ci(INFRA-3595): Phase 3 — Namespace cache and GRADLE_USER_HOME fix for Android build

[alucardzom]

Description

INFRA-3595 Phase 3 — adds Namespace Cache Volumes integration to the Android build and setup workflows, and fixes the GRADLE_USER_HOME path mismatch that blocked Android builds on Namespace runners.

Changes:

1. build-android-e2e.yml: Make GRADLE_USER_HOME conditional on runner_provider (/home/runner/_work/.gradle on Namespace vs /home/admin/_work/.gradle on Cirrus). Add nscloud-cache-action covering yarn, .metamask, node_modules, .yarn/cache, and Gradle caches/wrapper. Gate all 4 cirruslabs/cache steps on runner_provider != 'namespace'. On Namespace, always run full build (no APK fingerprint cache since cirruslabs/cache is skipped).

2. setup-node-modules.yml: Add nscloud-cache-action before dependency install. Make setup-node cache: conditional (disabled on Namespace). Gate .metamask actions/cache on current path.

Both cache paths coexist for rollback safety. When runner_provider: current (default on all triggers), all ternaries collapse to prior values — cirruslabs/cache runs, nscloud-cache-action is skipped. Behavior is byte-identical to the base branch.

Builds on Phase 1 (PR #29716) and Phase 0 (PR #29557).

Changelog

CHANGELOG entry: null

Related issues

Fixes: INFRA-3595 (parent epic INFRA-3511)
Refs: INFRA-3592 (Phase 0, PR #29557), INFRA-3593 (Phase 1, PR #29716)

Manual testing steps

Feature: Android build on Namespace runners

  Scenario: dispatch with namespace provider — Android build succeeds
    Given the branch phase3-namespace-android
    When user runs `gh workflow run ci.yml --ref phase3-namespace-android -f runner_provider=namespace`
    Then Build Android E2E APKs succeeds on namespace-profile-metamask-android-build
    And GRADLE_USER_HOME resolves to /home/runner/_work/.gradle
    And nscloud-cache-action caches Gradle deps and yarn/node_modules
    And cirruslabs/cache steps are skipped

  Scenario: dispatch with current provider — byte-identical to base
    Given the branch phase3-namespace-android
    When user runs `gh workflow run ci.yml --ref phase3-namespace-android -f runner_provider=current`
    Then Build Android E2E APKs succeeds on Cirrus ubuntu-runner-amd64
    And GRADLE_USER_HOME resolves to /home/admin/_work/.gradle
    And cirruslabs/cache steps run as before
    And nscloud-cache-action steps are skipped

  Scenario: implicit current via PR/push trigger
    Given a push or pull_request event (no workflow_dispatch)
    Then inputs.runner_provider is undefined/empty
    And all ternaries collapse to existing behavior

Screenshots/Recordings

Before

N/A

After

N/A — CI infrastructure PR, no UI surface.

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

N/A — workflow YAML only, no app code.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Made with Cursor

---

Note

Medium Risk
Moderate risk because it changes runner selection and caching behavior across core CI/build/E2E workflows, which can impact build determinism and job reliability. Default behavior remains current, but the new namespace path introduces new cache tooling and environment differences (e.g., Gradle home).

Overview
Adds an opt-in runner_provider switch across CI, build, and E2E workflows to route jobs to Namespace runner profiles (new labels added to actionlint.yaml) instead of the existing GitHub/Cirrus runners.

When runner_provider=namespace, enables namespacelabs/nscloud-cache-action for Yarn/node_modules/.metamask (and Gradle caches for Android), disables existing actions/cache/cirruslabs/cache steps where incompatible, and adjusts Android GRADLE_USER_HOME to the Namespace filesystem layout. Manual dispatch workflows (e.g., ci.yml, build.yml, Expo dev build, and E2E regression runs) now expose runner_provider as an input and forward it through reusable workflows.

^{Reviewed by Cursor Bugbot for commit 207bf39. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[github-actions]

🔍 Smart E2E Test Selection

⏭️ Smart E2E selection skipped - skip-smart-e2e-selection label found

All E2E tests pre-selected.

View GitHub Actions results

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 207bf39. Configure here.}

[cursor]

check-diff job missing Namespace cache setup

Medium Severity

The check-diff job has its runs-on updated to use a Namespace runner when runner_provider == 'namespace', but unlike every other similarly modified job in ci.yml, it is missing the nscloud-cache-action step, the conditional cache: parameter on actions/setup-node (still hardcoded to yarn), and the conditional gating of the .metamask actions/cache step. On Namespace runners, this job will run without the persistent disk cache that all other jobs use, creating an inconsistent caching strategy and causing slower builds. Compare to e.g. the dedupe or unit-tests jobs which received the full Namespace cache treatment.

 

^{Reviewed by Cursor Bugbot for commit 207bf39. Configure here.}

[alucardzom]

Verification evidence

All three validation scenarios have been executed and passed:

Scenario	Run	Result
Current path (PR trigger)	25421406400	All Android jobs passed on Cirrus (27/27 E2E shards, APK build, all Linux CI jobs). One iOS E2E flake re-running.
Namespace path (manual dispatch)	25427754071	Android build + all 27 E2E smoke shards passed on namespace-profile-metamask-android-build (16x32).
Rollback drill (runner_provider=current)	25430829673	Completed successfully. All jobs on Cirrus/GitHub-hosted runners.

Key findings during validation

• metamask-android-build profile required scale-up from 8x16 to 16x32 due to Gradle daemon OOM (Cirrus lg runner has 48GB)
• GRADLE_USER_HOME conditional fix confirmed working (/home/runner/_work/.gradle on Namespace vs /home/admin/_work/.gradle on Cirrus)
• One transient Gradle Plugin Portal 503 outage resolved on retry
• Unit test shard 8 OOM on Namespace is a pre-existing issue from Phase 1 (not related to Android changes)