feat(ci): POC Bitrise GH Action runners for iOS E2E (#28791)

## **Description**

Adds a temporary optional workflow to benchmark iOS E2E builds and tests
on Bitrise-provided GitHub Actions self-hosted runners as an alternative
to the current Cirrus CI macOS runners.

**What changed:**
- New `temp-bitrise-ios-e2e.yml` workflow (standalone benchmarking, not
part of CI gate)
- `run-e2e-workflow.yml` added `use_bitrise_runner` boolean input for
optional Bitrise runner routing, plus Vagrant path fix
- `run-e2e-smoke-tests-ios.yml` threaded `use_bitrise_runner` through
all 13 smoke test jobs

**Trigger strategy:**
- PRs: opt-in via `bitrise-poc` label only (label-based + `synchronize`)
- Main: hourly cron for baseline data collection
- Concurrency group per branch (stale pushes auto-cancelled)
- Fork PRs blocked from running on self-hosted runners

**Existing CI pipeline is NOT modified.** All defaults preserved (Cirrus
runners remain the default).

**Security:**
- Label-gated trigger (no automatic execution on all PRs)
- Fork PR guard (`!github.event.pull_request.head.repo.fork`)
- Boolean input with hardcoded runner group name (no string injection)
- `configure-keystores: false` (no signing certificates on Bitrise
runners)

## **Changelog**

CHANGELOG entry: null

## **Related issues**

Fixes: INFRA-3527

## **Manual testing steps**

```gherkin
Feature: Bitrise iOS E2E Runner Benchmarking

  Scenario: Trigger benchmarking workflow via label
    Given a PR exists on the repo
    When user adds the bitrise-poc label
    Then the iOS build starts on Bitrise runner
    And all 13 smoke test suites run on Bitrise runners
    And artifacts are uploaded
    And no sensitive data appears in workflow logs

  Scenario: Fork PR does not trigger
    Given a fork PR exists with the bitrise-poc label
    Then the workflow is skipped
```

## **Screenshots/Recordings**

N/A (CI workflow changes only)

## **Pre-merge author checklist**

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Qbandev

.github/actionlint.yaml

@@ -15,6 +15,8 @@ self-hosted-runner:
     - "ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-lg"
     - "ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-xl"
     - "low-priority"
+    - "bitrise_pool_name:DemoFA"
+    - "bitrise_pool_name:DemoFAXL"
 
 # Configuration variables in array of strings defined in your repository or
 # organization. `null` means disabling configuration variables check.

.github/workflows/run-e2e-smoke-tests-ios.yml

@@ -13,6 +13,11 @@ on:
         required: false
         type: string
         default: ''
+      use_bitrise_runner:
+        description: 'Route iOS E2E jobs to Bitrise self-hosted runner group.'
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -35,6 +40,7 @@ jobs:
       changed_files: ${{ inputs.changed_files }}
       build_type: 'main'
       metamask_environment: 'qa'
+      use_bitrise_runner: ${{ inputs.use_bitrise_runner }}
     secrets: inherit
 
   trade-ios-smoke:
@@ -53,6 +59,7 @@ jobs:
       changed_files: ${{ inputs.changed_files }}
       build_type: 'main'
       metamask_environment: 'qa'
+      use_bitrise_runner: ${{ inputs.use_bitrise_runner }}
     secrets: inherit
 
   perps-ios-smoke:
@@ -71,6 +78,7 @@ jobs:
       changed_files: ${{ inputs.changed_files }}
       build_type: 'main'
       metamask_environment: 'qa'
+      use_bitrise_runner: ${{ inputs.use_bitrise_runner }}
     secrets: inherit
 
   wallet-platform-ios-smoke:
@@ -89,6 +97,7 @@ jobs:
       changed_files: ${{ inputs.changed_files }}
       build_type: 'main'
       metamask_environment: 'qa'
+      use_bitrise_runner: ${{ inputs.use_bitrise_runner }}
     secrets: inherit
 
   identity-ios-smoke:
@@ -107,6 +116,7 @@ jobs:
       changed_files: ${{ inputs.changed_files }}
       build_type: 'main'
       metamask_environment: 'qa'
+      use_bitrise_runner: ${{ inputs.use_bitrise_runner }}
     secrets: inherit
 
   accounts-ios-smoke:
@@ -125,6 +135,7 @@ jobs:
       changed_files: ${{ inputs.changed_files }}
       build_type: 'main'
       metamask_environment: 'qa'
+      use_bitrise_runner: ${{ inputs.use_bitrise_runner }}
     secrets: inherit
 
   network-abstraction-ios-smoke:
@@ -143,6 +154,7 @@ jobs:
       changed_files: ${{ inputs.changed_files }}
       build_type: 'main'
       metamask_environment: 'qa'
+      use_bitrise_runner: ${{ inputs.use_bitrise_runner }}
     secrets: inherit
 
   network-expansion-ios-smoke:
@@ -161,6 +173,7 @@ jobs:
       changed_files: ${{ inputs.changed_files }}
       build_type: 'main'
       metamask_environment: 'qa'
+      use_bitrise_runner: ${{ inputs.use_bitrise_runner }}
     secrets: inherit
 
   prediction-market-ios-smoke:
@@ -179,6 +192,7 @@ jobs:
       changed_files: ${{ inputs.changed_files }}
       build_type: 'main'
       metamask_environment: 'qa'
+      use_bitrise_runner: ${{ inputs.use_bitrise_runner }}
     secrets: inherit
 
   card-ios-smoke:
@@ -197,6 +211,7 @@ jobs:
       changed_files: ${{ inputs.changed_files }}
       build_type: 'main'
       metamask_environment: 'qa'
+      use_bitrise_runner: ${{ inputs.use_bitrise_runner }}
     secrets: inherit
 
   ramps-ios-smoke:
@@ -215,6 +230,7 @@ jobs:
       changed_files: ${{ inputs.changed_files }}
       build_type: 'main'
       metamask_environment: 'qa'
+      use_bitrise_runner: ${{ inputs.use_bitrise_runner }}
     secrets: inherit
 
   multichain-api-ios-smoke:
@@ -233,6 +249,7 @@ jobs:
       changed_files: ${{ inputs.changed_files }}
       build_type: 'main'
       metamask_environment: 'qa'
+      use_bitrise_runner: ${{ inputs.use_bitrise_runner }}
     secrets: inherit
 
   seedless-onboarding-ios-smoke:
@@ -251,6 +268,7 @@ jobs:
       changed_files: ${{ inputs.changed_files }}
       build_type: 'main'
       metamask_environment: 'qa'
+      use_bitrise_runner: ${{ inputs.use_bitrise_runner }}
     secrets: inherit
 
   report-ios-smoke-tests:

.github/workflows/run-e2e-workflow.yml

@@ -53,11 +53,16 @@ on:
         required: false
         type: string
         default: 'main-'
+      use_bitrise_runner:
+        description: 'Route iOS E2E jobs to Bitrise self-hosted runner group.'
+        required: false
+        type: boolean
+        default: false
 
 jobs:
   test-e2e-mobile:
     name: ${{ inputs.test-suite-name }}
-    runs-on: ${{ inputs.platform == 'ios' && 'ghcr.io/cirruslabs/macos-runner:tahoe' || 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-lg' }}
+    runs-on: ${{ inputs.platform == 'ios' && (inputs.use_bitrise_runner && fromJSON('{"group":"temp-bitrise-runners","labels":["bitrise_pool_name:DemoFA"]}') || 'ghcr.io/cirruslabs/macos-runner:tahoe') || 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-lg' }}
     outputs:
       apk-target-path: ${{ steps.determine-target-paths.outputs.apk-target-path }}
       test-apk-target-path: ${{ steps.determine-target-paths.outputs.test-apk-target-path }}
@@ -102,6 +107,34 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # TEMPORARY: Bitrise runners use Vagrant (user=vagrant, HOME=/Users/vagrant).
+      # GitHub Actions tools hardcode /Users/runner paths. Create symlink to fix.
+      - name: Fix Vagrant environment paths (Bitrise runners)
+        if: ${{ inputs.use_bitrise_runner && inputs.platform == 'ios' }}
+        run: |
+          if [ -L /Users/runner ]; then
+            current_target="$(readlink /Users/runner)"
+            if [ "$current_target" = "/Users/vagrant" ]; then
+              echo "Symlink already correct: /Users/runner → /Users/vagrant"
+            else
+              echo "Replacing incorrect symlink /Users/runner → $current_target"
+              sudo rm /Users/runner
+              sudo ln -s /Users/vagrant /Users/runner
+              echo "Recreated symlink: /Users/runner → /Users/vagrant"
+            fi
+          elif [ -e /Users/runner ]; then
+            echo "Error: /Users/runner exists but is not a symlink"
+            ls -ld /Users/runner
+            exit 1
+          else
+            sudo ln -s /Users/vagrant /Users/runner
+            echo "Created symlink /Users/runner → /Users/vagrant"
+          fi
+          mkdir -p "$HOME/hostedtoolcache" "$HOME/tmp"
+          echo "RUNNER_TOOL_CACHE=$HOME/hostedtoolcache" >> "$GITHUB_ENV"
+          echo "RUNNER_TEMP=$HOME/tmp" >> "$GITHUB_ENV"
+        shell: bash
+
       - name: Set up E2E environment
         timeout-minutes: 15
         uses: ./.github/actions/setup-e2e-env