Merge remote-tracking branch 'origin/main' into fix/tat-3086-fix-limit-order-margin

Author: abretonc7s

.depcheckrc.yml

@@ -139,3 +139,18 @@ ignores:
 
   # Used in Yarn plugin for preview builds
   - '@yarnpkg/core'
+
+  # Babel plugins referenced in babel.config.js by their short name (without
+  # the `babel-plugin-` prefix). Babel resolves them correctly at build time
+  # but depcheck doesn't recognize the indirect reference. See babel.config.js
+  # line 65 comment for details.
+  - 'babel-plugin-react-compiler' # used as 'react-compiler' (line 68)
+  - 'babel-plugin-transform-inline-environment-variables' # used as 'transform-inline-environment-variables' (line 81)
+  - 'babel-plugin-transform-remove-console' # used as 'transform-remove-console' (line 166, production env)
+
+  # Listed as a direct dep in package.json but no longer referenced in
+  # babel.config.js (we use babel-preset-expo) or anywhere in our source.
+  # It's still available transitively via babel-preset-expo + Metro, so
+  # removing the direct declaration should be a no-op — left for a follow-up
+  # cleanup once the RN 0.81 upgrade has settled to avoid surprises.
+  - '@react-native/babel-preset'

.github/CODEOWNERS

@@ -158,7 +158,12 @@ app/components/UI/TemplateRenderer   @MetaMask/confirmations @MetaMask/core-plat
 app/components/UI/Stake              @MetaMask/earn
 app/core/Engine/controllers/earn-controller @MetaMask/earn
 app/core/Engine/messengers/earn-controller-messenger @MetaMask/earn
+app/core/Engine/controllers/chomp-api-service-init*                    @MetaMask/earn
+app/core/Engine/controllers/money-account-upgrade-controller-init*     @MetaMask/earn
+app/core/Engine/messengers/chomp-api-service-messenger*                @MetaMask/earn
+app/core/Engine/messengers/money-account-upgrade-controller-messenger* @MetaMask/earn
 app/selectors/earnController         @MetaMask/earn
+app/selectors/featureFlagController/chompApi/ @MetaMask/earn
 **/Earn/**                           @MetaMask/earn
 **/earn/**                           @MetaMask/earn
 **/Money/**                          @MetaMask/earn
@@ -358,6 +363,7 @@ tests/websocket/                                                @MetaMask/qa
 .github/workflows/run-performance-e2e.yml                       @MetaMask/qa
 .github/workflows/run-performance-e2e-experimental.yml          @MetaMask/qa
 .github/workflows/run-performance-e2e-release.yml               @MetaMask/qa
+.github/workflows/run-system-tests.yml                          @MetaMask/qa
 .github/scripts/e2e-*.mjs                                       @MetaMask/qa
 .github/scripts/collect-qa-stats.mjs                            @MetaMask/qa
 .github/scripts/generate-regression-slack-summary.mjs           @MetaMask/qa

.github/workflows/build-android-e2e.yml

@@ -34,7 +34,7 @@ on:
 jobs:
   build-android-apks:
     name: Build Android E2E APKs
-    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-android-build' || 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-lg' }} # Optimized for lg runner (48GB) with conservative memory settings
+    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-android-build' || (startsWith(github.base_ref, 'release/') && fromJSON('["ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-lg"]') || fromJSON('["ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-lg", "low-priority"]')) }} # Optimized for lg runner (48GB) with conservative memory settings
     timeout-minutes: 40
     env:
       GRADLE_USER_HOME: ${{ inputs.runner_provider == 'namespace' && '/home/runner/_work/.gradle' || '/home/admin/_work/.gradle' }}
@@ -117,6 +117,13 @@ jobs:
             exit 1
           fi
 
