build-android-e2e.yml

# Pure Android E2E build workflow - just builds APKs and uploads artifacts
# No testing, no unnecessary setup - optimized for speed and efficiency

name: Build Android E2E APKs

on:
  workflow_call:
    outputs:
      apk-uploaded:
        description: 'Whether the APK was successfully uploaded'
        value: ${{ jobs.build-android-apks.outputs.apk-uploaded }}
    inputs:
      build_type:
        description: 'The type of build to perform'
        required: false
        default: 'main'
        type: string
      metamask_environment:
        description: 'The environment to build for'
        required: false
        default: 'e2e'
        type: string
      source-fingerprint:
        description: >-
          Canonical @expo/fingerprint hash for this commit, computed once in
          the `native-build-fingerprint` job. Used for cache keys and cross-run
          artifact lookups. When empty (e.g. forked PR where the hash job is
          skipped), the build compiles fresh with no cache reuse.
        required: false
        default: ''
        type: string
      runner_provider:
        description: Runner provider forwarded from the caller
        required: false
        type: string
        default: current
      include_arm64:
        description: >-
          Include arm64-v8a in the E2E build (in addition to x86_64) so the APK runs on
          Apple Silicon emulators. Default false = standard CI behavior (x86_64-only).
          When true, all build reuse/caching is disabled and artifact names are suffixed
          with "-arm64" to avoid colliding with the standard x86_64 CI artifacts.
        required: false
        default: false
        type: boolean
      reuse-main-builds-only:
        description: >-
          When true, only reuse native artifacts from the base branch (main) and skip
          JS repacking. Fails if no reusable main build is found.
        required: false
        default: false
        type: boolean

jobs:
  build-android-apks:
    name: Build Android E2E APKs
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-android-build' || (startsWith(github.base_ref, 'release/') && fromJSON('["ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-lg"]') || fromJSON('["ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-lg", "low-priority"]')) }} # Optimized for lg runner (48GB) with conservative memory settings
    timeout-minutes: 40
    env:
      GRADLE_USER_HOME: ${{ inputs.runner_provider == 'namespace' && '/home/runner/_work/.gradle' || '/home/admin/_work/.gradle' }}
      CACHE_GENERATION: v1 # Increment this to bust the cache (v1, v2, v3, etc.)
      YARN_ENABLE_GLOBAL_CACHE: 'true' # Enable Yarn global cache for faster installs
      E2E_BUILD_METADATA_ARTIFACT: ${{ inputs.build_type }}-${{ inputs.metamask_environment }}-android-build-metadata
    outputs:
      apk-uploaded: ${{ steps.upload-apk-namespace.outcome == 'success' || steps.upload-apk.outcome == 'success' }}
      apk-target-path: ${{ steps.determine-target-paths.outputs.apk-target-path }}
      test-apk-target-path: ${{ steps.determine-target-paths.outputs.test-apk-target-path }}
      artifact_name: ${{ steps.determine-target-paths.outputs.artifact_name }}

    steps:
      - name: Checkout repo (Namespace)
        uses: namespacelabs/nscloud-checkout-action@938f5d2d403d6224d9a0c0dc559b1dae09c2ede4 # v8.1.1
        if: ${{ inputs.runner_provider == 'namespace' }}
      - name: Checkout repo
        uses: actions/checkout@v6
        if: ${{ inputs.runner_provider != 'namespace' }}

      - name: Check force-builds override
        id: force-builds
        uses: ./.github/actions/check-force-builds
        with:
          github-token: ${{ github.token }}

      - name: Configure Namespace cache
        if: ${{ inputs.runner_provider == 'namespace' }}
        uses: namespacelabs/nscloud-cache-action@15799a6b54e5765f85b2aac25b3f0df43ed571c0 # v1
        with:
          cache: |
            gradle
            maven
          path: |
            ~/.cache/yarn
            .metamask
            node_modules
            .yarn/cache
            ${{ env.GRADLE_USER_HOME }}/caches
            ${{ env.GRADLE_USER_HOME }}/wrapper
            ${{ env.GRADLE_USER_HOME }}/apk-cache

      - name: Configure Gradle remote build cache
        if: ${{ inputs.runner_provider == 'namespace' }}
        run: |
          mkdir -p "$GRADLE_USER_HOME/init.d"
          REF="${GITHUB_REF_NAME}"
          PUSH=true
          if [[ "$REF" != "main" && "$REF" != release/* && "$REF" != stable/* ]]; then
            PUSH=false
          fi
          nsc cache gradle setup --push="$PUSH" --init-gradle "$GRADLE_USER_HOME/init.d/namespace-cache.init.gradle"
          echo "Gradle remote build cache configured (push=$PUSH) at $GRADLE_USER_HOME/init.d/namespace-cache.init.gradle"

      - name: Report source fingerprint
        run: |
          if [[ -z "$SOURCE_FINGERPRINT" ]]; then
            echo "::warning::No source-fingerprint provided (likely a forked PR); artifact reuse disabled."
          else
            echo "Source fingerprint: $SOURCE_FINGERPRINT"
          fi
        env:
          SOURCE_FINGERPRINT: ${{ inputs.source-fingerprint }}

      - name: Determine target paths and Artifact Names
        id: determine-target-paths
        run: |
          if [[ "${{ inputs.build_type }}" == "flask" ]]; then
            {
              echo "apk-target-path=android/app/build/outputs/apk/flask/release"
              echo "test-apk-target-path=android/app/build/outputs/apk/androidTest/flask/release"
              echo "artifact_name=app-flask-release"
            } >> "$GITHUB_OUTPUT"
          elif [[ "${{ inputs.build_type }}" == "main" ]]; then
            {
              echo "apk-target-path=android/app/build/outputs/apk/prod/release"
              echo "test-apk-target-path=android/app/build/outputs/apk/androidTest/prod/release"
              echo "artifact_name=app-prod-release"
            } >> "$GITHUB_OUTPUT"
          else
            echo "❌ Error: build_type ${{ inputs.build_type }} is not valid"
            exit 1
          fi

      - name: Check Namespace E2E APK cache
        id: namespace-apk-cache
        if: ${{ inputs.runner_provider == 'namespace' && steps.force-builds.outputs.force != 'true' && inputs.source-fingerprint != '' && inputs.include_arm64 == false }}
        shell: bash
        env:
          APK_TARGET: ${{ steps.determine-target-paths.outputs.apk-target-path }}
          TEST_APK_TARGET: ${{ steps.determine-target-paths.outputs.test-apk-target-path }}
          ARTIFACT_NAME: ${{ steps.determine-target-paths.outputs.artifact_name }}
          FINGERPRINT: ${{ inputs.source-fingerprint }}
          CACHE_GENERATION: ${{ env.CACHE_GENERATION }}
          GRADLE_FILES_HASH: ${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          REF_NAME: ${{ github.ref_name }}
          BUILD_TYPE: ${{ inputs.build_type }}
        run: |
          MARKER="${GRADLE_USER_HOME}/apk-cache/.e2e-apk-cache-marker"
          APK_CACHED="${GRADLE_USER_HOME}/apk-cache/${ARTIFACT_NAME}.apk"
          TEST_APK_CACHED="${GRADLE_USER_HOME}/apk-cache/${ARTIFACT_NAME}-androidTest.apk"
          EXPECTED="${REF_NAME}"$'\n'"${BUILD_TYPE}"$'\n'"${CACHE_GENERATION}"$'\n'"${FINGERPRINT}"$'\n'"${GRADLE_FILES_HASH}"
          echo "--- Debug: APK cache marker diagnostics ---"
          echo "MARKER=$MARKER"
          echo "APK_CACHED=$APK_CACHED"
          echo "TEST_APK_CACHED=$TEST_APK_CACHED"
          echo "marker exists: $([[ -f "${MARKER}" ]] && echo yes || echo NO)"
          echo "apk exists: $([[ -f "${APK_CACHED}" ]] && echo yes || echo NO)"
          echo "test-apk exists: $([[ -f "${TEST_APK_CACHED}" ]] && echo yes || echo NO)"
          ls -la "${GRADLE_USER_HOME}/apk-cache/" 2>&1 || echo "apk-cache dir not found"
          if [[ -f "${MARKER}" ]]; then
            echo "--- marker contents ---"
            cat "${MARKER}"
            echo "--- expected ---"
            echo "${EXPECTED}"
            echo "--- match: $([[ "$(<"${MARKER}")" == "${EXPECTED}" ]] && echo YES || echo NO) ---"
          fi
          if [[ -f "${MARKER}" ]] && [[ -f "${APK_CACHED}" ]] && [[ -f "${TEST_APK_CACHED}" ]] && [[ "$(<"${MARKER}")" == "${EXPECTED}" ]]; then
            echo "cache-hit=true" >> "${GITHUB_OUTPUT}"
            echo "Namespace APK cache hit — restoring APKs to build output dirs."
            mkdir -p "${APK_TARGET}" "${TEST_APK_TARGET}"
            cp "${APK_CACHED}" "${APK_TARGET}/"
            cp "${TEST_APK_CACHED}" "${TEST_APK_TARGET}/"
          else
            echo "cache-hit=false" >> "${GITHUB_OUTPUT}"
            echo "Namespace APK cache miss — full build required."
          fi

      - name: Find reusable build from prior run
        id: find-reusable-build
        if: ${{ inputs.runner_provider != 'namespace' && steps.force-builds.outputs.force != 'true' && inputs.source-fingerprint != '' && inputs.include_arm64 == false }}
        uses: ./.github/actions/find-reusable-build
        with:
          fingerprint: ${{ inputs.source-fingerprint }}
          artifact-names: '["${{ inputs.build_type }}-${{ inputs.metamask_environment }}-release.apk","${{ inputs.build_type }}-${{ inputs.metamask_environment }}-release-androidTest.apk"]'
          metadata-artifact-name: ${{ inputs.reuse-main-builds-only != true && env.E2E_BUILD_METADATA_ARTIFACT || '' }}
          github-token: ${{ github.token }}
          main-branch-only: ${{ inputs.reuse-main-builds-only }}
          max-candidates-per-branch: ${{ inputs.reuse-main-builds-only && '30' || '10' }}

      - name: Restore APKs matching fingerprint from branch cache
        if: ${{ inputs.runner_provider != 'namespace' && steps.force-builds.outputs.force != 'true' && steps.find-reusable-build.outputs.found != 'true' && inputs.include_arm64 == false && inputs.reuse-main-builds-only != true }}
        id: apk-cache-restore
        # This action automatically updates the cache at the end of the workflow
        uses: cirruslabs/cache@bba69c6578b863ad0398ad40567bd2ef70290fe0 # v4
        with:
          path: |
            ${{ steps.determine-target-paths.outputs.apk-target-path }}/${{ steps.determine-target-paths.outputs.artifact_name }}.apk
            ${{ steps.determine-target-paths.outputs.test-apk-target-path }}/${{ steps.determine-target-paths.outputs.artifact_name }}-androidTest.apk
          key: android-apk-${{ github.ref_name }}-${{ inputs.build_type }}-${{ env.CACHE_GENERATION }}-${{ inputs.source-fingerprint }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}

      - name: Restore APKs matching fingerprint from main cache
        if: ${{ inputs.runner_provider != 'namespace' && steps.force-builds.outputs.force != 'true' && steps.find-reusable-build.outputs.found != 'true' && inputs.include_arm64 == false && (inputs.reuse-main-builds-only == true || (steps.apk-cache-restore.outputs.cache-hit != 'true' && github.ref_name != 'main')) }}
        id: apk-cache-restore-main
        # This will only restore the cache, not update it
        uses: cirruslabs/cache/restore@bba69c6578b863ad0398ad40567bd2ef70290fe0 # v4
        with:
          path: |
            ${{ steps.determine-target-paths.outputs.apk-target-path }}/${{ steps.determine-target-paths.outputs.artifact_name }}.apk
            ${{ steps.determine-target-paths.outputs.test-apk-target-path }}/${{ steps.determine-target-paths.outputs.artifact_name }}-androidTest.apk
          key: android-apk-main-${{ inputs.build_type }}-${{ env.CACHE_GENERATION }}-${{ inputs.source-fingerprint }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}

      - name: Download reusable Android build metadata from prior run
        id: download-reusable-metadata
        if: ${{ steps.find-reusable-build.outputs.found == 'true' }}
        continue-on-error: true
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.E2E_BUILD_METADATA_ARTIFACT }}
          path: .e2e-reusable-metadata/android
          github-token: ${{ github.token }}
          repository: ${{ github.repository }}
          run-id: ${{ steps.find-reusable-build.outputs.run-id }}

      - name: Validate reusable Android build metadata
        id: validate-reusable-metadata
        if: ${{ steps.find-reusable-build.outputs.found == 'true' }}
        shell: bash
        env:
          EXPECTED_FINGERPRINT: ${{ inputs.source-fingerprint }}
          EXPECTED_BUILD_TYPE: ${{ inputs.build_type }}
          EXPECTED_METAMASK_ENVIRONMENT: ${{ inputs.metamask_environment }}
          EXPECTED_RUN_ID: ${{ steps.find-reusable-build.outputs.run-id }}
          EXPECTED_HEAD_SHA: ${{ steps.find-reusable-build.outputs.source-sha }}
          EXPECTED_ARTIFACTS: '["${{ inputs.build_type }}-${{ inputs.metamask_environment }}-release.apk","${{ inputs.build_type }}-${{ inputs.metamask_environment }}-release-androidTest.apk"]'
          METADATA_FILE: .e2e-reusable-metadata/android/android.json
        run: |
          set -euo pipefail
          echo "valid=false" >> "$GITHUB_OUTPUT"
          if [[ "${{ steps.download-reusable-metadata.outcome }}" != "success" ]]; then
            echo "::warning::Reusable Android metadata download failed; falling back to fresh native build."
            exit 0
          fi
          if [[ ! -f "$METADATA_FILE" ]]; then
            echo "::warning::Reusable Android metadata file missing at $METADATA_FILE; falling back to fresh native build."
            exit 0
          fi
          if jq -e \
            --arg fingerprint "$EXPECTED_FINGERPRINT" \
            --arg buildType "$EXPECTED_BUILD_TYPE" \
            --arg metamaskEnvironment "$EXPECTED_METAMASK_ENVIRONMENT" \
            --arg workflowRunId "$EXPECTED_RUN_ID" \
            --arg headSha "$EXPECTED_HEAD_SHA" \
            --argjson artifactNames "$EXPECTED_ARTIFACTS" \
            '.schemaVersion == 1
              and .fingerprint == $fingerprint
              and .platform == "android"
              and .buildType == $buildType
              and .metamaskEnvironment == $metamaskEnvironment
              and .workflowRunId == $workflowRunId
              and .headSha == $headSha
              and .artifactNames == $artifactNames' "$METADATA_FILE" >/dev/null; then
            echo "valid=true" >> "$GITHUB_OUTPUT"
            echo "Reusable Android metadata is valid."
          else
            echo "::warning::Reusable Android metadata did not match current build request; falling back to fresh native build."
            cat "$METADATA_FILE"
          fi

      - name: Download reusable APK from prior run
        id: download-reusable-apk
        if: ${{ steps.validate-reusable-metadata.outputs.valid == 'true' && inputs.include_arm64 == false }}
        continue-on-error: true
        uses: actions/download-artifact@v4
        with:
          name: ${{ inputs.build_type }}-${{ inputs.metamask_environment }}-release.apk
          path: ${{ steps.determine-target-paths.outputs.apk-target-path }}
          github-token: ${{ github.token }}
          repository: ${{ github.repository }}
          run-id: ${{ steps.find-reusable-build.outputs.run-id }}

      - name: Download reusable androidTest APK from prior run
        id: download-reusable-test-apk
        if: ${{ steps.validate-reusable-metadata.outputs.valid == 'true' && inputs.include_arm64 == false }}
        continue-on-error: true
        uses: actions/download-artifact@v4
        with:
          name: ${{ inputs.build_type }}-${{ inputs.metamask_environment }}-release-androidTest.apk
          path: ${{ steps.determine-target-paths.outputs.test-apk-target-path }}
          github-token: ${{ github.token }}
          repository: ${{ github.repository }}
          run-id: ${{ steps.find-reusable-build.outputs.run-id }}

      - name: Log reused Android build source
        if: ${{ steps.download-reusable-apk.outcome == 'success' && steps.download-reusable-test-apk.outcome == 'success' }}
        run: |
          echo "Reusing Android build from run ${{ steps.find-reusable-build.outputs.run-id }}"
          echo "Source SHA: ${{ steps.find-reusable-build.outputs.source-sha }}"
          echo "Source branch: ${{ steps.find-reusable-build.outputs.source-branch }}"
        shell: bash

      - name: Compute native-build gate
        id: gate
        run: |
          if [[ "${{ inputs.reuse-main-builds-only }}" == "true" ]]; then
            if [[ "${{ steps.force-builds.outputs.force }}" == "true" ]]; then
              echo "needs-native-build=true" >> "$GITHUB_OUTPUT"
              echo "force-builds override on test-only PR — compiling fresh native build."
            elif [[ "${{ steps.find-reusable-build.outputs.found }}" == "true" \
               && "${{ steps.download-reusable-apk.outcome }}" == "success" \
               && "${{ steps.download-reusable-test-apk.outcome }}" == "success" ]]; then
              echo "needs-native-build=false" >> "$GITHUB_OUTPUT"
              echo "Test-only PR: reusing main branch Android artifacts from GitHub Actions (no repack)."
            elif [[ "${{ steps.apk-cache-restore-main.outputs.cache-hit }}" == "true" ]]; then
              echo "needs-native-build=false" >> "$GITHUB_OUTPUT"
              echo "Test-only PR: reusing main branch Android artifacts from Cirrus APK cache (no repack)."
            else
              echo "::warning::Test-only PR could not reuse main Android builds yet (GitHub artifacts or main APK cache). Falling back to fresh native build."
              echo "needs-native-build=true" >> "$GITHUB_OUTPUT"
            fi
          elif [[ "${{ steps.namespace-apk-cache.outputs.cache-hit }}" == "true" ]]; then
            echo "needs-native-build=false" >> "$GITHUB_OUTPUT"
            echo "Namespace APK cache hit; heavy Android setup + Gradle restore will be skipped."
          elif [[ "${{ steps.find-reusable-build.outputs.found }}" == "true" \
             && "${{ steps.validate-reusable-metadata.outputs.valid }}" == "true" \
             && "${{ steps.download-reusable-apk.outcome }}" == "success" \
             && "${{ steps.download-reusable-test-apk.outcome }}" == "success" ]]; then
            echo "needs-native-build=false" >> "$GITHUB_OUTPUT"
            echo "Reuse path active (cross-run artifact download succeeded); heavy Android setup + Gradle restore will be skipped."
          elif [[ "${{ steps.apk-cache-restore.outputs.cache-hit }}" == "true" \
               || "${{ steps.apk-cache-restore-main.outputs.cache-hit }}" == "true" ]]; then
            echo "needs-native-build=false" >> "$GITHUB_OUTPUT"
            echo "APK cache hit; heavy Android setup + Gradle restore will be skipped."
          else
            if [[ "${{ steps.find-reusable-build.outputs.found }}" == "true" && "${{ steps.validate-reusable-metadata.outputs.valid }}" != "true" ]]; then
              echo "::warning::Reusable run was found but metadata validation failed; falling back to fresh native build."
            elif [[ "${{ steps.find-reusable-build.outputs.found }}" == "true" ]]; then
              echo "::warning::Reusable run was found but artifact download failed (apk=${{ steps.download-reusable-apk.outcome }}, test-apk=${{ steps.download-reusable-test-apk.outcome }}); falling back to fresh native build."
            fi
            echo "needs-native-build=true" >> "$GITHUB_OUTPUT"
            echo "No reuse path; full native build + setup will run."
          fi
        shell: bash

      - name: Write Android E2E reuse summary
        if: ${{ always() }}
        shell: bash
        env:
          SOURCE_FINGERPRINT: ${{ inputs.source-fingerprint }}
          BUILD_TYPE: ${{ inputs.build_type }}
          METAMASK_ENVIRONMENT: ${{ inputs.metamask_environment }}
          REUSABLE_FOUND: ${{ steps.find-reusable-build.outputs.found }}
          REUSABLE_RUN_ID: ${{ steps.find-reusable-build.outputs.run-id }}
          METADATA_VALID: ${{ steps.validate-reusable-metadata.outputs.valid }}
          APK_DOWNLOAD_OUTCOME: ${{ steps.download-reusable-apk.outcome }}
          TEST_APK_DOWNLOAD_OUTCOME: ${{ steps.download-reusable-test-apk.outcome }}
          NAMESPACE_CACHE_HIT: ${{ steps.namespace-apk-cache.outputs.cache-hit }}
          BRANCH_CACHE_HIT: ${{ steps.apk-cache-restore.outputs.cache-hit }}
          MAIN_CACHE_HIT: ${{ steps.apk-cache-restore-main.outputs.cache-hit }}
          BRANCH_CACHE_KEY: android-apk-${{ github.ref_name }}-${{ inputs.build_type }}-${{ env.CACHE_GENERATION }}-${{ inputs.source-fingerprint }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          MAIN_CACHE_KEY: android-apk-main-${{ inputs.build_type }}-${{ env.CACHE_GENERATION }}-${{ inputs.source-fingerprint }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          NEEDS_NATIVE_BUILD: ${{ steps.gate.outputs.needs-native-build }}
          REPOSITORY: ${{ github.repository }}
        run: |
          value() {
            if [[ -n "${1:-}" ]]; then
              printf '%s' "$1"
            else
              printf 'n/a'
            fi
          }

          yes_no() {
            case "${1:-}" in
              true) printf 'yes' ;;
              *) printf 'no' ;;
            esac
          }

          github_candidate="$(yes_no "$REUSABLE_FOUND")"
          if [[ -n "${REUSABLE_RUN_ID:-}" ]]; then
            github_candidate="yes ([https://github.com/$REPOSITORY/actions/runs/$REUSABLE_RUN_ID](https://github.com/$REPOSITORY/actions/runs/$REUSABLE_RUN_ID))"
          fi

          decision="Fresh native build"
          if [[ "${NAMESPACE_CACHE_HIT:-}" == "true" ]]; then
            decision="Namespace APK cache"
          elif [[ "${REUSABLE_FOUND:-}" == "true" && "${METADATA_VALID:-}" == "true" && "${APK_DOWNLOAD_OUTCOME:-}" == "success" && "${TEST_APK_DOWNLOAD_OUTCOME:-}" == "success" ]]; then
            decision="GitHub artifact reuse"
          elif [[ "${BRANCH_CACHE_HIT:-}" == "true" || "${MAIN_CACHE_HIT:-}" == "true" ]]; then
            decision="Cirrus APK cache"
          elif [[ "${NEEDS_NATIVE_BUILD:-}" == "false" ]]; then
            decision="reuse/cache hit"
          fi

          branch_cache="$(yes_no "$BRANCH_CACHE_HIT")"
          main_cache="$(yes_no "$MAIN_CACHE_HIT")"
          if [[ "${BRANCH_CACHE_HIT:-}" == "true" ]]; then
            branch_cache="yes (\`$BRANCH_CACHE_KEY\`)"
          elif [[ "${MAIN_CACHE_HIT:-}" == "true" ]]; then
            main_cache="yes (\`$MAIN_CACHE_KEY\`)"
          fi

          {
            echo "### Android E2E build reuse"
            echo ""
            echo "| Field | Value |"
            echo "| --- | --- |"
            echo "| Decision | $decision |"
            echo "| Native build fingerprint | \`$(value "$SOURCE_FINGERPRINT")\` |"
            echo "| Build type | \`$(value "$BUILD_TYPE")\` |"
            echo "| MetaMask environment | \`$(value "$METAMASK_ENVIRONMENT")\` |"
            echo "| Branch APK cache hit | $branch_cache |"
            echo "| Main APK cache hit | $main_cache |"
            echo "| GitHub artifact candidate | $github_candidate |"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Setup Android Build Environment
        timeout-minutes: 15
        uses: ./.github/actions/setup-e2e-env
        with:
          platform: android
          setup-simulator: false
          configure-keystores: true
          install-foundry: false
          runner_provider: ${{ inputs.runner_provider }}

      # The Namespace cache action above already includes `.metamask`, so the
      # dedicated actions/cache restore is only needed on non-Namespace runners.
      - name: Restore .metamask folder
        if: ${{ inputs.runner_provider != 'namespace' }}
        id: restore-metamask
        uses: actions/cache@v4
        with:
          path: .metamask
          key: .metamask-${{ hashFiles('package.json', 'yarn.lock') }}

      - name: Setup project dependencies with retry (native-build path)
        if: ${{ steps.gate.outputs.needs-native-build == 'true' }}
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: |
            echo "🚀 Setting up project..."
            yarn setup:github-ci --no-build-ios

      - name: Setup project dependencies with retry (reuse-hit path)
        if: ${{ steps.gate.outputs.needs-native-build != 'true' }}
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: |
            echo "📦 Setting up project (lightweight, skips jetify)..."
            yarn setup:github-ci --no-build-ios --no-build-android

      # -------------------------------------------------------------------------
      # Gradle caches + native build — only on the full native-build path.
      # -------------------------------------------------------------------------

      # Skipped on Namespace runners because the Namespace cache action above
      # already handles `${GRADLE_USER_HOME}/caches` and `wrapper` — running
      # cirruslabs/cache on top of it would be redundant work and a redundant
      # save at end of run.
      - name: Restore Gradle dependencies from branch cache
        id: gradle-cache-restore
        # This action automatically updates the cache at the end of the workflow
        uses: cirruslabs/cache@bba69c6578b863ad0398ad40567bd2ef70290fe0 # v4
        if: ${{ inputs.runner_provider != 'namespace' && steps.gate.outputs.needs-native-build == 'true' }}
        env:
          GRADLE_CACHE_VERSION: 1
        with:
          path: |
            ~/_work/.gradle/caches
            ~/_work/.gradle/wrapper
          # Include Gradle properties in key to force rebuild when properties change.
          # Keep the `hashFiles` call for Gradle config in-sync with the
          # sibling "Restore Gradle dependencies from main cache" step below.
          key: gradle-${{ github.ref_name }}-${{ env.GRADLE_CACHE_VERSION }}-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}

      - name: Restore Gradle dependencies from main cache
        # This will only restore the cache, not update it
        uses: cirruslabs/cache/restore@bba69c6578b863ad0398ad40567bd2ef70290fe0 # v4
        if: ${{ inputs.runner_provider != 'namespace' && steps.gate.outputs.needs-native-build == 'true' && steps.gradle-cache-restore.outputs.cache-hit != 'true' && github.ref_name != 'main' }}
        env:
          GRADLE_CACHE_VERSION: 1
        with:
          path: |
            ~/_work/.gradle/caches
            ~/_work/.gradle/wrapper
          # Include Gradle properties in key to force rebuild when properties change.
          # Keep the `hashFiles` call for Gradle config in-sync with the
          # sibling "Restore Gradle dependencies from branch cache" step above.
          key: gradle-main-${{ env.GRADLE_CACHE_VERSION }}-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}

      - name: Configure Namespace Gradle remote cache
        id: namespace-gradle-cache
        if: ${{ inputs.runner_provider == 'namespace' && steps.gate.outputs.needs-native-build == 'true' }}
        run: |
          nsc cache gradle setup --init-gradle "$RUNNER_TEMP/namespace-gradle-init.gradle"
          echo "init-script=$RUNNER_TEMP/namespace-gradle-init.gradle" >> "$GITHUB_OUTPUT"
        shell: bash

      - name: Build Android E2E APKs
        if: ${{ steps.gate.outputs.needs-native-build == 'true' }}
        run: |
          echo "🏗 Building Android E2E APKs..."
          export NODE_OPTIONS="--max-old-space-size=4096"
          cp android/gradle.properties.github android/gradle.properties
          yarn build:android:${{ inputs.build_type }}:e2e
        shell: bash
        env:
          PLATFORM: android
          METAMASK_ENVIRONMENT: ${{ inputs.metamask_environment }}
          METAMASK_BUILD_TYPE: ${{ inputs.build_type }}
          E2E_INCLUDE_ARM64: ${{ inputs.include_arm64 }}
          HAS_TEST_OVERRIDES: true
          E2E: 'true'
          IGNORE_BOXLOGS_DEVELOPMENT: true
          GITHUB_CI: 'true'
          CI: 'true'
          GRADLE_INIT_SCRIPT: ${{ steps.namespace-gradle-cache.outputs.init-script }}
          NODE_OPTIONS: '--max-old-space-size=4096'
          # Limit Metro workers to prevent OOM (each worker uses ~3GB)
          METRO_MAX_WORKERS: '4'
          # React Native 0.81's ReactAndroid/build.gradle.kts requests CMake 3.30.5
          # via `System.getenv("CMAKE_VERSION") ?: "3.30.5"`. The self-hosted runner
          # only ships CMake 3.22.1 in /opt/android-sdk/cmake/ and AGP cannot auto-
          # download missing components, causing CXX1300. RN's CMakeLists.txt files
          # only require >= 3.13, so 3.22.1 is fully sufficient.
          CMAKE_VERSION: '3.22.1'
          BRIDGE_USE_DEV_APIS: 'true'
          RAMP_INTERNAL_BUILD: 'true'
          SEEDLESS_ONBOARDING_ENABLED: 'true'
          MM_NOTIFICATIONS_UI_ENABLED: 'true'
          MM_SECURITY_ALERTS_API_ENABLED: 'true'
          MM_POOLED_STAKING_ENABLED: 'true'
          FEATURES_ANNOUNCEMENTS_ACCESS_TOKEN: ${{ secrets.FEATURES_ANNOUNCEMENTS_ACCESS_TOKEN }}
          FEATURES_ANNOUNCEMENTS_SPACE_ID: ${{ secrets.FEATURES_ANNOUNCEMENTS_SPACE_ID }}
          SEGMENT_WRITE_KEY_QA: ${{ secrets.SEGMENT_WRITE_KEY_QA }}
          SEGMENT_WRITE_KEY_FLASK: ${{ secrets.SEGMENT_WRITE_KEY_FLASK }}
          SEGMENT_PROXY_URL_QA: ${{ secrets.SEGMENT_PROXY_URL_QA }}
          SEGMENT_PROXY_URL_FLASK: ${{ secrets.SEGMENT_PROXY_URL_FLASK }}
          SEGMENT_DELETE_API_SOURCE_ID_QA: ${{ secrets.SEGMENT_DELETE_API_SOURCE_ID_QA }}
          SEGMENT_DELETE_API_SOURCE_ID_FLASK: ${{ secrets.SEGMENT_DELETE_API_SOURCE_ID_FLASK }}
          SEGMENT_REGULATIONS_ENDPOINT_QA: ${{ secrets.SEGMENT_REGULATIONS_ENDPOINT_QA }}
          SEGMENT_REGULATIONS_ENDPOINT_FLASK: ${{ secrets.SEGMENT_REGULATIONS_ENDPOINT_FLASK }}
          MM_SENTRY_DSN_TEST: ${{ secrets.MM_SENTRY_DSN_TEST }}
          MM_SENTRY_AUTH_TOKEN: ${{ secrets.MM_SENTRY_AUTH_TOKEN }}
          GOOGLE_SERVICES_B64_IOS: ${{ secrets.GOOGLE_SERVICES_B64_IOS }}
          GOOGLE_SERVICES_B64_ANDROID: ${{ secrets.GOOGLE_SERVICES_B64_ANDROID }}
          MM_INFURA_PROJECT_ID: ${{ secrets.MM_INFURA_PROJECT_ID }}

