Merge branch 'main' into wsun/clean-up-react-navigation-stack

Author: weitingsun

.github/workflows/auto-create-release-pr.yml

@@ -43,7 +43,6 @@ jobs:
       id-token: write
     uses: ./.github/workflows/create-release-pr.yml
     secrets:
-      github-token: ${{ secrets.PR_TOKEN }}
       google-application-creds-base64: ${{ secrets.GCP_RLS_SHEET_ACCOUNT_BASE64 }}
     with:
       semver-version: ${{ needs.extract.outputs.semver }}

.github/workflows/build-rc-auto.yml

@@ -123,11 +123,10 @@ jobs:
     if: needs.validate-and-find-pr.outputs.has-pr == 'true' && needs.validate-and-find-pr.outputs.rc-frozen != 'true'
     permissions:
       contents: write
+      id-token: write
     with:
       base-branch: ${{ needs.validate-and-find-pr.outputs.branch-name }}
       build_number: ${{ needs.generate_rc_build_version.outputs.build-version }}
-    secrets:
-      PR_TOKEN: ${{ secrets.PR_TOKEN }}
 
   trigger-ios-rc-build:
     name: Trigger iOS RC Build

.github/workflows/commit-build-version.yml

@@ -19,29 +19,32 @@ on:
         description: 'Build number from generate-build-version.yml outputs.build-version'
         required: true
         type: string
-    secrets:
-      PR_TOKEN:
-        description: 'GitHub token for checkout and push operations'
-        required: false
     outputs:
       commit-hash:
         description: 'Commit SHA with build version bumped'
         value: ${{ jobs.commit.outputs.commit-hash }}
 
 permissions:
-  contents: write
+  id-token: write
 
 jobs:
   commit:
     runs-on: ubuntu-latest
     outputs:
       commit-hash: ${{ steps.bump-build-version.outputs.commit-hash }}
     steps:
+      - name: Get token
+        id: get-token
+        uses: MetaMask/github-tools/.github/actions/get-token@v1
+        with:
+          token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }}
+          permissions: |
+            contents: write
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: ${{ inputs.base-branch }}
-          token: ${{ secrets.PR_TOKEN || github.token }}
+          token: ${{ steps.get-token.outputs.token }}
       - name: Bump build version
         id: bump-build-version
         shell: bash

.github/workflows/create-release-pr.yml

@@ -22,12 +22,8 @@ on:
         type: boolean
         default: false
     secrets:
-      github-token:
-        required: false
       google-application-creds-base64:
         required: false
-      PR_TOKEN:
-        required: false
       GCP_RLS_SHEET_ACCOUNT_BASE64:
         required: false
 
@@ -109,6 +105,21 @@ jobs:
     name: Create Release Pull Request using Github Tools
     runs-on: ubuntu-latest
     steps:
+      # Mint a short-lived token via the token-exchange service (OIDC). It needs:
+      # - contents: write       → push the release / version-bump / changelog branches
+      # - pull_requests: write  → open the release PRs
+      # - members: read         → auto-changelog --autoCategorize resolves PR author teams (read:org)
+      # OIDC works on every trigger, so no workflow_dispatch vs workflow_call token split is needed.
+      - name: Get token
+        id: get-token
+        uses: MetaMask/github-tools/.github/actions/get-token@v1
+        with:
+          token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }}
+          permissions: |
+            contents: write
+            pull_requests: write
+            members: read
+
       - name: Create Release PR (semver / native version bump)
         if: needs.resolve-bases.outputs.is_ota != 'true'
         uses: MetaMask/github-tools/.github/actions/create-release-pr@v1
@@ -119,10 +130,7 @@ jobs:
           semver-version: ${{ inputs.semver-version }}
           previous-version-ref: ${{ needs.resolve-previous-ref.outputs.previous_ref }}
           mobile-build-version: ${{ needs.generate-build-version.outputs.build-version }}
-          # Needs write to metamask-mobile and read to metamask-planning. Prefer PR_TOKEN (workflow scope / bot) over GITHUB_TOKEN.
-          # workflow_dispatch: use secrets.PR_TOKEN directly.
-          # workflow_call: reusable workflows only receive secrets explicitly passed in; auto-create-release-pr maps github-token → PR_TOKEN.
-          github-token: ${{ github.event_name == 'workflow_dispatch' && secrets.PR_TOKEN || secrets.github-token }}
+          github-token: ${{ steps.get-token.outputs.token }}
           google-application-creds-base64: ${{ github.event_name == 'workflow_dispatch' && secrets.GCP_RLS_SHEET_ACCOUNT_BASE64 || secrets.google-application-creds-base64 }}
 
       # Check PR before checkout/bump/push so retries do not overwrite OTA_VERSION again when a PR already exists.
@@ -133,7 +141,7 @@ jobs:
         env:
           SEMVER: ${{ inputs.semver-version }}
           RELEASE_BASE: ${{ needs.resolve-bases.outputs.release_base }}
-          GH_TOKEN: ${{ github.event_name == 'workflow_dispatch' && secrets.PR_TOKEN || secrets.github-token }}
+          GH_TOKEN: ${{ steps.get-token.outputs.token }}
         run: |
           set -euo pipefail
           BRANCH="release/${SEMVER}-ota"
@@ -151,15 +159,15 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: release/${{ inputs.semver-version }}-ota
-          token: ${{ github.event_name == 'workflow_dispatch' && secrets.PR_TOKEN || secrets.github-token }}
+          token: ${{ steps.get-token.outputs.token }}
           fetch-depth: 0
 
       - name: Bump OTA_VERSION and push (OTA hotfix)
         if: needs.resolve-bases.outputs.is_ota == 'true' && steps.ota_release_pr.outputs.exists != 'true'
         shell: bash
         env:
           SEMVER: ${{ inputs.semver-version }}
-          GH_TOKEN: ${{ github.event_name == 'workflow_dispatch' && secrets.PR_TOKEN || secrets.github-token }}
+          GH_TOKEN: ${{ steps.get-token.outputs.token }}
         run: |
           set -euo pipefail
           BRANCH="release/${SEMVER}-ota"
@@ -199,7 +207,7 @@ jobs:
         if: needs.resolve-bases.outputs.is_ota == 'true' && steps.ota_release_pr.outputs.exists != 'true'
         shell: bash
         env:
-          GITHUB_TOKEN: ${{ github.event_name == 'workflow_dispatch' && secrets.PR_TOKEN || secrets.github-token }}
+          GITHUB_TOKEN: ${{ steps.get-token.outputs.token }}
           GIT_AUTHOR_NAME: metamaskbot
           GIT_AUTHOR_EMAIL: metamaskbot@users.noreply.github.com
         run: |
@@ -223,7 +231,7 @@ jobs:
         env:
           SEMVER: ${{ inputs.semver-version }}
           RELEASE_BASE: ${{ needs.resolve-bases.outputs.release_base }}
-          GH_TOKEN: ${{ github.event_name == 'workflow_dispatch' && secrets.PR_TOKEN || secrets.github-token }}
+          GH_TOKEN: ${{ steps.get-token.outputs.token }}
         run: |
           set -euo pipefail
           BRANCH="release/${SEMVER}-ota"

.github/workflows/publish-slack-release-testing-status.yml

@@ -10,15 +10,24 @@ jobs:
     name: Publish Slack release testing status
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
+      id-token: write
     steps:
+      - name: Get token
+        id: get-token
+        uses: MetaMask/github-tools/.github/actions/get-token@v1
+        with:
+          token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }}
+          permissions: |
+            contents: read
+            pull_requests: read
+
       - name: Publish Slack release testing status
         uses: MetaMask/github-tools/.github/actions/publish-slack-release-testing-status@v1
         with:
           platform: 'mobile'
           test-only: 'true'
           google-document-id: '1tsoodlAlyvEUpkkcNcbZ4PM9HuC9cEM80RZeoVv5OCQ'
           slack-api-key: ${{ secrets.SLACKBOT_RLS_TOKEN }}
-          github-token: ${{ secrets.PR_TOKEN }}
+          github-token: ${{ steps.get-token.outputs.token }}
           google-application-creds-base64: ${{ secrets.GCP_RLS_SHEET_ACCOUNT_BASE64 }}

.github/workflows/run-e2e-smoke-tests-android.yml

@@ -92,23 +92,6 @@ jobs:
       runner_provider: ${{ inputs.runner_provider }}
     secrets: inherit
 
-  identity-android-smoke:
-    if: contains(fromJson(inputs.selected_tags), 'ALL') || contains(fromJson(inputs.selected_tags), 'SmokeIdentity')
-    strategy:
-      matrix:
-        split: [1]
-      fail-fast: false
-    uses: ./.github/workflows/run-e2e-workflow.yml
-    with:
-      test-suite-name: identity-android-smoke-${{ matrix.split }}
-      platform: android
-      test_suite_tag: 'SmokeIdentity'
-      split_number: ${{ matrix.split }}
-      total_splits: 1
-      changed_files: ${{ inputs.changed_files }}
-      runner_provider: ${{ inputs.runner_provider }}
-    secrets: inherit
-
   network-abstraction-android-smoke:
     if: contains(fromJson(inputs.selected_tags), 'ALL') || contains(fromJson(inputs.selected_tags), 'SmokeNetworkAbstractions')
     strategy:
@@ -265,13 +248,21 @@ jobs:
   report-android-smoke-tests:
     name: Report Android Smoke Tests
     runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
-    if: ${{ !cancelled() && inputs.selected_tags != '[]' && inputs.selected_tags != '["FlaskBuildTests"]' }}
+    # Appium migration: skip rollup when every Detox shard is skipped (e.g. AI selects
+    # an Appium-only tag like SmokeAccounts). Non-empty tags still trigger this workflow.
+    if: >-
+      ${{
+        !cancelled() &&
+        (
+          contains(toJSON(needs), '"result":"success"') ||
+          contains(toJSON(needs), '"result":"failure"')
+        )
+      }}
     needs:
       - swap-android-smoke
       - stake-android-smoke
       - perps-android-smoke
       - wallet-platform-android-smoke
-      - identity-android-smoke
       - network-abstraction-android-smoke
       - network-expansion-android-smoke
       - confirmations-android-smoke

.github/workflows/run-e2e-smoke-tests-ios.yml

@@ -114,24 +114,6 @@ jobs:
       runner_provider: ${{ inputs.runner_provider }}
     secrets: inherit
 
-  identity-ios-smoke:
-    if: contains(fromJson(inputs.selected_tags), 'ALL') || contains(fromJson(inputs.selected_tags), 'SmokeIdentity')
-    strategy:
-      matrix:
-        split: [1]
-      fail-fast: false
-    uses: ./.github/workflows/run-e2e-workflow.yml
-    with:
-      test-suite-name: identity-ios-smoke-${{ matrix.split }}
-      platform: ios
-      test_suite_tag: 'SmokeIdentity'
-      split_number: ${{ matrix.split }}
-      total_splits: 1
-      changed_files: ${{ inputs.changed_files }}
-      build_type: 'main'
-      runner_provider: ${{ inputs.runner_provider }}
-    secrets: inherit
-
   network-abstraction-ios-smoke:
     if: contains(fromJson(inputs.selected_tags), 'ALL') || contains(fromJson(inputs.selected_tags), 'SmokeNetworkAbstractions')
     strategy:
@@ -279,14 +261,22 @@ jobs:
   report-ios-smoke-tests:
     name: Report iOS Smoke Tests
     runs-on: ${{ inputs.runner_provider == 'namespace' && 'namespace-profile-metamask-ci-linux' || 'ubuntu-latest' }}
-    if: ${{ !cancelled() && inputs.selected_tags != '[]' && inputs.selected_tags != '["FlaskBuildTests"]' }}
+    # Appium migration: skip rollup when every Detox shard is skipped (e.g. AI selects
+    # an Appium-only tag like SmokeAccounts). Non-empty tags still trigger this workflow.
+    if: >-
+      ${{
+        !cancelled() &&
+        (
+          contains(toJSON(needs), '"result":"success"') ||
+          contains(toJSON(needs), '"result":"failure"')
+        )
+      }}
     needs:
       - confirmations-ios-smoke
       - swap-ios-smoke
       - stake-ios-smoke
       - perps-ios-smoke
       - wallet-platform-ios-smoke
-      - identity-ios-smoke
       - network-abstraction-ios-smoke
       - network-expansion-ios-smoke
       - prediction-market-ios-smoke

.github/workflows/runway-production-builds.yml

@@ -39,12 +39,10 @@ jobs:
     needs: generate-build-version
     uses: ./.github/workflows/commit-build-version.yml
     permissions:
-      contents: write
+      id-token: write
     with:
       base-branch: ${{ inputs.source_branch || github.ref_name }}
       build_number: ${{ needs.generate-build-version.outputs.build-version }}
-    secrets:
-      PR_TOKEN: ${{ secrets.PR_TOKEN }}
 
   build:
     name: Build iOS + Android (main-prod)

.github/workflows/runway-rc-builds.yml

@@ -39,12 +39,10 @@ jobs:
     needs: generate-build-version
     uses: ./.github/workflows/commit-build-version.yml
     permissions:
-      contents: write
+      id-token: write
     with:
       base-branch: ${{ inputs.source_branch || github.ref_name }}
       build_number: ${{ needs.generate-build-version.outputs.build-version }}
-    secrets:
-      PR_TOKEN: ${{ secrets.PR_TOKEN }}
 
   build:
     name: Build iOS + Android (main-rc)

.github/workflows/update-release-changelog.yml

@@ -52,12 +52,22 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+      id-token: write
     steps:
+      - name: Get token
+        id: get-token
+        uses: MetaMask/github-tools/.github/actions/get-token@v1
+        with:
+          token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }}
+          permissions: |
+            contents: write
+            pull_requests: write
+
       - name: Checkout release branch
         uses: actions/checkout@v4
         with:
           ref: ${{ github.ref_name }}
-          token: ${{ secrets.PR_TOKEN }}
+          token: ${{ steps.get-token.outputs.token }}
           fetch-depth: 0
 
       - name: Checkout github-tools
@@ -75,15 +85,13 @@ jobs:
       - name: Update Release Changelog
         shell: bash
         env:
-          GITHUB_TOKEN: ${{ secrets.PR_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.get-token.outputs.token }}
           GIT_AUTHOR_NAME: metamaskbot
           GIT_AUTHOR_EMAIL: metamaskbot@users.noreply.github.com
         run: |
           set -euo pipefail
           git config user.name metamaskbot
           git config user.email metamaskbot@users.noreply.github.com
-          corepack enable
-          yarn install --immutable
           bash .github/scripts/run-update-release-changelog-mobile.sh \
             "${{ github.ref_name }}" \
             mobile \