+      # TEMPORARY: `${{ github.run_id }}` makes every key unique per workflow
+      # run so we always get a fresh build during the RN 0.81 upgrade — the
+      # `yarn fingerprint:generate` heuristic doesn't track every native input
+      # being changed (yarn patches, MainApplication, Podfile shims, etc.) so
+      # the branch cache can serve a stale .apk and only the JS gets repacked.
+      # Remove the trailing `-${{ github.run_id }}` from each `key:` below
+      # once the upgrade is settled and fingerprint covers the touched paths.
       - name: Restore APKs matching fingerprint from branch cache
         if: ${{ inputs.runner_provider != 'namespace' }}
         id: apk-cache-restore
@@ -132,7 +139,7 @@ jobs:
           # - "Restore APKs matching fingerprint from main cache"
           # - "Restore Gradle dependencies from branch cache"
           # - "Restore Gradle dependencies from main cache"
-          key: android-apk-${{ github.ref_name }}-${{ inputs.build_type }}-${{ env.CACHE_GENERATION }}-${{ steps.generate-fingerprint.outputs.fingerprint }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          key: android-apk-${{ github.ref_name }}-${{ inputs.build_type }}-${{ env.CACHE_GENERATION }}-${{ steps.generate-fingerprint.outputs.fingerprint }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}-${{ github.run_id }}
 
       - name: Restore APKs matching fingerprint from main cache
         if: ${{ inputs.runner_provider != 'namespace' && steps.apk-cache-restore.outputs.cache-hit != 'true' && github.ref_name != 'main' }}
@@ -149,7 +156,7 @@ jobs:
           # - "Restore APKs matching fingerprint from main cache"
           # - "Restore Gradle dependencies from branch cache"
           # - "Restore Gradle dependencies from main cache"
-          key: android-apk-main-${{ inputs.build_type }}-${{ env.CACHE_GENERATION }}-${{ steps.generate-fingerprint.outputs.fingerprint }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          key: android-apk-main-${{ inputs.build_type }}-${{ env.CACHE_GENERATION }}-${{ steps.generate-fingerprint.outputs.fingerprint }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}-${{ github.run_id }}
 
       - name: Restore Gradle dependencies from branch cache
         id: gradle-cache-restore
@@ -168,7 +175,7 @@ jobs:
           # - "Restore APKs matching fingerprint from main cache"
           # - "Restore Gradle dependencies from branch cache"
           # - "Restore Gradle dependencies from main cache"
-          key: gradle-${{ github.ref_name }}-${{ env.GRADLE_CACHE_VERSION }}-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          key: gradle-${{ github.ref_name }}-${{ env.GRADLE_CACHE_VERSION }}-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}-${{ github.run_id }}
 
       - name: Restore Gradle dependencies from main cache
         # This will only restore the cache, not update it
@@ -186,7 +193,7 @@ jobs:
           # - "Restore APKs matching fingerprint from main cache"
           # - "Restore Gradle dependencies from branch cache"
           # - "Restore Gradle dependencies from main cache"
-          key: gradle-main-${{ env.GRADLE_CACHE_VERSION }}-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          key: gradle-main-${{ env.GRADLE_CACHE_VERSION }}-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}-${{ github.run_id }}
 
       - name: Build Android E2E APKs
         if: ${{ inputs.runner_provider == 'namespace' || (steps.apk-cache-restore.outputs.cache-hit != 'true' && steps.apk-cache-restore-main.outputs.cache-hit != 'true') }}
@@ -208,6 +215,12 @@ jobs:
           NODE_OPTIONS: '--max-old-space-size=4096'
           # Limit Metro workers to prevent OOM (each worker uses ~3GB)
           METRO_MAX_WORKERS: '4'
+          # React Native 0.81's ReactAndroid/build.gradle.kts requests CMake 3.30.5
+          # via `System.getenv("CMAKE_VERSION") ?: "3.30.5"`. The self-hosted runner
+          # only ships CMake 3.22.1 in /opt/android-sdk/cmake/ and AGP cannot auto-
+          # download missing components, causing CXX1300. RN's CMakeLists.txt files
+          # only require >= 3.13, so 3.22.1 is fully sufficient.
+          CMAKE_VERSION: '3.22.1'
           BRIDGE_USE_DEV_APIS: 'true'
           RAMP_INTERNAL_BUILD: 'true'
           SEEDLESS_ONBOARDING_ENABLED: 'true'

.github/workflows/build-ios-e2e.yml

@@ -30,15 +30,15 @@ permissions:
 jobs:
   build-ios-apps:
     name: Build iOS E2E Apps
-    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ios-build' || 'ghcr.io/cirruslabs/macos-runner:tahoe-xl' }}
+    runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ios-build' || (startsWith(github.base_ref, 'release/') && fromJSON('["ghcr.io/cirruslabs/macos-runner:tahoe-xl"]') || fromJSON('["ghcr.io/cirruslabs/macos-runner:tahoe-xl", "low-priority"]')) }}
     outputs:
       artifacts-url: ${{ steps.set-artifacts-url.outputs.artifacts-url }}
       app-uploaded: ${{ steps.upload-app.outcome == 'success' }}
       sourcemap-uploaded: ${{ steps.upload-sourcemap.outcome == 'success' }}
     env:
       # Bump these to bust the respective caches and force a full rebuild
-      XCODE_CACHE_VERSION: 1
-      IOS_APP_CACHE_VERSION: 2
+      XCODE_CACHE_VERSION: 4
+      IOS_APP_CACHE_VERSION: 5
       RCT_NO_LAUNCH_PACKAGER: 1
       XCODE_BUILD_SETTINGS: 'COMPILER_INDEX_STORE_ENABLE=NO'
       GITHUB_CI: 'true' # This ensures it's available during pod install
@@ -75,6 +75,13 @@ jobs:
       - name: Checkout repo
         uses: actions/checkout@v6
 
+      # TEMPORARY: `${{ github.run_id }}` makes every key unique per workflow
+      # run so we always get a fresh build during the RN 0.81 upgrade — the
+      # `yarn fingerprint:generate` heuristic doesn't track every native input
+      # being changed (yarn patches, AppDelegate, Podfile shims, etc.) so the
+      # branch cache can serve a stale .app and only the JS gets repacked.
+      # Remove the trailing `-${{ github.run_id }}` from each `key:` below
+      # once the upgrade is settled and fingerprint covers the touched paths.
       - name: Restore Xcode derived data from branch cache
         id: xcode-restore-cache
         # This action automatically updates the cache at the end of the workflow
@@ -83,7 +90,7 @@ jobs:
           path: |
             ~/Library/Developer/Xcode/DerivedData
             ios/build
-          key: ${{ runner.os }}-xcode-${{ github.ref_name }}-${{ env.XCODE_CACHE_VERSION }}-${{ hashFiles('ios/**/*.{h,m,mm,swift}', 'ios/**/Podfile.lock', 'yarn.lock') }}
+          key: ${{ runner.os }}-xcode-${{ github.ref_name }}-${{ env.XCODE_CACHE_VERSION }}-${{ hashFiles('ios/**/*.{h,m,mm,swift}', 'ios/**/Podfile.lock', 'yarn.lock') }}-${{ github.run_id }}
 
       - name: Restore Xcode derived data from main cache
         if: ${{ steps.xcode-restore-cache.outputs.cache-hit != 'true' && github.ref_name != 'main' }}
@@ -94,7 +101,7 @@ jobs:
           path: |
             ~/Library/Developer/Xcode/DerivedData
             ios/build
-          key: ${{ runner.os }}-xcode-main-${{ env.XCODE_CACHE_VERSION }}-${{ hashFiles('ios/**/*.{h,m,mm,swift}', 'ios/**/Podfile.lock', 'yarn.lock') }}
+          key: ${{ runner.os }}-xcode-main-${{ env.XCODE_CACHE_VERSION }}-${{ hashFiles('ios/**/*.{h,m,mm,swift}', 'ios/**/Podfile.lock', 'yarn.lock') }}-${{ github.run_id }}
 
       - name: Restore .metamask folder (Foundry download cache for install:foundryup)
         uses: actions/cache@v4
@@ -154,7 +161,7 @@ jobs:
         with:
           path: |
             ios/build/Build/Products/Release-iphonesimulator/MetaMask.app
-          key: ios-app-${{ github.ref_name }}-v${{ env.IOS_APP_CACHE_VERSION }}-${{ steps.generate-fingerprint.outputs.fingerprint }}
+          key: ios-app-${{ github.ref_name }}-v${{ env.IOS_APP_CACHE_VERSION }}-${{ steps.generate-fingerprint.outputs.fingerprint }}-${{ github.run_id }}
 
       - name: Restore iOS app matching fingerprint from main cache
         if: ${{ steps.cache-restore.outputs.cache-hit != 'true' && github.ref_name != 'main' }}
@@ -164,7 +171,7 @@ jobs:
         with:
           path: |
             ios/build/Build/Products/Release-iphonesimulator/MetaMask.app
-          key: ios-app-main-v${{ env.IOS_APP_CACHE_VERSION }}-${{ steps.generate-fingerprint.outputs.fingerprint }}
+          key: ios-app-main-v${{ env.IOS_APP_CACHE_VERSION }}-${{ steps.generate-fingerprint.outputs.fingerprint }}-${{ github.run_id }}
 
       # Build the iOS E2E app for simulator
       - name: Build iOS E2E App

.github/workflows/build.yml

@@ -130,6 +130,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          fetch-depth: 1
           ref: ${{ !inputs.skip_version_bump && needs.update-build-version.outputs.commit-hash || (inputs.source_branch || github.ref_name) }}
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -169,7 +170,7 @@ jobs:
     uses: ./.github/workflows/setup-node-modules.yml
     with:
       ref: ${{ needs.prepare.outputs.checkout_ref_for_setup }}
-      fetch-depth: 0
+      fetch-depth: 1
       checkout-submodules: true
       platform: ${{ matrix.platform }}
       build_name: ${{ inputs.build_name }}
@@ -190,6 +191,9 @@ jobs:
     # Android: Cirrus lg (large) runner for 8GB Gradle heap; iOS: Cirrus macOS Tahoe (has Xcode 26.x)
     runs-on: ${{ inputs.runner_provider == 'namespace' && (matrix.platform == 'ios' && 'namespace-profile-metamask-ios-build' || 'namespace-profile-metamask-android-build') || (matrix.platform == 'ios' && 'ghcr.io/cirruslabs/macos-runner:tahoe-xl' || 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-lg') }}
     environment: ${{ needs.prepare.outputs.github_environment }}
+    env:
+      GRADLE_USER_HOME: /home/admin/_work/.gradle
+      CACHE_GENERATION: v1
     steps:
       - name: Validate version-bump commit
         if: ${{ !inputs.skip_version_bump }}
@@ -375,6 +379,29 @@ jobs:
           java-version: '17'
           distribution: 'temurin'
 
+      - name: Apply release Gradle config (Android)
+        if: matrix.platform == 'android'
+        run: cp android/gradle.properties.release android/gradle.properties
+
+      - name: Restore Gradle dependencies from branch cache (Android)
+        if: matrix.platform == 'android'
+        id: gradle-cache-restore
+        uses: cirruslabs/cache@bba69c6578b863ad0398ad40567bd2ef70290fe0 # v4
+        with:
+          path: |
+            ~/_work/.gradle/caches
+            ~/_work/.gradle/wrapper
+          key: gradle-release-${{ github.ref_name }}-${{ env.CACHE_GENERATION }}-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+
+      - name: Restore Gradle dependencies from main cache (Android)
+        if: matrix.platform == 'android' && steps.gradle-cache-restore.outputs.cache-hit != 'true' && github.ref_name != 'main'
+        uses: cirruslabs/cache/restore@bba69c6578b863ad0398ad40567bd2ef70290fe0 # v4
+        with:
+          path: |
+            ~/_work/.gradle/caches
+            ~/_work/.gradle/wrapper
+          key: gradle-release-main-${{ env.CACHE_GENERATION }}-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+
       # iOS: Clean up any existing keychains from previous runs
       - name: Clean up existing keychains
         if: matrix.platform == 'ios' && needs.prepare.outputs.signing_aws_role != ''
@@ -425,6 +452,12 @@ jobs:
         timeout-minutes: 115
         env:
           GIT_BRANCH: ${{ inputs.source_branch || github.ref_name }}
+          # React Native 0.81's ReactAndroid/build.gradle.kts requests CMake 3.30.5
+          # via `System.getenv("CMAKE_VERSION") ?: "3.30.5"`. The self-hosted runner
+          # only ships CMake 3.22.1 in /opt/android-sdk/cmake/ and AGP cannot auto-
+          # download missing components, causing CXX1300. RN's CMakeLists.txt files
+          # only require >= 3.13, so 3.22.1 is fully sufficient.
+          CMAKE_VERSION: '3.22.1'
         uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
         with:
           timeout_minutes: 55
@@ -541,6 +574,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          fetch-depth: 1
           ref: ${{ needs.prepare.outputs.checkout_ref_for_setup }}
 
       - name: Setup Node.js

.github/workflows/ci.yml

@@ -72,7 +72,7 @@ jobs:
       - name: Clean state and following up dependencies installation with retry
         uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
         with:
-          timeout_minutes: 10
+          timeout_minutes: 20
           max_attempts: 3
           retry_wait_seconds: 30
           command: yarn setup:github-ci

.github/workflows/create-build-branch.yml

@@ -27,7 +27,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           ref: ${{ inputs.source_branch }}
           token: ${{ secrets.PR_TOKEN || github.token }}
       - name: Create temporary build branch

.github/workflows/crowdin-rc-download-translations.yml

@@ -0,0 +1,88 @@
+name: Crowdin Download Approved RC Translations
+
+on:
+  workflow_dispatch:
+
+jobs:
+  find-rc-branches:
+    name: Find release candidate branches
+    if: ${{ github.ref_name == 'main' }}
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    outputs:
+      branches: ${{ steps.find-branches.outputs.branches }}
+    steps:
+      - name: Find release candidate branches
+        id: find-branches
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { data: prs } = await github.rest.pulls.list({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              base: 'stable',
+              state: 'open',
+            });
+
+            const releaseBranchRegex = /^release\/[0-9]+\.[0-9]+\.[0-9]+$/;
+
+            const branches = prs
+              .map((pr) => pr.head.ref)
+              .filter((branchName) => releaseBranchRegex.test(branchName));
+
+            core.info(`Found release branches: ${branches.join(',')}`);
+            core.setOutput('branches', JSON.stringify(branches));
+
+
+  download-translations:
+    name: Download translations
+    # Use `!cancelled()` to ensure this runs even when `find-rc-branches` is skipped
+    if: ${{ !cancelled() }}
+    needs: [find-rc-branches]
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+
+    strategy:
+      matrix:
+        # If run on `main`, we download translations for all RCs
+        # If run on a non-default branch, we just download translations for that individual branch
+        branch: >-
+          ${{
+            github.ref_name == 'main' &&
+            fromJson(needs.find-rc-branches.outputs.branches) ||
+            fromJson(format('[{0}]', github.ref_name))
+          }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          ref: ${{ matrix.branch }}
+          # Use PAT to ensure that the commit later can trigger status check workflows
+          token: ${{ secrets.METAMASKBOT_CROWDIN_TOKEN }}
+
+      - name: crowdin download approved translations
+        uses: crowdin/github-action@a3160b9e5a9e00739392c23da5e580c6cabe526d
+        with:
+          upload_sources: false
+          upload_translations: false # disabled to prevent translations overwriting Blends translations
+          download_translations: true # created separate action to pull down completed translations
+          export_only_approved: true
+
+          crowdin_branch_name: ${{ matrix.branch }}
+          pull_request_base_branch_name: ${{ matrix.branch }}
+          localization_branch_name: l10n_crowdin_translations_${{ matrix.branch }}
+          pull_request_title: 'chore: New Crowdin Translations for ${{ matrix.branch }}'
+          skip_ref_checkout: true
+          # This will be in dry-run mode until after we've tested this on `main`
+          dryrun_action: true
+
+          github_user_name: metamaskbot
+          github_user_email: metamaskbot@users.noreply.github.com
+        env:
+          GITHUB_TOKEN: ${{ secrets.METAMASKBOT_CROWDIN_TOKEN }}
+          GITHUB_ACTOR: metamaskbot
+          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_PERSONAL_TOKEN }}