build-ios-e2e.yml

name: Build iOS E2E Apps

on:
  workflow_call:
    outputs:
      app-uploaded:
        description: 'Whether the app was successfully uploaded'
        value: ${{ jobs.build-ios-apps.outputs.app-uploaded }}
    inputs:
      build_type:
        description: 'The type of build to perform'
        required: false
        default: 'main'
        type: string
      metamask_environment:
        description: 'The environment to build for'
        required: false
        default: 'e2e'
        type: string
      source-fingerprint:
        description: >-
          Canonical @expo/fingerprint hash for this commit, computed once in
          the `post-build-source-hash` job. Used for cache keys and cross-run
          artifact lookups. When empty (e.g. forked PR where the hash job is
          skipped), the build compiles fresh with no cache reuse.
        required: false
        default: ''
        type: string
      runner_provider:
        description: Runner provider forwarded from the caller
        required: false
        type: string
        default: current

jobs:
  build-ios-apps:
    name: Build iOS E2E Apps
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ios-build' || (startsWith(github.base_ref, 'release/') && fromJSON('["ghcr.io/cirruslabs/macos-runner:tahoe-xl"]') || fromJSON('["ghcr.io/cirruslabs/macos-runner:tahoe-xl", "low-priority"]')) }}
    outputs:
      artifacts-url: ${{ steps.set-artifacts-url.outputs.artifacts-url }}
      app-uploaded: ${{ steps.upload-app.outcome == 'success' }}
      sourcemap-uploaded: ${{ steps.upload-sourcemap.outcome == 'success' }}
    env:
      XCODE_CACHE_VERSION: 1
      RCT_NO_LAUNCH_PACKAGER: 1
      XCODE_BUILD_SETTINGS: 'COMPILER_INDEX_STORE_ENABLE=NO'
      GITHUB_CI: 'true' # This ensures it's available during pod install
      PLATFORM: ios
      METAMASK_ENVIRONMENT: ${{ inputs.metamask_environment }}
      METAMASK_BUILD_TYPE: ${{ inputs.build_type }}
      IS_TEST: true
      E2E: 'true'
      IGNORE_BOXLOGS_DEVELOPMENT: true
      CI: 'true'
      NODE_OPTIONS: '--max-old-space-size=8192'
      BRIDGE_USE_DEV_APIS: 'true'
      RAMP_INTERNAL_BUILD: 'true'
      SEEDLESS_ONBOARDING_ENABLED: 'true'
      MM_NOTIFICATIONS_UI_ENABLED: 'true'
      MM_SECURITY_ALERTS_API_ENABLED: 'true'
      YARN_ENABLE_GLOBAL_CACHE: 'true'
      MM_POOLED_STAKING_ENABLED: 'true'
      FEATURES_ANNOUNCEMENTS_ACCESS_TOKEN: ${{ secrets.FEATURES_ANNOUNCEMENTS_ACCESS_TOKEN }}
      FEATURES_ANNOUNCEMENTS_SPACE_ID: ${{ secrets.FEATURES_ANNOUNCEMENTS_SPACE_ID }}
      SEGMENT_WRITE_KEY_QA: ${{ secrets.SEGMENT_WRITE_KEY_QA }}
      SEGMENT_PROXY_URL_QA: ${{ secrets.SEGMENT_PROXY_URL_QA }}
      SEGMENT_DELETE_API_SOURCE_ID_QA: ${{ secrets.SEGMENT_DELETE_API_SOURCE_ID_QA }}
      SEGMENT_REGULATIONS_ENDPOINT_QA: ${{ secrets.SEGMENT_REGULATIONS_ENDPOINT_QA }}
      MM_SENTRY_DSN_TEST: ${{ secrets.MM_SENTRY_DSN_TEST }}
      MM_SENTRY_AUTH_TOKEN: ${{ secrets.MM_SENTRY_AUTH_TOKEN }}
      GOOGLE_SERVICES_B64_IOS: ${{ secrets.GOOGLE_SERVICES_B64_IOS }}
      GOOGLE_SERVICES_B64_ANDROID: ${{ secrets.GOOGLE_SERVICES_B64_ANDROID }}
      MM_INFURA_PROJECT_ID: ${{ secrets.MM_INFURA_PROJECT_ID }}
      MM_PREDICT_GTM_MODAL_ENABLED: 'false'

    steps:
      # Get the source code from the repository
      - name: Checkout repo
        uses: actions/checkout@v6

      - name: Check force-builds override
        id: force-builds
        uses: ./.github/actions/check-force-builds
        with:
          github-token: ${{ github.token }}

      - name: Report source fingerprint
        run: |
          if [[ -z "$SOURCE_FINGERPRINT" ]]; then
            echo "::warning::No source-fingerprint provided (likely a forked PR); artifact reuse disabled."
          else
            echo "Source fingerprint: $SOURCE_FINGERPRINT"
          fi
        env:
          SOURCE_FINGERPRINT: ${{ inputs.source-fingerprint }}

      - name: Find reusable build from prior run
        id: find-reusable-build
        if: ${{ steps.force-builds.outputs.force != 'true' && inputs.source-fingerprint != '' }}
        uses: ./.github/actions/find-reusable-build
        with:
          fingerprint: ${{ inputs.source-fingerprint }}
          artifact-names: '["${{ inputs.build_type }}-${{ inputs.metamask_environment }}-MetaMask.app"]'
          github-token: ${{ github.token }}

      - name: Download reusable iOS build from prior run
        id: download-reusable-app
        if: ${{ steps.find-reusable-build.outputs.found == 'true' }}
        continue-on-error: true
        uses: actions/download-artifact@v4
        with:
          name: ${{ inputs.build_type }}-${{ inputs.metamask_environment }}-MetaMask.app
          path: ios/build/Build/Products/Release-iphonesimulator/MetaMask.app
          github-token: ${{ github.token }}
          repository: ${{ github.repository }}
          run-id: ${{ steps.find-reusable-build.outputs.run-id }}

      - name: Log reused iOS build source
        if: ${{ steps.download-reusable-app.outcome == 'success' }}
        run: |
          echo "Reusing iOS build from run ${{ steps.find-reusable-build.outputs.run-id }}"
          echo "Source SHA: ${{ steps.find-reusable-build.outputs.source-sha }}"
          echo "Source branch: ${{ steps.find-reusable-build.outputs.source-branch }}"
        shell: bash

      - name: Compute native-build gate
        id: gate
        run: |
          if [[ "${{ steps.find-reusable-build.outputs.found }}" == "true" \
             && "${{ steps.download-reusable-app.outcome }}" == "success" ]]; then
            echo "needs-native-build=false" >> "$GITHUB_OUTPUT"
            echo "Reuse path active (cross-run artifact download succeeded); heavy native setup will be skipped."
          else
            if [[ "${{ steps.find-reusable-build.outputs.found }}" == "true" ]]; then
              echo "::warning::Reusable run was found but artifact download failed (outcome=${{ steps.download-reusable-app.outcome }}); falling back to fresh native build."
            fi
            echo "needs-native-build=true" >> "$GITHUB_OUTPUT"
            echo "No reuse path; full native build + setup will run."
          fi
        shell: bash

      # -------------------------------------------------------------------------
      # Heavy native setup — only runs on a full native-build path.
      # -------------------------------------------------------------------------

      - name: Restore Xcode derived data from branch cache
        id: xcode-restore-cache
        if: ${{ steps.gate.outputs.needs-native-build == 'true' && inputs.runner_provider != 'namespace' }}
        # This action automatically updates the cache at the end of the workflow
        uses: cirruslabs/cache@bba69c6578b863ad0398ad40567bd2ef70290fe0 # v4
        with:
          path: |
            ~/Library/Developer/Xcode/DerivedData
            ios/build
          key: ${{ runner.os }}-xcode-${{ github.ref_name }}-${{ env.XCODE_CACHE_VERSION }}-${{ hashFiles('ios/**/*.{h,m,mm,swift}', 'ios/**/Podfile.lock', 'yarn.lock') }}

      - name: Restore Xcode derived data from main cache
        if: ${{ steps.gate.outputs.needs-native-build == 'true' && steps.xcode-restore-cache.outputs.cache-hit != 'true' && github.ref_name != 'main' && inputs.runner_provider != 'namespace' }}
        id: xcode-restore-cache-main
        # This will only restore the cache, not update it
        uses: cirruslabs/cache/restore@bba69c6578b863ad0398ad40567bd2ef70290fe0 # v4
        with:
          path: |
            ~/Library/Developer/Xcode/DerivedData
            ios/build
          key: ${{ runner.os }}-xcode-main-${{ env.XCODE_CACHE_VERSION }}-${{ hashFiles('ios/**/*.{h,m,mm,swift}', 'ios/**/Podfile.lock', 'yarn.lock') }}

      # Namespace's built-in cocoapods preset handles the CocoaPods cache paths upstream.
      # Validated to work without a separate stale-state clear step (A/B tested 2026-05-11).
      - name: Configure Namespace iOS cache
        if: ${{ steps.gate.outputs.needs-native-build == 'true' && inputs.runner_provider == 'namespace' }}
        uses: namespacelabs/nscloud-cache-action@15799a6b54e5765f85b2aac25b3f0df43ed571c0 # v1.4.3
        with:
          cache: cocoapods

      # Install Node.js, Xcode tools, and other iOS development dependencies.
      - name: Installing iOS Environment Setup
        if: ${{ steps.gate.outputs.needs-native-build == 'true' }}
        timeout-minutes: 15
        uses: ./.github/actions/setup-e2e-env
        with:
          platform: ios
          setup-simulator: false
          install-foundry: false

      - name: Print iOS tool versions
        if: ${{ steps.gate.outputs.needs-native-build == 'true' }}
        run: |
          echo "🔧 Node.js Version:"
          node -v || echo "Node not found"
          echo "🧶 Yarn Version:"
          yarn -v || echo "Yarn not found"
          echo "📦 CocoaPods Version:"
          pod --version || echo "CocoaPods not found"
          echo "🛠️ Xcode Path:"
          xcode-select -p || echo "Xcode not found"
          echo "📱 Booted iOS Simulators:"
          xcrun simctl list | grep Booted || echo "No booted simulators found"
        shell: bash

      # Clean iOS plist files to prevent extended attribute issues
      - name: Clean iOS plist files
        if: ${{ steps.gate.outputs.needs-native-build == 'true' }}
        run: find ios -name "*.plist" -exec xattr -c {} \;

      - name: Restore .metamask folder
        if: ${{ steps.gate.outputs.needs-native-build == 'true' }}
        id: restore-metamask
        uses: actions/cache@v4
        with:
          path: .metamask
          key: .metamask-${{ hashFiles('package.json', 'yarn.lock') }}

      # Run project setup with retry for better resilience
      - name: Setup project dependencies with retry
        if: ${{ steps.gate.outputs.needs-native-build == 'true' }}
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: |
            echo "🚀 Setting up project..."
            yarn setup:github-ci --build-ios --no-build-android

      - name: Setup Node.js (reuse-hit path)
        if: ${{ steps.gate.outputs.needs-native-build != 'true' }}
        uses: actions/setup-node@v6
        with:
          node-version: '20.18.0'

      - name: Enable corepack (reuse-hit path)
        if: ${{ steps.gate.outputs.needs-native-build != 'true' }}
        run: |
          corepack enable
          corepack prepare yarn@3.8.7 --activate
        shell: bash

      - name: Restore yarn cache (reuse-hit path)
        if: ${{ steps.gate.outputs.needs-native-build != 'true' }}
        uses: actions/cache@v4
        with:
          path: |
            node_modules
          key: e2e-yarn-ios-${{ runner.os }}-${{ hashFiles('yarn.lock') }}

      - name: Install JS dependencies (reuse-hit path)
        if: ${{ steps.gate.outputs.needs-native-build != 'true' }}
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: yarn install --immutable
        env:
          NODE_OPTIONS: --max-old-space-size=4096
          YARN_ENABLE_GLOBAL_CACHE: 'true'

      - name: Restore .metamask folder (reuse-hit path)
        if: ${{ steps.gate.outputs.needs-native-build != 'true' }}
        id: restore-metamask-lean
        uses: actions/cache@v4
        with:
          path: .metamask
          key: .metamask-${{ hashFiles('package.json', 'yarn.lock') }}

      - name: Run lightweight project setup (reuse-hit path)
        if: ${{ steps.gate.outputs.needs-native-build != 'true' }}
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: |
            echo "📦 Setting up project (lightweight, skips Xcode build)..."
            yarn setup:github-ci --no-build-ios --no-build-android

      # Build the iOS E2E app for simulator
      - name: Build iOS E2E App
        if: ${{ steps.gate.outputs.needs-native-build == 'true' }}
        run: |
          echo "🏗 Building iOS E2E App..."
          export NODE_OPTIONS="--max-old-space-size=8192"
          yarn build:ios:main:e2e
        shell: bash
        env:
          PLATFORM: ios
          METAMASK_ENVIRONMENT: main
          METAMASK_BUILD_TYPE: main
          IS_TEST: true
          IS_SIM_BUILD: 'true' # Ensures simulator build (.app) not device build (.ipa)
          IGNORE_BOXLOGS_DEVELOPMENT: true
          GITHUB_CI: 'true'
          CI: 'true'

          NODE_OPTIONS: '--max_old_space_size=4096' # Increase memory limit for build

          SEGMENT_WRITE_KEY_QA: ${{ secrets.SEGMENT_WRITE_KEY_QA }}
          SEGMENT_PROXY_URL_QA: ${{ secrets.SEGMENT_PROXY_URL_QA }}
          SEGMENT_DELETE_API_SOURCE_ID_QA: ${{ secrets.SEGMENT_DELETE_API_SOURCE_ID_QA }}
          SEGMENT_REGULATIONS_ENDPOINT_QA: ${{ secrets.SEGMENT_REGULATIONS_ENDPOINT_QA }}

          MM_SENTRY_DSN_TEST: ${{ secrets.MM_SENTRY_DSN_TEST }}
          MM_SENTRY_AUTH_TOKEN: ${{ secrets.MM_SENTRY_AUTH_TOKEN }}

          GOOGLE_SERVICES_B64_IOS: ${{ secrets.GOOGLE_SERVICES_B64_IOS }}
          GOOGLE_SERVICES_B64_ANDROID: ${{ secrets.GOOGLE_SERVICES_B64_ANDROID }}

      - name: Repack iOS app with JS updates using @expo/repack-app
        if: ${{ steps.gate.outputs.needs-native-build != 'true' }}
        run: |
          echo "📦 Repacking iOS app with updated JavaScript bundle using @expo/repack-app..."
          # Use the optimized repack script which uses @expo/repack-app
          yarn build:repack:ios
          echo "📦 Final app size: $(du -sh "ios/build/Build/Products/Release-iphonesimulator/MetaMask.app" | cut -f1)"
        env:
          PLATFORM: ios
          METAMASK_ENVIRONMENT: qa
          METAMASK_BUILD_TYPE: main
          IS_TEST: true
          E2E: 'true'
          IGNORE_BOXLOGS_DEVELOPMENT: true
          GITHUB_CI: 'true'
          CI: 'true'
          NODE_OPTIONS: '--max-old-space-size=8192'
          METRO_MAX_WORKERS: '6'
          BRIDGE_USE_DEV_APIS: 'true'
          RAMP_INTERNAL_BUILD: 'true'
          SEEDLESS_ONBOARDING_ENABLED: 'true'
          MM_NOTIFICATIONS_UI_ENABLED: 'true'
          MM_SECURITY_ALERTS_API_ENABLED: 'true'
          FEATURES_ANNOUNCEMENTS_ACCESS_TOKEN: ${{ secrets.FEATURES_ANNOUNCEMENTS_ACCESS_TOKEN }}
          FEATURES_ANNOUNCEMENTS_SPACE_ID: ${{ secrets.FEATURES_ANNOUNCEMENTS_SPACE_ID }}
          SEGMENT_WRITE_KEY_QA: ${{ secrets.SEGMENT_WRITE_KEY_QA }}
          SEGMENT_PROXY_URL_QA: ${{ secrets.SEGMENT_PROXY_URL_QA }}
          SEGMENT_DELETE_API_SOURCE_ID_QA: ${{ secrets.SEGMENT_DELETE_API_SOURCE_ID_QA }}
          SEGMENT_REGULATIONS_ENDPOINT_QA: ${{ secrets.SEGMENT_REGULATIONS_ENDPOINT_QA }}
          MM_SENTRY_DSN_TEST: ${{ secrets.MM_SENTRY_DSN_TEST }}
          MM_SENTRY_AUTH_TOKEN: ${{ secrets.MM_SENTRY_AUTH_TOKEN }}
          GOOGLE_SERVICES_B64_IOS: ${{ secrets.GOOGLE_SERVICES_B64_IOS }}
          GOOGLE_SERVICES_B64_ANDROID: ${{ secrets.GOOGLE_SERVICES_B64_ANDROID }}
          MM_INFURA_PROJECT_ID: ${{ secrets.MM_INFURA_PROJECT_ID }}

      # Xcode on case-insensitive APFS can store the bundle executable with wrong case (e.g. "metamask"
      # vs CFBundleExecutable "MetaMask"), causing xcrun simctl install to fail with a case-sensitive
      # directory lookup on the test runner. actions/upload-artifact also strips execute permissions.
      - name: Fix iOS bundle executable case and permissions before upload
        run: |
          APP_PATH="ios/build/Build/Products/Release-iphonesimulator/MetaMask.app"
          BUNDLE_EXEC=$(/usr/libexec/PlistBuddy -c "Print CFBundleExecutable" "$APP_PATH/Info.plist" 2>/dev/null)
          if [ -z "$BUNDLE_EXEC" ]; then
            echo "Could not read CFBundleExecutable from Info.plist"
            exit 1
          fi

          ACTUAL_PATH=$(find "$APP_PATH" -maxdepth 1 -iname "$BUNDLE_EXEC" -type f | head -1)
          if [ -z "$ACTUAL_PATH" ]; then
            echo "Bundle executable not found: $BUNDLE_EXEC"
            exit 1
          fi

          # Two-step rename to fix case on case-insensitive APFS (direct rename is a no-op)
          if [ "$(basename "$ACTUAL_PATH")" != "$BUNDLE_EXEC" ]; then
            mv "$ACTUAL_PATH" "$APP_PATH/${BUNDLE_EXEC}_fix"
            mv "$APP_PATH/${BUNDLE_EXEC}_fix" "$APP_PATH/$BUNDLE_EXEC"
          fi

          chmod +x "$APP_PATH/$BUNDLE_EXEC"
        shell: bash

      # Upload the iOS .app file that works in simulators
      - name: Upload iOS APP Artifact (Simulator)
        id: upload-app
        uses: actions/upload-artifact@v4
        with:
          name: ${{ inputs.build_type }}-${{ inputs.metamask_environment }}-MetaMask.app
          path: ios/build/Build/Products/Release-iphonesimulator/MetaMask.app
          retention-days: 7
          if-no-files-found: error
        continue-on-error: true

      # Upload source map file for crash debugging and error tracking.
      # Both paths produce it: `yarn build:ios:main:e2e` via
      # `scripts/ios/bundle-js-and-sentry-upload.sh` and `yarn build:repack:ios`
      # via `scripts/repack.js` both write to `sourcemaps/ios/index.js.map`.
      - name: Upload iOS Source Map
        id: upload-sourcemap
        uses: actions/upload-artifact@v4
        with:
          name: ${{ inputs.build_type }}-${{ inputs.metamask_environment }}-index.js.map
          path: sourcemaps/ios/index.js.map
          retention-days: 7
          if-no-files-found: error
        continue-on-error: true

      # Generate artifact download URL and display upload status summary
      - name: Set Artifacts URL and Status
        id: set-artifacts-url
        run: |
          ARTIFACTS_URL="https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
          echo "artifacts-url=${ARTIFACTS_URL}" >> "$GITHUB_OUTPUT"
          echo "📦 Artifacts available at: ${ARTIFACTS_URL}"
          echo ""
          echo "Upload Status Summary:"
          echo "- APP (Simulator): ${{ steps.upload-app.outcome }}"
          echo "- Source Map: ${{ steps.upload-sourcemap.outcome }}"

        env:
          GITHUB_REPOSITORY: '${{ github.repository }}'
          GITHUB_RUN_ID: '${{ github.run_id }}'