chore: separate setup dependencies from EAS push job

[weitingsun]

Description

In this PR, we don't run yarn install in the EAS job. Instead we set up dependencies in a different job and attach it when we do eas push.

Workflow test: https://github.com/MetaMask/metamask-mobile/actions/runs/21225548771

Changelog

CHANGELOG entry: Added setup-dependencies to push OTA update workflow

Related issues

Fixes: https://consensyssoftware.atlassian.net/browse/MCWP-265

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I’ve followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Separates dependency setup from the EAS update workflow and switches to artifact-based node_modules reuse with compatibility checks.

• Introduces reusable workflow setup-node-modules.yml to install deps, run project setup, verify artifacts, and upload node_modules (versioned by Node/OS)
• Updates push-eas-update.yml to consume prebuilt artifacts for both target and base refs, generate fingerprints without reinstalling, and use artifacts in the push step
• Adds composite actions: validate-artifact-compatibility (ensures Node/OS match) and restore-node-modules-permissions (fixes executable bits) with verification steps
• Adjusts approval to use release-team, improves base_branch input description, and updates CODEOWNERS to include the new workflow

^{Written by Cursor Bugbot for commit ae5bd7c. This will update automatically on new commits. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[tommasini]

Also we can change the name of the node modules artifcact to include the node version and the OS name. We should pick those from the environment itself.

That way we can check it on the push-eas-update workflow if those are the same. That would prevent any undesired native (node native) behavior from happening

[weitingsun]

this is done below when we do name: Set artifact name with node version and OS

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: None (no tests recommended)
• Risk Level: low
• AI Confidence: 95%

click to see 🤖 AI reasoning details

All changes in this PR are purely CI/CD infrastructure changes related to GitHub Actions workflows:

1. CODEOWNERS: Simple ownership assignment for a workflow file
2. restore-node-modules-permissions/action.yml: New composite action for restoring file permissions after artifact download
3. validate-artifact-compatibility/action.yml: New composite action for validating Node version and OS compatibility
4. push-eas-update.yml: Refactored EAS update workflow to use reusable workflows and artifact caching instead of inline dependency installation
5. setup-node-modules.yml: New reusable workflow for setting up and caching node_modules

These changes:

• Do NOT modify any application code
• Do NOT modify any E2E test code or infrastructure
• Do NOT affect any user-facing functionality
• Are isolated to the EAS (Expo Application Services) update workflow which is separate from the Detox E2E testing pipeline

The changes optimize CI/CD by caching node_modules artifacts and validating compatibility, but have zero impact on the mobile application behavior or E2E tests.

View GitHub Actions results

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sethkfman]

LGTM