feat: create Runway RC

[weitingsun]

Description

New workflow runway_ios_rc_workflow is created. We are using this workflow in Runway for RC release to iOS. If there is a change in OTA version in ota.ts, then we call Push OTA update workflow and push an OTA update to iOS RC. If not, we are going to call Build Mobile App workflow and build a new iOS RC.

Note: added runway_android_rc_workflow

Success workflow runs:
Regular build: https://github.com/MetaMask/metamask-mobile/actions/runs/23260145017
OTA Push: https://github.com/MetaMask/metamask-mobile/actions/runs/23267287137

Changelog

CHANGELOG entry: Added new workflow runway_ios_rc_workflow

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Medium Risk
Adds new GitHub Actions workflows that can dispatch builds, OTA updates, and iOS TestFlight uploads; misconfiguration could trigger the wrong release path or fail deployments. Changes are CI/release-pipeline only, with no runtime app behavior impact beyond the OTA_VERSION constant value change.

Overview
Adds Runway RC GitHub Actions workflows for ios and android that, on workflow_dispatch, detect whether app/constants/ota.ts’s OTA_VERSION changed vs the current release tag (or main) and then either dispatch push-eas-update.yml (requires resolving a PR number) or invoke the reusable build.yml for main-rc builds.

The iOS workflow additionally uploads the generated IPA to TestFlight (with a step summary) after a successful build. Separately simplifies build.yml branch selection by switching source_branch handling to inputs.source_branch || github.ref_name, and updates OTA_VERSION to a placeholder value.

^{Written by Cursor Bugbot for commit b8641bc. This will update automatically on new commits. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[cursor]

Placeholder OTA version string committed to production code

High Severity

OTA_VERSION is set to the placeholder 'vX.XX.X' instead of a real version string. This value is displayed to users in the App Information settings screen (e.g. "MetaMask ota vX.XX.X (build)") and is passed as the message input when the new workflow triggers an OTA update via push-eas-update.yml. The file's own comment says to use version strings like v0, v1, v2 and reset to v0 for new native builds — vX.XX.X is a template marker, not a valid version.

 

[weitingsun]

we will always want to update this when it's an OTA push, so it makes sense to keep it generic on main

[cursor]

Duplicated decide job across iOS and Android workflows

Low Severity

The entire decide job (~70 lines including OTA detection logic, PR resolution, and sed-based version extraction) is copy-pasted verbatim between runway_ios_rc_workflow.yml and runway_android_rc_workflow.yml. The trigger-ota job is also nearly identical (differing only in the platform value). A bug fix or behavior change to the OTA detection logic (e.g., the fragile sed -n '9p' extraction) would need to be applied to both files independently, risking divergence. Extracting the shared decide logic into a reusable workflow (like build.yml is used) would reduce this maintenance risk.

Additional Locations (1)

• .github/workflows/runway_ios_rc_workflow.yml#L30-L102

 

[weitingsun]

sounds good will extract in the next PR :)

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: None (no tests recommended)
• Selected Performance tags: None (no tests recommended)
• Risk Level: low
• AI Confidence: 95%

click to see 🤖 AI reasoning details

E2E Test Selection:
All 4 changed files are CI/CD infrastructure changes with no impact on app functionality or E2E test flows:

1. .github/workflows/build.yml: Minor expression simplification — inputs.source_branch != '' && inputs.source_branch || github.ref_name → inputs.source_branch || github.ref_name. These are semantically equivalent in GitHub Actions (empty string is falsy), so this is a cosmetic/readability fix with no behavioral change.

2. .github/workflows/runway_android_rc_workflow.yml (new file): New Runway-triggered workflow for Android RC builds. Purely CI pipeline automation — decides between OTA update or full native build based on OTA_VERSION bump detection. No app code changes.

3. .github/workflows/runway_ios_rc_workflow.yml (new file): New Runway-triggered workflow for iOS RC builds with TestFlight upload. Same pattern as Android workflow. Purely CI pipeline automation.

4. app/constants/ota.ts: OTA_VERSION changed from 'v7.65.1' to 'vX.XX.X'. This constant is only used for: (a) Sentry tag metadata (expo-ota-version), and (b) log metadata. It has no effect on any user-facing functionality, navigation, controllers, or E2E test flows. The new CI workflows read this value via sed from the file directly — it's a placeholder reset for the new workflow's bump-detection logic.

None of these changes affect: app source code logic, UI components, controllers, navigation, test infrastructure (page objects, fixtures, test framework), or any user flows tested by E2E tests. No E2E tests are warranted.

Performance Test Selection:
All changes are CI/CD workflow files and a version string constant. No app code, UI components, data loading, state management, or performance-sensitive paths were modified. Performance tests are not warranted.

View GitHub Actions results

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

There are 4 total unresolved issues (including 2 from previous reviews).

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

[cursor]

Deprecated Node.js 16 action in new workflows

Medium Severity

Both new workflow files use actions/github-script@v6, which runs on the deprecated Node.js 16 runtime. GitHub has been warning about Node.js 16 deprecation since September 2023, and these actions will eventually fail. The same repo already uses actions/github-script@v7 (Node.js 20) in generate-rc-test-plan.yml, so the newer version is already proven to work in this codebase.

Additional Locations (1)

• .github/workflows/runway_android_rc_workflow.yml#L119-L120

 

[cursor]

Near-identical decide job duplicated across workflows

Low Severity

The decide job (~70 lines) is completely identical between runway_ios_rc_workflow.yml and runway_android_rc_workflow.yml. The only differences between the two files are the platform string ('ios' vs 'android') in trigger-ota and trigger-build, plus the iOS-specific TestFlight upload jobs. A reusable workflow parameterized by platform would eliminate the duplication and the risk of the two copies drifting out of sync.

Additional Locations (1)

• .github/workflows/runway_android_rc_workflow.yml#L30-L102

 

[weitingsun]

we want separate workflows for Runway

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud