ci(INFRA-3629): Phase 5c Namespace artifact adoption

[bsgrigorov]

Description

Paired artifact steps: runner_provider=namespace → SHA-pinned namespace-actions/upload-artifact / namespace-actions/download-artifact. Otherwise → actions/upload-artifact@v4 / actions/download-artifact@v4. No dynamic uses:; only if:-gated pairs.

Behavior added

• Coverage / Sonar: Shards, merge outputs, and lcov.info use the same backend as the runner.
• iOS JS bundle: Upload and downstream consumer use the same backend.
• E2E (run-e2e-workflow.yml): JUnit, screenshots, and prior-run junit re-fetch use the paired backend on Namespace.
• Fixture validation: Report job downloads junit with the same backend the producer used.
• Native E2E builds: APK / androidTest and .app / sourcemap uploads align with same-run “download all” in run-e2e-workflow.yml (no mixed backend in one run).
• Smoke / regression: Pattern shard downloads and rollup + JSON report uploads are paired on Namespace vs current. Regression rollups use explicit retention-days: 7 on both backends (matches smoke; Namespace default without that is 30 days).

Caveats

• Cross-run APK/app reuse via run-id still uses GitHub’s API where used. find-reusable-build is off on Namespace (Android + iOS) until that path is validated for Namespace artifacts.
• Org allowlist: TechOps asked to allow the two namespace-actions/* pins (distinct from namespacelabs/*).

Acceptance evidence (still to attach before closing INFRA-3629)

Implements pairing + pins only; ticket “done” still needs linked proof (Namespace ci dispatch where Namespace steps actually run, allowlist, INFRA-3597 pointer if applicable, native E2E Namespace handoff, timing/stability if required, rollback note on ticket).

• Namespace manual dispatch: 25843127496 (runner_provider=namespace — see run for status).
• Recent completed ci on phase5c/namespace-artifact-adoption:

Kind	Run	Outcome
workflow_dispatch (Namespace runners)	25839065840	failure
pull_request (GitHub-hosted jobs)	25839502117	success
pull_request	25839064157	cancelled

Changelog

CHANGELOG entry: null

Related issues

Related to INFRA-3629 — partial implementation until acceptance evidence is on the ticket (this PR does not claim full closure).

Manual testing steps

Feature: Namespace CI artifact parity

  Scenario: Manual CI trial on Namespace runners
    Given branch phase5c/namespace-artifact-adoption is pushed and a draft PR is open
    When a maintainer runs workflow "ci" via workflow_dispatch with runner_provider=namespace
    Then jobs that upload or download artifacts should use namespace-actions upload/download on Namespace runners
    And jobs on non-Namespace providers should use actions/upload-artifact and actions/download-artifact v4

  Scenario: Optional comparison run
    Given the same ref and PR context
    When the same workflow is dispatched with runner_provider=current
    Then artifact steps should select GitHub artifact actions
    And no job should rely on Namespace-only storage for artifacts produced by the other provider in the same logical handoff

Screenshots/Recordings

N/A — workflow and runner configuration only; validate via Actions run logs and the Artifacts tab on the workflow run.

Before

N/A

After

N/A

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

• I've tested on Android
  • Ideally on a mid-range device; emulator is acceptable
• I've tested with a power user scenario
  • Use these power-user SRPs to import wallets with many accounts and tokens
• I've instrumented key operations with Sentry traces for production performance metrics
  • See trace() for usage and addToken for an example

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Medium Risk
Changes CI artifact upload/download paths across builds, coverage, and E2E workflows; misconfiguration could break artifact handoffs and make tests/coverage flaky or unavailable on one runner provider.

Overview
Standardizes artifact handling when runner_provider=namespace by pairing namespace-actions/upload-artifact + namespace-actions/download-artifact (SHA-pinned) with the existing actions/*-artifact@v4 steps for non-Namespace runs, preventing mixed backends within a single workflow run.

This updates Android/iOS E2E build workflows to upload APKs, test APKs, .app bundles, and iOS sourcemaps via the matching backend and adjusts job outputs/status logging accordingly; it also disables cross-run reusable-build lookup on Namespace for iOS.

The main ci.yml workflow now uploads/downloads artifacts (iOS JS bundle, coverage shards/merged outputs, and fixture-validation JUnit) via the provider-matched backend, tweaks Namespace Jest parallelism (--maxWorkers=33%), and updates smoke/regression report workflows plus run-e2e-workflow.yml to download prior-run results and upload JUnit/screenshots using the same backend (with consistent retention-days: 7).

^{Reviewed by Cursor Bugbot for commit 4680278. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[bsgrigorov]

CI note — Namespace unit SIGKILL (transient) + current runs

What happened: Namespace ci unit shards intermittently died with SIGKILL (cgroup OOM under parallel Jest load), similar to earlier Namespace trials — transient runner / harness pressure, not a signal that the Phase 5c workflow logic is wrong.

Mitigation (landed on this branch): aac0451c1c9f5e097049fa01030af80fb4a478da — Namespace Linux unit matrix uses --maxWorkers=33% (~3 workers on 8 vCPU) instead of 50%, with the existing 12 GiB heap split on Namespace vs GitHub-hosted.

Latest workflow runs (same head as PR tip)

Trigger	Run	Unit shards (1–10)	Overall
pull_request ci	25876141254	All SUCCESS	Failure — Android / iOS E2E smoke jobs + Validate E2E Fixtures; Check all jobs pass reflects those downstream failures (not unit SIGKILL on this run).
workflow_dispatch ci (Namespace)	25876139751	All SUCCESS	Failure — Android / iOS E2E smoke + Check all jobs pass (E2E side).

Merge posture: Branch is mergeable from GitHub’s perspective; ready for human review. policy-bot / policy-bot: main are still pending until policy approves.

Happy to re-run or pair a runner_provider=current dispatch at the same SHA if reviewers want an A/B line in the ticket.

[github-actions]

🔍 Smart E2E Test Selection

⏭️ Smart E2E selection skipped - skip-smart-e2e-selection label found

All E2E tests pre-selected.

View GitHub Actions results

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud