ci.yml

name: ci

on:
  push:
    branches: [main]
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
    branches-ignore:
      - stable
  merge_group:
  schedule:
    # Run the full suite "overnight," once every hour from 2:00am UTC until 6:00am UTC.
    # This helps to identy the flaky and failed tests on main branch
    - cron: '0 2-6 * * *'
  workflow_dispatch:
    inputs:
      runner_provider:
        description: Runner provider for this manual trial run
        required: true
        type: choice
        options:
          - current
          - namespace
        default: current

concurrency:
  group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.sha || github.ref }}
  cancel-in-progress: ${{ !(contains(github.ref, 'refs/heads/main') || contains(github.ref, 'refs/heads/stable')) }}

jobs:
  get_requirements:
    name: Get workflow and job requirements
    uses: ./.github/workflows/get-requirements.yml

  check-diff:
    name: Check diff
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ios-build' || 'macos-latest' }}
    if: ${{ needs.get_requirements.outputs.skip_everything != 'true' }}
    needs:
      - get_requirements
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          cache: yarn
      - uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb #v1
        with:
          ruby-version: '3.2.9'
        env:
          BUNDLE_GEMFILE: ios/Gemfile
      - name: Install Yarn dependencies with retry
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: yarn install --immutable
      - name: Restore .metamask folder
        id: restore-metamask
        uses: actions/cache@v4
        with:
          path: .metamask
          key: .metamask-${{ hashFiles('package.json', 'yarn.lock') }}

      - name: Install Foundry if cache missed
        if: steps.restore-metamask.outputs.cache-hit != 'true'
        run: yarn install:foundryup
      - name: Clean state and following up dependencies installation with retry
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: yarn setup:github-ci
      - name: Require clean working directory
        shell: bash
        run: |
          if ! git diff --exit-code; then
            echo "Working tree dirty at end of job"
            exit 1
          else
            echo "No changes detected"
          fi

  post-build-source-hash:
    name: Post build-source-hash commit status
    runs-on: ubuntu-latest
    permissions:
      contents: read
      statuses: write
    needs:
      - get_requirements
    outputs:
      fingerprint: ${{ steps.publish.outputs.fingerprint }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
          cache: yarn
      - name: Install Yarn dependencies with retry
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: yarn install --immutable
      - name: Post build-source-hash commit status
        id: publish
        uses: ./.github/actions/post-build-source-hash
        with:
          github-token: ${{ github.token }}
          # .head.sha = PR head (pull_request events); github.sha fallback = pushed/scheduled commit
          # (push to main, merge_group, schedule) where no PR payload exists.
          target-sha: ${{ github.event.pull_request.head.sha || github.sha }}

  dedupe:
    name: Dedupe
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    if: ${{ needs.get_requirements.outputs.skip_everything != 'true' }}
    needs:
      - get_requirements
    steps:
      - uses: actions/checkout@v6
      - name: Configure Namespace cache
        if: ${{ inputs.runner_provider == 'namespace' }}
        uses: namespacelabs/nscloud-cache-action@15799a6b54e5765f85b2aac25b3f0df43ed571c0 # v1
        with:
          path: |
            ~/.cache/yarn
            .metamask
            node_modules
            .yarn/cache
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          cache: ${{ inputs.runner_provider != 'namespace' && 'yarn' || '' }}
      - name: Install Yarn dependencies with retry
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: yarn install --immutable
      - name: Clean state and following up dependencies installation
        run: yarn setup:github-ci --node
      - name: Deduplicate dependencies with retry
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: yarn deduplicate
      - name: Print error if duplicates found
        shell: bash
        run: |
          if ! git diff --exit-code; then
            echo "Duplicate dependencies detected; run 'yarn deduplicate' to remove them"
            exit 1
          fi

  git-safe-dependencies:
    name: Run `@lavamoat/git-safe-dependencies`
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    if: ${{ needs.get_requirements.outputs.skip_everything != 'true' }}
    needs:
      - get_requirements
    steps:
      - uses: actions/checkout@v6
      - name: Configure Namespace cache
        if: ${{ inputs.runner_provider == 'namespace' }}
        uses: namespacelabs/nscloud-cache-action@15799a6b54e5765f85b2aac25b3f0df43ed571c0 # v1
        with:
          path: |
            ~/.cache/yarn
            .metamask
            node_modules
            .yarn/cache
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          cache: ${{ inputs.runner_provider != 'namespace' && 'yarn' || '' }}
      - name: Install Yarn dependencies with retry
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: yarn install --immutable
      - name: Clean state and following up dependencies installation
        run: yarn setup:github-ci --node
      - name: Run @lavamoat/git-safe-dependencies with retry
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: yarn git-safe-dependencies

  scripts:
    name: Run `${{ matrix.scripts }}`
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    if: ${{ needs.get_requirements.outputs.skip_everything != 'true' }}
    needs:
      - get_requirements
    strategy:
      matrix:
        scripts:
          - lint
          - lint:tsc
          - format:check
          - audit:ci
          - test:depcheck
          - test:tgz-check
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 2
      - name: Configure Namespace cache
        if: ${{ inputs.runner_provider == 'namespace' }}
        uses: namespacelabs/nscloud-cache-action@15799a6b54e5765f85b2aac25b3f0df43ed571c0 # v1
        with:
          path: |
            ~/.cache/yarn
            .metamask
            node_modules
            .yarn/cache
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          cache: ${{ inputs.runner_provider != 'namespace' && 'yarn' || '' }}
      - name: Install Yarn dependencies with retry
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: yarn install --immutable
      - name: Clean state and following up dependencies installation
        run: yarn setup:github-ci --node
      - run: yarn ${{ matrix['scripts'] }}
      - name: Require clean working directory
        shell: bash
        run: |
          if ! git diff --exit-code; then
            echo "Working tree dirty at end of job"
            exit 1
          else
            echo "No changes detected"
          fi

  js-bundle-size-check:
    name: JS bundle size check
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    if: ${{ needs.get_requirements.outputs.skip_everything != 'true' }}
    needs:
      - get_requirements
    permissions:
      contents: read
      statuses: write
    steps:
      - uses: actions/checkout@v6
      - name: Configure Namespace cache
        if: ${{ inputs.runner_provider == 'namespace' }}
        uses: namespacelabs/nscloud-cache-action@15799a6b54e5765f85b2aac25b3f0df43ed571c0 # v1
        with:
          path: |
            ~/.cache/yarn
            .metamask
            node_modules
            .yarn/cache
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          cache: ${{ inputs.runner_provider != 'namespace' && 'yarn' || '' }}
      - name: Install Yarn dependencies with retry
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: yarn install --immutable
      - name: Clean state and following up dependencies installation
        run: yarn setup:github-ci --no-build-android

      - name: Generate iOS bundle
        run: yarn gen-bundle:ios
        env:
          NODE_OPTIONS: --max_old_space_size=12288

      - name: Check bundle size
        if: github.event_name == 'pull_request'
        env:
          GITHUB_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euo pipefail
          # Baseline is the latest successful ci/ios-js-bundle-size status on
          # github.event.pull_request.base.sha (GitHub's PR base commit for this run), not git merge-base(head, base).
          append_job_summary() {
            if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
              cat >> "$GITHUB_STEP_SUMMARY"
            fi
          }

          FILE_PATH='ios/main.jsbundle'
          CURRENT_MB="$(stat -c %s "$FILE_PATH" | awk '{print $1/1024/1024}')"
          echo "Current iOS JS bundle: ${CURRENT_MB} MB"

          BASELINE_MB=""
          BASE_SHA='${{ github.event.pull_request.base.sha }}'
          REPO_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}"

          if [[ -n "$BASE_SHA" ]]; then
            echo "Resolving baseline bundle size from ci/ios-js-bundle-size status on base commit ${BASE_SHA}"
            if ! STATUSES_JSON="$(
              curl -fsS \
                -H "Authorization: Bearer ${GITHUB_TOKEN}" \
                -H "Accept: application/vnd.github+json" \
                -H "X-GitHub-Api-Version: 2022-11-28" \
                "https://api.github.com/repos/${GITHUB_REPOSITORY}/commits/${BASE_SHA}/status"
            )"; then
              echo "::warning::Failed to fetch commit statuses for base ${BASE_SHA}; skipping iOS JS bundle delta check."
              append_job_summary <<EOF
          ### iOS JS bundle size (PR)

          **Result:** skipped — could not load [combined status](${REPO_URL}/commit/${BASE_SHA}) for PR base \`${BASE_SHA}\`.

          | | MiB |
          |---|--:|
          | Current bundle | ${CURRENT_MB} |

          Baseline would be read from the latest successful \`ci/ios-js-bundle-size\` status description on that base commit (MiB from awk, then an optional trailing semicolon, matching the main-branch post step).
          EOF
              exit 0
            fi
            DESC="$(
              echo "$STATUSES_JSON" | jq -r '
                (.statuses // [])
                | map(select(.context == "ci/ios-js-bundle-size" and .state == "success"))
                | sort_by(.updated_at // .created_at)
                | if length > 0 then .[-1].description else "" end
              '
            )"
            # Status description is "${FILE_SIZE_MB};" from the Post iOS JS bundle size step (awk MiB + ';').
            # Regex in a variable: ';' in an unquoted [[ =~ ... ]] pattern is parsed as a command separator (shellcheck SC1072).
            _bundle_desc_re='^[[:space:]]*([0-9]+(\.[0-9]*)?)[[:space:]]*;?[[:space:]]*$'
            if [[ "$DESC" =~ $_bundle_desc_re ]]; then
              BASELINE_MB="${BASH_REMATCH[1]}"
              echo "Baseline from base ref status: ${BASELINE_MB} MB"
            else
              echo "::warning::No successful ci/ios-js-bundle-size status (or unrecognized description) on base ${BASE_SHA}; skipping iOS JS bundle delta check."
              append_job_summary <<EOF
          ### iOS JS bundle size (PR)

          **Result:** skipped — no parseable \`ci/ios-js-bundle-size\` success status on PR base [\`${BASE_SHA}\`](${REPO_URL}/commit/${BASE_SHA}).

          | | MiB |
          |---|--:|
          | Current bundle | ${CURRENT_MB} |
          | Raw description | \`${DESC:-<empty>}\` |

          EOF
              exit 0
            fi
          else
            echo "::warning::Pull request base SHA is empty; skipping iOS JS bundle delta check."
            append_job_summary <<EOF
          ### iOS JS bundle size (PR)

          **Result:** skipped — \`github.event.pull_request.base.sha\` was empty.

          | | MiB |
          |---|--:|
          | Current bundle | ${CURRENT_MB} |

          EOF
            exit 0
          fi

          if [[ -z "${BASELINE_MB:-}" ]]; then
            echo "::warning::Baseline is undefined; skipping iOS JS bundle delta check."
            append_job_summary <<EOF
          ### iOS JS bundle size (PR)

          **Result:** skipped — baseline MiB was empty after parsing.

          | | MiB |
          |---|--:|
          | Current bundle | ${CURRENT_MB} |

          EOF
            exit 0
          fi

          DELTA_MB="$(echo "${CURRENT_MB} - ${BASELINE_MB}" | bc -l)"
          echo "Delta (current - baseline): ${DELTA_MB} MB"
          echo "::notice::iOS JS bundle delta vs baseline: ${DELTA_MB} MB (current ${CURRENT_MB} MB, baseline ${BASELINE_MB} MB)"
          if (( $(echo "${DELTA_MB} > 1" | bc -l) )); then
            echo "::error::JS bundle exceeds baseline by more than 1 MiB (delta ${DELTA_MB} MiB; current ${CURRENT_MB} MiB, baseline ${BASELINE_MB} MiB)."
            append_job_summary <<EOF
          ### iOS JS bundle size (PR)

          **Result:** failed — delta is more than 1 MiB above the status baseline on PR base [\`${BASE_SHA}\`](${REPO_URL}/commit/${BASE_SHA}).

          | | MiB |
          |---|--:|
          | PR base commit | — |
          | Baseline (from status) | ${BASELINE_MB} |
          | Current bundle | ${CURRENT_MB} |
          | Delta (current - baseline) | ${DELTA_MB} |

          EOF
            exit 1
          fi
          echo "JS bundle size check passed (delta is one or less)."
          append_job_summary <<EOF
          ### iOS JS bundle size (PR)

          **Result:** passed

          | | MiB |
          |---|--:|
          | PR base commit | [\`${BASE_SHA}\`](${REPO_URL}/commit/${BASE_SHA}) |
          | Baseline (from \`ci/ios-js-bundle-size\` status) | ${BASELINE_MB} |
          | Current bundle | ${CURRENT_MB} |
          | Delta (current - baseline) | ${DELTA_MB} |

          Fail threshold: more than 1 MiB above baseline. Baseline is **not** from \`git merge-base\`; it is the value posted to the PR base commit by CI.

          EOF

      - name: Post iOS JS bundle size to commit status
        if: ${{ github.ref == 'refs/heads/main' }}
        env:
          GITHUB_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euo pipefail
          FILE_PATH='ios/main.jsbundle'
          # Match scripts/js-bundle-stats.sh: GNU stat byte size, MiB via awk
          FILE_SIZE_MB="$(stat -c %s "$FILE_PATH" | awk '{print $1/1024/1024}')"
          echo "File size of $FILE_PATH: $FILE_SIZE_MB MB"
          COMMIT_SHA='${{ github.event.pull_request.head.sha || github.sha }}'
          TARGET_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
          BODY="$(jq -n \
            --arg state success \
            --arg context 'ci/ios-js-bundle-size' \
            --arg desc "${FILE_SIZE_MB};" \
            --arg target_url "$TARGET_URL" \
            '{
              state: $state,
              context: $context,
              description: ($desc | if length > 140 then .[0:140] else . end),
              target_url: $target_url
            }')"
          curl -fsS -X POST \
            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
            -H "Accept: application/vnd.github+json" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            "https://api.github.com/repos/${GITHUB_REPOSITORY}/statuses/${COMMIT_SHA}" \
            -d "$BODY"

      - name: Upload iOS bundle
        uses: actions/upload-artifact@v4
        with:
          name: ios-bundle
          path: ios/main.jsbundle
          retention-days: 7

  ship-js-bundle-size-check:
    name: Ship JS bundle size check
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    needs: [js-bundle-size-check]
    if: ${{ github.ref == 'refs/heads/main' }}
    steps:
      - uses: actions/checkout@v6

      - name: Download iOS bundle
        uses: actions/download-artifact@v4
        with:
          name: ios-bundle
          path: ios

      - name: Verify iOS bundle artifact layout
        shell: bash
        run: |
          set -euo pipefail
          ls -la ios/
          if [[ ! -f ios/main.jsbundle ]]; then
            echo "::error::Expected ios/main.jsbundle to be a regular file (artifact layout may be wrong)."
            exit 1
          fi

      - name: Report iOS JS bundle size and commit (main)
        run: |
          SHORT_SHA="$(git rev-parse --short HEAD)"
          FILE_PATH='ios/main.jsbundle'
          MB="$(stat -c %s "$FILE_PATH" | awk '{print $1/1024/1024}')"
          echo "commit_short=$SHORT_SHA"
          echo "::notice::iOS JS bundle (main): ${MB} MiB @ ${SHORT_SHA}"

      - name: Push bundle size to mobile_bundlesize_stats repo
        run: ./scripts/push-bundle-size.sh
        env:
          GITHUB_ACTOR: metamaskbot
          GITHUB_TOKEN: ${{ secrets.MOBILE_BUNDLESIZE_TOKEN }}

  check-workflows:
    name: Check workflows
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    if: ${{ needs.get_requirements.outputs.skip_everything != 'true' }}
    needs:
      - get_requirements
    steps:
      - uses: actions/checkout@v6
      - name: Download actionlint
        id: download-actionlint
        run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/62dc61a45fc95efe8c800af7a557ab0b9165d63b/scripts/download-actionlint.bash) 1.7.1
        shell: bash
      - name: Check workflow files
        run: ${{ steps.download-actionlint.outputs.executable }} -color -config-file .github/actionlint.yaml
        shell: bash

  unit-tests:
    name: Unit tests (${{ matrix.shard }})
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    if: ${{ needs.get_requirements.outputs.skip_everything != 'true' }}
    needs:
      - get_requirements
    strategy:
      matrix:
        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
    steps:
      - uses: actions/checkout@v6
      - name: Configure Namespace cache
        if: ${{ inputs.runner_provider == 'namespace' }}
        uses: namespacelabs/nscloud-cache-action@15799a6b54e5765f85b2aac25b3f0df43ed571c0 # v1
        with:
          path: |
            ~/.cache/yarn
            .metamask
            node_modules
            .yarn/cache
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          cache: ${{ inputs.runner_provider != 'namespace' && 'yarn' || '' }}
      - name: Install Yarn dependencies with retry
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: yarn install --immutable
      - name: Clean state and following up dependencies installation
        run: yarn setup:github-ci --node
      - name: Prepare results directory
        run: mkdir -p tests/results
      # The "10" in this command is the total number of shards. It must be kept
      # in sync with the length of matrix.shard
      - run: yarn test:unit --shard=${{ matrix.shard }}/10 --forceExit --silent --coverageReporters=json --json --outputFile=tests/results/unit-test-results-${{ matrix.shard }}.json
        env:
          NODE_OPTIONS: ${{ inputs.runner_provider == 'namespace' && '--max_old_space_size=12288' || '--max_old_space_size=20480' }}
      - name: Rename coverage report and extract test count for this shard
        shell: bash
        run: |
          mv ./tests/coverage/coverage-final.json ./tests/coverage/coverage-unit-${{ matrix.shard }}.json
          cp tests/results/unit-test-results-${{ matrix.shard }}.json ./tests/coverage/jest-results.json
          count=$(jq '(.numPassedTests // 0) + (.numFailedTests // 0)' tests/results/unit-test-results-${{ matrix.shard }}.json)
          echo "{\"count\": $count}" > ./tests/coverage/count.json
      - uses: actions/upload-artifact@v4
        with:
          name: coverage-unit-${{ matrix.shard }}
          path: ./tests/coverage/
          if-no-files-found: error
          retention-days: 7
      - name: Require clean working directory
        shell: bash
        run: |
          if ! git diff --exit-code; then
            echo "Working tree dirty at end of job"
            exit 1
          else
            echo "No changes detected"
          fi

  # We need to merge both unit and component view tests into a single coverage report so the PR coverage
  # threshold calculation is accurate.
  merge-unit-and-component-view-tests:
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    needs: [unit-tests, component-view-tests]
    if: ${{ !cancelled() && github.event_name != 'merge_group' }}
    steps:
      - uses: actions/checkout@v6
      - name: Configure Namespace cache
        if: ${{ inputs.runner_provider == 'namespace' }}
        uses: namespacelabs/nscloud-cache-action@15799a6b54e5765f85b2aac25b3f0df43ed571c0 # v1
        with:
          path: |
            ~/.cache/yarn
            .metamask
            node_modules
            .yarn/cache
      - name: Restore node_modules cache
        if: ${{ inputs.runner_provider != 'namespace' }}
        id: cache-node-modules
        uses: actions/cache@v4
        with:
          path: |
            node_modules
            .yarn/install-state.gz
          key: ${{ runner.os }}-node-modules-${{ hashFiles('yarn.lock') }}
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          cache: ${{ inputs.runner_provider != 'namespace' && 'yarn' || '' }}
      - name: Install Yarn dependencies with retry
        if: ${{ inputs.runner_provider == 'namespace' || steps.cache-node-modules.outputs.cache-hit != 'true' }}
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: yarn install --immutable
      - name: Clean state and following up dependencies installation
        run: yarn setup:github-ci --node
      - uses: actions/download-artifact@v4
        with:
          pattern: coverage-*
          path: tests/coverage/
      - name: Aggregate test counts and gather coverage reports
        shell: bash
        run: |
          unit_total=0
          for file in ./tests/coverage/coverage-unit-*/count.json; do
            [ -f "$file" ] || continue
            count=$(jq '.count // 0' "$file")
            unit_total=$((unit_total + count))
          done
          echo "{\"unit_test_number\": $unit_total}" > unit-test-stats.json
          echo "Unit test count: $unit_total"

          cv_total=0
          for file in ./tests/coverage/coverage-cv-*/count.json; do
            [ -f "$file" ] || continue
            count=$(jq '.count // 0' "$file")
            cv_total=$((cv_total + count))
          done
          echo "{\"component_view_test_number\": $cv_total}" > cv-test-stats.json
          echo "CV test count: $cv_total"

          mkdir -p tests/coverage-cv-merged
          for file in ./tests/coverage/coverage-cv-*/coverage-cv-*.json; do
            [ -f "$file" ] && cp "$file" ./tests/coverage-cv-merged/
          done

          mkdir -p tests/coverage-unit-merged
          for file in ./tests/coverage/coverage-unit-*/coverage-unit-*.json; do
            [ -f "$file" ] && cp "$file" ./tests/coverage-unit-merged/
          done

          find ./tests/coverage/coverage-* -name 'coverage-*.json' -exec mv {} ./tests/coverage/ \;
      - run: yarn test:merge-coverage
      - run: yarn test:validate-coverage
      - uses: actions/upload-artifact@v4
        with:
          name: lcov.info
          path: ./tests/merged-coverage/lcov.info
          if-no-files-found: error
          retention-days: 7
      - uses: actions/upload-artifact@v4
        with:
          name: cv-test-stats
          path: ./cv-test-stats.json
          if-no-files-found: error
          retention-days: 7
      - uses: actions/upload-artifact@v4
        with:
          name: unit-test-stats
          path: ./unit-test-stats.json
          if-no-files-found: error
          retention-days: 7
      - name: Generate CV test coverage report
        run: yarn nyc report --temp-dir ./tests/coverage-cv-merged --report-dir ./tests/coverage-cv-lcov --reporter html --reporter json-summary
      - uses: actions/upload-artifact@v4
        with:
          name: cv-test-coverage-html
          path: ./tests/coverage-cv-lcov/
          if-no-files-found: error
          retention-days: 7
      - uses: actions/upload-artifact@v4
        with:
          name: cv-test-coverage-summary
          path: ./tests/coverage-cv-lcov/coverage-summary.json
          if-no-files-found: error
          retention-days: 7
      - name: Generate unit test coverage summary
        run: yarn nyc report --temp-dir ./tests/coverage-unit-merged --report-dir ./tests/coverage-unit-lcov --reporter json-summary
      - uses: actions/upload-artifact@v4
        with:
          name: unit-test-coverage-summary
          path: ./tests/coverage-unit-lcov/coverage-summary.json
          if-no-files-found: error
          retention-days: 7
      - name: Require clean working directory
        shell: bash
        run: |
          if ! git diff --exit-code; then
            echo "Working tree dirty at end of job"
            exit 1
          else
            echo "No changes detected"
          fi

