportWallet/srpButtonToSrpForm: -83%
  • onboardingImportWallet/metricsToWalletReadyScreen: -16%
  • onboardingImportWallet/doneButtonToHomeScreen: -75%
  • onboardingImportWallet/openAccountMenuToAccountListLoaded: +33%
  • onboardingImportWallet/total: -41%
  • onboardingNewWallet/srpButtonToPwForm: -78%
  • onboardingNewWallet/skipBackupToMetricsScreen: -68%
  • onboardingNewWallet/agreeButtonToOnboardingSuccess: -26%
  • onboardingNewWallet/doneButtonToAssetList: -32%
  • onboardingNewWallet/total: -32%
  • assetDetails/assetClickToPriceChart: -39%
  • assetDetails/total: -39%
  • solanaAssetDetails/assetClickToPriceChart: -70%
  • solanaAssetDetails/total: -70%
  • importSrpHome/openAccountMenuAfterLogin: -75%
  • importSrpHome/homeAfterImportWithNewWallet: -69%
  • importSrpHome/total: -60%
  • sendTransactions/openSendPageFromHome: -13%
  • sendTransactions/selectTokenToSendFormLoaded: -27%
  • sendTransactions/reviewTransactionToConfirmationPage: +34%
  • sendTransactions/total: +31%
  • swap/openSwapPageFromHome: -96%
  • swap/fetchAndDisplaySwapQuotes: +31%
  • swap/total: +11%

🌐 Core Web Vitals — 🟢 good · 🟡 needs improvement · 🔴 poor (web.dev thresholds)

  • 🟡 assetDetails/INP: p75 216ms
  • 🟡 assetDetails/FCP: p75 2.5s
  • 🟡 solanaAssetDetails/FCP: p75 2.5s
  • 🟡 importSrpHome/INP: p75 208ms
  • 🟡 importSrpHome/FCP: p75 2.5s
  • 🟡 sendTransactions/INP: p75 216ms
  • 🟡 sendTransactions/FCP: p75 2.5s
  • 🟡 swap/FCP: p75 2.5s
Dapp Page Load Benchmarks · Samples: 100
Benchmarkchrome-browserify
dappPageLoad🟢 [Show logs]
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 298 Bytes (0%)
  • ui: 1 KiB (0.01%)
  • common: 6.77 KiB (0.05%)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed size-M skip-release-validation team-extension-platform Extension Platform team

Projects

Status: Needs dev review

Development

Successfully merging this pull request may close these issues.

3 participants