      - name: Record Namespace E2E APK cache marker
        if: ${{ inputs.runner_provider == 'namespace' && steps.gate.outputs.needs-native-build == 'true' && inputs.source-fingerprint != '' && inputs.include_arm64 == false }}
        shell: bash
        env:
          APK_SOURCE: ${{ steps.determine-target-paths.outputs.apk-target-path }}/${{ steps.determine-target-paths.outputs.artifact_name }}.apk
          TEST_APK_SOURCE: ${{ steps.determine-target-paths.outputs.test-apk-target-path }}/${{ steps.determine-target-paths.outputs.artifact_name }}-androidTest.apk
          ARTIFACT_NAME: ${{ steps.determine-target-paths.outputs.artifact_name }}
          FINGERPRINT: ${{ inputs.source-fingerprint }}
          CACHE_GENERATION: ${{ env.CACHE_GENERATION }}
          GRADLE_FILES_HASH: ${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          REF_NAME: ${{ github.ref_name }}
          BUILD_TYPE: ${{ inputs.build_type }}
        run: |
          CACHE_DIR="${GRADLE_USER_HOME}/apk-cache"
          mkdir -p "${CACHE_DIR}"
          cp "${APK_SOURCE}" "${CACHE_DIR}/${ARTIFACT_NAME}.apk"
          cp "${TEST_APK_SOURCE}" "${CACHE_DIR}/${ARTIFACT_NAME}-androidTest.apk"
          EXPECTED="${REF_NAME}"$'\n'"${BUILD_TYPE}"$'\n'"${CACHE_GENERATION}"$'\n'"${FINGERPRINT}"$'\n'"${GRADLE_FILES_HASH}"
          printf '%s\n' "${EXPECTED}" > "${CACHE_DIR}/.e2e-apk-cache-marker"
          echo "Namespace APK cache marker + APKs written to ${CACHE_DIR}."

      - name: Repack APK with JS updates using @expo/repack-app
        if: ${{ steps.gate.outputs.needs-native-build != 'true' && inputs.reuse-main-builds-only != true }}
        run: |
          echo "📦 Repacking APK with updated JavaScript bundle using @expo/repack-app..."
          # Use the optimized repack script which uses @expo/repack-app
          yarn build:repack:android
          echo "📦 Final APK size: $(du -h "${{ steps.determine-target-paths.outputs.apk-target-path }}/${{ steps.determine-target-paths.outputs.artifact_name }}.apk" | cut -f1)"
        env:
          PLATFORM: android
          METAMASK_ENVIRONMENT: ${{ inputs.metamask_environment }}
          METAMASK_BUILD_TYPE: ${{ inputs.build_type }}
          E2E_INCLUDE_ARM64: ${{ inputs.include_arm64 }}
          HAS_TEST_OVERRIDES: true
          E2E: 'true'
          IGNORE_BOXLOGS_DEVELOPMENT: true
          GITHUB_CI: 'true'
          CI: 'true'
          NODE_OPTIONS: '--max-old-space-size=8192'
          METRO_MAX_WORKERS: '6'
          BRIDGE_USE_DEV_APIS: 'true'
          RAMP_INTERNAL_BUILD: 'true'
          SEEDLESS_ONBOARDING_ENABLED: 'true'
          MM_NOTIFICATIONS_UI_ENABLED: 'true'
          MM_SECURITY_ALERTS_API_ENABLED: 'true'
          MM_POOLED_STAKING_ENABLED: 'true'
          FEATURES_ANNOUNCEMENTS_ACCESS_TOKEN: ${{ secrets.FEATURES_ANNOUNCEMENTS_ACCESS_TOKEN }}
          FEATURES_ANNOUNCEMENTS_SPACE_ID: ${{ secrets.FEATURES_ANNOUNCEMENTS_SPACE_ID }}
          SEGMENT_WRITE_KEY_QA: ${{ secrets.SEGMENT_WRITE_KEY_QA }}
          SEGMENT_WRITE_KEY_FLASK: ${{ secrets.SEGMENT_WRITE_KEY_FLASK }}
          SEGMENT_PROXY_URL_QA: ${{ secrets.SEGMENT_PROXY_URL_QA }}
          SEGMENT_PROXY_URL_FLASK: ${{ secrets.SEGMENT_PROXY_URL_FLASK }}
          SEGMENT_DELETE_API_SOURCE_ID_QA: ${{ secrets.SEGMENT_DELETE_API_SOURCE_ID_QA }}
          SEGMENT_DELETE_API_SOURCE_ID_FLASK: ${{ secrets.SEGMENT_DELETE_API_SOURCE_ID_FLASK }}
          SEGMENT_REGULATIONS_ENDPOINT_QA: ${{ secrets.SEGMENT_REGULATIONS_ENDPOINT_QA }}
          SEGMENT_REGULATIONS_ENDPOINT_FLASK: ${{ secrets.SEGMENT_REGULATIONS_ENDPOINT_FLASK }}
          MM_SENTRY_DSN_TEST: ${{ secrets.MM_SENTRY_DSN_TEST }}
          MM_SENTRY_AUTH_TOKEN: ${{ secrets.MM_SENTRY_AUTH_TOKEN }}
          GOOGLE_SERVICES_B64_IOS: ${{ secrets.GOOGLE_SERVICES_B64_IOS }}
          GOOGLE_SERVICES_B64_ANDROID: ${{ secrets.GOOGLE_SERVICES_B64_ANDROID }}
          MM_INFURA_PROJECT_ID: ${{ secrets.MM_INFURA_PROJECT_ID }}