  component-view-tests:
    name: Component view tests
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    if: ${{ needs.get_requirements.outputs.skip_everything != 'true' }}
    needs:
      - get_requirements
    strategy:
      matrix:
        shard: [1, 2]
    steps:
      - uses: actions/checkout@v6
      - name: Configure Namespace cache
        if: ${{ inputs.runner_provider == 'namespace' }}
        uses: namespacelabs/nscloud-cache-action@15799a6b54e5765f85b2aac25b3f0df43ed571c0 # v1
        with:
          path: |
            ~/.cache/yarn
            .metamask
            node_modules
            .yarn/cache
      - name: Restore node_modules cache
        if: ${{ inputs.runner_provider != 'namespace' }}
        id: cache-node-modules
        uses: actions/cache@v4
        with:
          path: |
            node_modules
            .yarn/install-state.gz
          key: ${{ runner.os }}-node-modules-${{ hashFiles('yarn.lock') }}
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          cache: ${{ inputs.runner_provider != 'namespace' && 'yarn' || '' }}
      - name: Install Yarn dependencies with retry
        if: ${{ inputs.runner_provider == 'namespace' || steps.cache-node-modules.outputs.cache-hit != 'true' }}
        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
        with:
          timeout_minutes: 10
          max_attempts: 3
          retry_wait_seconds: 30
          command: yarn install --immutable
      - name: Clean state and following up dependencies installation
        run: yarn setup:github-ci --node
      - name: Prepare results directory
        run: mkdir -p tests/results
      - run: |
          yarn test:view:ci \
            --shard=${{ matrix.shard }}/2 \
            --json \
            --outputFile=tests/results/cv-test-results-${{ matrix.shard }}.json
        env:
          NODE_OPTIONS: ${{ inputs.runner_provider == 'namespace' && '--max-old-space-size=12288' || '--max-old-space-size=20480' }}
      - name: Rename coverage report and extract test count for this shard
        shell: bash
        run: |
          mv ./tests/coverage/coverage-final.json ./tests/coverage/coverage-cv-${{ matrix.shard }}.json
          cp tests/results/cv-test-results-${{ matrix.shard }}.json ./tests/coverage/jest-results.json
          count=$(jq '(.numPassedTests // 0) + (.numFailedTests // 0)' tests/results/cv-test-results-${{ matrix.shard }}.json)
          echo "{\"count\": $count}" > ./tests/coverage/count.json
      - uses: actions/upload-artifact@v4
        with:
          name: coverage-cv-${{ matrix.shard }}
          path: ./tests/coverage/
          if-no-files-found: error
          retention-days: 7

  smart-e2e-selection:
    name: 'Smart E2E Selection'
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    if: ${{ needs.get_requirements.outputs.run_smart_e2e_selection == 'true' }}
    needs:
      - get_requirements
    continue-on-error: true
    permissions:
      contents: read
      issues: write
      pull-requests: write
    outputs:
      ai_e2e_test_tags: ${{ steps.e2e-selection.outputs.ai_e2e_test_tags }}
      ai_confidence: ${{ steps.e2e-selection.outputs.ai_confidence }}
    steps:
      - name: Checkout for action definition
        uses: actions/checkout@v6
        with:
          sparse-checkout: |
            .github/actions/smart-e2e-selection
          sparse-checkout-cone-mode: false
          fetch-depth: 1

      - name: Run Smart E2E Selection
        id: e2e-selection
        uses: ./.github/actions/smart-e2e-selection
        with:
          claude-api-key: ${{ secrets.E2E_CLAUDE_API_KEY }}
          openai-api-key: ${{ secrets.E2E_OPENAI_API_KEY }}
          google-api-key: ${{ secrets.E2E_GEMINI_API_KEY }}
          github-token: ${{ github.token }}
          pr-number: ${{ github.event.pull_request.number }}
          repository: ${{ github.repository }}
          post-comment: 'true'
          base-ref: ${{ github.event.pull_request.base.ref }}

  build-android-apks:
    name: 'Build Android APKs'
    if: >-
      ${{
        !cancelled() &&
        needs.get_requirements.outputs.android_e2e_needed == 'true' &&
        !(fromJSON(needs.smart-e2e-selection.outputs.ai_confidence || '0') >= 80 && needs.smart-e2e-selection.outputs.ai_e2e_test_tags == '[]')
      }}
    permissions:
      contents: read
      id-token: write
      actions: read
      statuses: read
      pull-requests: read
    needs: [get_requirements, smart-e2e-selection, post-build-source-hash]
    uses: ./.github/workflows/build-android-e2e.yml
    with:
      build_type: 'main'
      metamask_environment: 'e2e'
      keystore_target: 'qa'
      source-fingerprint: ${{ needs.post-build-source-hash.outputs.fingerprint }}
      runner_provider: ${{ inputs.runner_provider }}
    secrets: inherit

  e2e-smoke-tests-android:
    name: 'Android E2E Smoke Tests'
    if: ${{ !cancelled() && needs.build-android-apks.result == 'success' }}
    permissions:
      contents: read
      id-token: write
    needs: [get_requirements, build-android-apks, smart-e2e-selection]
    uses: ./.github/workflows/run-e2e-smoke-tests-android.yml
    with:
      changed_files: ${{ needs.get_requirements.outputs.changed_files }}
      selected_tags: >-
        ${{
          (fromJSON(needs.smart-e2e-selection.outputs.ai_confidence || '0') >= 80 && needs.smart-e2e-selection.outputs.ai_e2e_test_tags) ||
          '["ALL"]'
        }}
      runner_provider: ${{ inputs.runner_provider }}
    secrets: inherit

  build-ios-apps:
    name: 'Build iOS Apps'
    if: >-
      ${{
        !cancelled() &&
        needs.get_requirements.outputs.ios_e2e_needed == 'true' &&
        !(fromJSON(needs.smart-e2e-selection.outputs.ai_confidence || '0') >= 80 && needs.smart-e2e-selection.outputs.ai_e2e_test_tags == '[]')
      }}
    permissions:
      contents: read
      id-token: write
      actions: read
      statuses: read
      pull-requests: read
    needs: [get_requirements, smart-e2e-selection, post-build-source-hash]
    uses: ./.github/workflows/build-ios-e2e.yml
    with:
      source-fingerprint: ${{ needs.post-build-source-hash.outputs.fingerprint }}
      runner_provider: ${{ inputs.runner_provider }}
    secrets: inherit

  ios-tests-ready:
    name: 'iOS Tests Ready'
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    if: ${{ !cancelled() && needs.build-ios-apps.result == 'success' }}
    needs: [build-ios-apps]
    steps:
      - name: iOS build complete
        run: echo "Dummy step to better visualize the Android and iOS E2E tests in Github workflow graph"

  e2e-smoke-tests-ios:
    name: 'iOS E2E Smoke Tests'
    if: ${{ !cancelled() && needs.ios-tests-ready.result == 'success' }}
    permissions:
      contents: read
      id-token: write
    needs: [get_requirements, ios-tests-ready, smart-e2e-selection]
    uses: ./.github/workflows/run-e2e-smoke-tests-ios.yml
    with:
      changed_files: ${{ needs.get_requirements.outputs.changed_files }}
      selected_tags: >-
        ${{
          (fromJSON(needs.smart-e2e-selection.outputs.ai_confidence || '0') >= 80 && needs.smart-e2e-selection.outputs.ai_e2e_test_tags) ||
          '["ALL"]'
        }}
      runner_provider: ${{ inputs.runner_provider }}
    secrets: inherit

  # Fixture validation — ensures committed E2E fixtures match the live app state schema
  validate-e2e-fixtures:
    name: 'Validate E2E Fixtures'
    if: ${{ needs.ios-tests-ready.result == 'success' && github.event_name == 'pull_request' }}
    permissions:
      contents: read
      id-token: write
    needs: [get_requirements, ios-tests-ready, smart-e2e-selection]
    uses: ./.github/workflows/run-e2e-workflow.yml
    with:
      test-suite-name: validate-e2e-fixtures
      platform: ios
      test_suite_tag: 'FixtureValidation'
      split_number: 1
      total_splits: 1
      build_type: 'main'
      metamask_environment: 'qa'
      runner_provider: ${{ inputs.runner_provider }}
    secrets: inherit

  report-fixture-validation:
    name: 'Report Fixture Validation'
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    if: ${{ !cancelled() && needs.validate-e2e-fixtures.result != 'skipped' }}
    needs: [validate-e2e-fixtures]
    permissions:
      pull-requests: write
    steps:
      - uses: actions/checkout@v6

      - name: Download fixture validation results
        continue-on-error: true
        uses: actions/download-artifact@v4
        with:
          name: test-e2e-main-validate-e2e-fixtures-junit-results
          path: fixture-results/

      - name: Report results
        env:
          RESULTS_PATH: fixture-results
          VALIDATION_RESULT: ${{ needs.validate-e2e-fixtures.result }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: node .github/scripts/e2e-report-fixture-validation.mjs

  sonar-cloud:
    name: SonarCloud analysis
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    needs: merge-unit-and-component-view-tests
    if: ${{ !cancelled() && github.event_name != 'merge_group' && !github.event.pull_request.head.repo.fork }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0 # SonarCloud needs a full checkout to perform necessary analysis
      - name: Configure Namespace cache
        if: ${{ inputs.runner_provider == 'namespace' }}
        uses: namespacelabs/nscloud-cache-action@15799a6b54e5765f85b2aac25b3f0df43ed571c0 # v1
        with:
          path: |
            ~/.cache/yarn
            .metamask
            node_modules
            .yarn/cache
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
      - uses: actions/download-artifact@v4
        with:
          name: lcov.info
          path: coverage/
      - name: Upload coverage reports to Codecov
        if: ${{ always() }}
        continue-on-error: true
        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
      - name: SonarCloud Scan
        if: ${{ env.HAVE_SONAR_TOKEN == 'true' }}
        continue-on-error: true
        # This is SonarSource/sonarqube-scan-action@v7.0.0
        uses: SonarSource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9
        env:
          HAVE_SONAR_TOKEN: ${{ secrets.SONAR_TOKEN != '' }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      - name: Require clean working directory
        shell: bash
        run: |
          if ! git diff --exit-code; then
            echo "Working tree dirty at end of job"
            exit 1
          else
            echo "No changes detected"
          fi

          # Revert git update-index --no-assume-unchanged for each entry
          echo "Reverting assume unchanged for the following paths:"
          for path in "${EXCLUDES[@]}"; do
            echo "$path"
            git update-index --no-assume-unchanged "$path"
          done

  sonar-cloud-quality-gate-status:
    name: SonarCloud quality gate status
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    needs: sonar-cloud
    if: ${{ !cancelled() && github.event_name != 'merge_group' && !github.event.pull_request.head.repo.fork }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
      - name: SonarCloud Quality Gate Status
        id: sonar-status
        env:
          REPO: ${{ github.repository }}
          ISSUE_NUMBER: ${{ github.event.issue.number || github.event.pull_request.number }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Skip step if event is not a PR
          if [[ "${{ github.event_name }}" != "pull_request" ]]; then
            echo "This job only runs for pull requests."
            exit 0
          fi

          # Bypass step if skip-sonar-cloud label is found
          LABEL=$(curl -s -H "Authorization: token $GITHUB_TOKEN" \
          "https://api.github.com/repos/$REPO/issues/$ISSUE_NUMBER/labels" | \
          jq -r '.[] | select(.name=="skip-sonar-cloud") | .name')

          if [[ "$LABEL" == "skip-sonar-cloud" ]]; then
            echo "skip-sonar-cloud label found. Skipping SonarCloud Quality Gate check."
          else
            sleep 30

            PROJECT_KEY="metamask-mobile"
            PR_NUMBER="${{ github.event.pull_request.number }}"
            SONAR_TOKEN="${{ secrets.SONAR_TOKEN }}"

            if [ -z "$PR_NUMBER" ]; then
              echo "No pull request number found. Failing the check."
              exit 1
            fi

            RESPONSE=$(curl -s -u "$SONAR_TOKEN:" \
              "https://sonarcloud.io/api/qualitygates/project_status?projectKey=$PROJECT_KEY&pullRequest=$PR_NUMBER")
            echo "SonarCloud API Response: $RESPONSE"

            STATUS=$(echo "$RESPONSE" | jq -r '.projectStatus.status')

            if [[ "$STATUS" == "ERROR" ]]; then
              echo "Quality Gate failed."
              exit 1
            elif [[ "$STATUS" == "OK" ]]; then
              echo "Quality Gate passed."
            else
              echo "Could not determine Quality Gate status."
              exit 1
            fi
          fi

  check-all-jobs-pass:
    name: Check all jobs pass
    # Run the aggregate gate even when optional dependencies are skipped.
    # The composite action decides which skipped jobs are acceptable.
    if: ${{ always() && !cancelled() }}
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    needs:
      - get_requirements
      - check-diff
      - dedupe
      - scripts
      - unit-tests
      - component-view-tests
      - check-workflows
      - js-bundle-size-check
      - sonar-cloud-quality-gate-status
      - build-android-apks
      - build-ios-apps
      - e2e-smoke-tests-android
      - e2e-smoke-tests-ios
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1
          sparse-checkout: |
            .github/actions/ci-status-gate

      - name: Evaluate CI status
        uses: ./.github/actions/ci-status-gate
        with:
          needs-json: ${{ toJSON(needs) }}
          requirement-context-json: ${{ toJSON(needs.get_requirements.outputs) }}
          e2e-job-regex: '^(build-android-apks|build-ios-apps|e2e-smoke-tests-android|e2e-smoke-tests-ios)$'
          event-name: ${{ github.event_name }}
          is-fork: ${{ github.event.pull_request.head.repo.fork == true }}

  log-merge-group-failure:
    name: Log merge group failure
    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
    # Only run this job if the merge group event fails, skip on forks
    if: ${{ github.event_name == 'merge_group' && failure() }}
    needs:
      - check-all-jobs-pass
    steps:
      - name: Log merge group failure to Google Sheets
        uses: MetaMask/github-tools/.github/actions/log-merge-group-failure@v1
        with:
          google-application-credentials: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
          google-service-account: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
          spreadsheet-id: ${{ secrets.GOOGLE_MERGE_QUEUE_SPREADSHEET_ID }}
          sheet-name: ${{ secrets.GOOGLE_MERGE_QUEUE_SHEET_NAME }}