      - name: Write Android E2E build metadata
        shell: bash
        env:
          SOURCE_FINGERPRINT: ${{ inputs.source-fingerprint }}
          BUILD_TYPE: ${{ inputs.build_type }}
          METAMASK_ENVIRONMENT: ${{ inputs.metamask_environment }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          CHECKOUT_SHA: ${{ github.sha }}
          GITHUB_REF_VALUE: ${{ github.ref }}
          GITHUB_REF_NAME_VALUE: ${{ github.ref_name }}
          GITHUB_EVENT_NAME_VALUE: ${{ github.event_name }}
          GITHUB_RUN_ID_VALUE: ${{ github.run_id }}
          ARTIFACT_NAMES: ${{ format('["{0}-{1}{2}-release.apk","{0}-{1}{2}-release-androidTest.apk"]', inputs.build_type, inputs.metamask_environment, inputs.include_arm64 && '-arm64' || '') }}
        run: |
          set -euo pipefail
          mkdir -p .e2e-build-metadata
          jq -n \
            --arg fingerprint "$SOURCE_FINGERPRINT" \
            --arg platform "android" \
            --arg buildType "$BUILD_TYPE" \
            --arg metamaskEnvironment "$METAMASK_ENVIRONMENT" \
            --arg workflowRunId "$GITHUB_RUN_ID_VALUE" \
            --arg headSha "$HEAD_SHA" \
            --arg checkoutSha "$CHECKOUT_SHA" \
            --arg githubRef "$GITHUB_REF_VALUE" \
            --arg githubRefName "$GITHUB_REF_NAME_VALUE" \
            --arg githubEventName "$GITHUB_EVENT_NAME_VALUE" \
            --arg createdAt "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
            --argjson artifactNames "$ARTIFACT_NAMES" \
            '{
              schemaVersion: 1,
              fingerprint: $fingerprint,
              platform: $platform,
              buildType: $buildType,
              metamaskEnvironment: $metamaskEnvironment,
              workflowRunId: $workflowRunId,
              headSha: $headSha,
              checkoutSha: $checkoutSha,
              githubRef: $githubRef,
              githubRefName: $githubRefName,
              githubEventName: $githubEventName,
              artifactNames: $artifactNames,
              createdAt: $createdAt
            }' > .e2e-build-metadata/android.json
          cat .e2e-build-metadata/android.json

      - name: Upload Android APK (Namespace)
        id: upload-apk-namespace
        if: ${{ inputs.runner_provider == 'namespace' }}
        uses: namespace-actions/upload-artifact@f6ccaacc655aec41b93af180d1d7eef21af862d2 # v1.0.3
        with:
          name: ${{ inputs.build_type }}-${{ inputs.metamask_environment }}${{ inputs.include_arm64 && '-arm64' || '' }}-release.apk
          path: ${{ steps.determine-target-paths.outputs.apk-target-path }}/${{ steps.determine-target-paths.outputs.artifact_name }}.apk
          retention-days: 7
          if-no-files-found: error

      - name: Upload Android APK (current)
        id: upload-apk
        if: ${{ inputs.runner_provider != 'namespace' }}
        uses: actions/upload-artifact@v4
        with:
          name: ${{ inputs.build_type }}-${{ inputs.metamask_environment }}${{ inputs.include_arm64 && '-arm64' || '' }}-release.apk
          path: ${{ steps.determine-target-paths.outputs.apk-target-path }}/${{ steps.determine-target-paths.outputs.artifact_name }}.apk
          retention-days: 7
          if-no-files-found: error

      - name: Upload Android Test APK (Namespace)
        id: upload-test-apk-namespace
        if: ${{ inputs.runner_provider == 'namespace' }}
        uses: namespace-actions/upload-artifact@f6ccaacc655aec41b93af180d1d7eef21af862d2 # v1.0.3
        with:
          name: ${{ inputs.build_type }}-${{ inputs.metamask_environment }}${{ inputs.include_arm64 && '-arm64' || '' }}-release-androidTest.apk
          path: ${{ steps.determine-target-paths.outputs.test-apk-target-path }}/${{ steps.determine-target-paths.outputs.artifact_name }}-androidTest.apk
          retention-days: 7
          if-no-files-found: error

      - name: Upload Android build metadata (Namespace)
        id: upload-metadata-namespace
        if: ${{ inputs.runner_provider == 'namespace' }}
        uses: namespace-actions/upload-artifact@f6ccaacc655aec41b93af180d1d7eef21af862d2 # v1.0.3
        with:
          name: ${{ env.E2E_BUILD_METADATA_ARTIFACT }}
          path: .e2e-build-metadata/android.json
          retention-days: 7
          if-no-files-found: error
        continue-on-error: true

      - name: Upload Android build metadata (current)
        id: upload-metadata
        if: ${{ inputs.runner_provider != 'namespace' }}
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.E2E_BUILD_METADATA_ARTIFACT }}
          path: .e2e-build-metadata/android.json
          retention-days: 7
          if-no-files-found: error
        continue-on-error: true

      - name: Upload Android Test APK (current)
        id: upload-test-apk
        if: ${{ inputs.runner_provider != 'namespace' }}
        uses: actions/upload-artifact@v4
        with:
          name: ${{ inputs.build_type }}-${{ inputs.metamask_environment }}${{ inputs.include_arm64 && '-arm64' || '' }}-release-androidTest.apk
          path: ${{ steps.determine-target-paths.outputs.test-apk-target-path }}/${{ steps.determine-target-paths.outputs.artifact_name }}-androidTest.apk
          retention-days: 7
          if-no-files-found: error