ci: run Linux CI on Namespace shadow behind NAMESPACE_SHADOW_LINUX_AUTO_DISPATCH

[alucardzom]

Description

Extends the Namespace shadow CI (introduced in #32893) so we can also benchmark Linux CI jobs on Namespace runners, controlled by a second repo Actions variable.

What is the reason for the change?

The Namespace shadow currently runs iOS-only (gated by NAMESPACE_SHADOW_AUTO_DISPATCH, enabled since Jul 13). The next step of the Namespace evaluation is getting Linux CI runs (lint/dedupe/scripts/unit/component/integration tests) on namespace-profile-metamask-ci-linux runners, toggleable independently from the iOS pipeline.

What is the improvement/solution?

A namespace shadow run is now composed of two independently-flagged pipelines:

NAMESPACE_SHADOW_AUTO_DISPATCH (existing)	NAMESPACE_SHADOW_LINUX_AUTO_DISPATCH (new)	Shadow behavior
true	false/unset	Auto-dispatch on PR/push; iOS pipeline only (current behavior)
false/unset	true	Auto-dispatch on PR/push; Linux pipeline only (no macOS runners used)
true	true	Auto-dispatch on PR/push; iOS + Linux pipelines
false/unset	false/unset	No auto-dispatch; manual workflow_dispatch yields a near-empty scaffolding run

The Linux pipeline covers everything that runs on Linux runners — the quality jobs on namespace-profile-metamask-ci-linux and Android build + Android E2E smoke on namespace-profile-metamask-android-build — matching what the Phase 5 benchmark exercised (verified against Phase 5 shadow run 27025678155, where all Android jobs ran on Namespace runners).

1. ci-namespace-shadow.yml — the dispatch gate now ORs the two flags: PR/push auto-dispatch happens when either variable is true (manual workflow_dispatch always works; fork-PR guard unchanged).
2. ci.yml —
   • Linux pipeline (12 jobs): dedupe, git-safe-dependencies, scripts, js-bundle-size-check, check-workflows, prepare-ci-js-deps, unit-tests, component-view-tests, integration-tests, merge-unit-and-component-view-tests, build-android-apks, e2e-smoke-tests-android now use (inputs.runner_provider != 'namespace' || vars.NAMESPACE_SHADOW_LINUX_AUTO_DISPATCH == 'true') instead of a hard namespace skip. All of them already had namespace runner ternaries and nscloud checkout/cache/artifact steps from the Phase 5 benchmark — no step changes needed.
     • prepare-ci-js-deps is included because merge-unit-and-component-view-tests explicitly requires it to have succeeded.
     • integration-tests (added to ci.yml after ci: re-enable Namespace shadow CI (iOS-only) behind NAMESPACE_SHADOW_AUTO_DISPATCH #32893) previously had no shadow gate at all; it now follows the same BITRISE/NAMESPACE-SHADOW pattern (skipped on Bitrise shadow, flag-gated on Namespace shadow).
   • iOS pipeline: check-diff and build-ios-apps (the macOS entry jobs) are now gated on NAMESPACE_SHADOW_AUTO_DISPATCH == 'true' for namespace runs, so a Linux-only shadow uses no macOS runners. Downstream iOS jobs cascade-skip via needs.
   • Unchanged (never run in namespace shadows): appium-smoke-tests-android (pinned to runner_provider: current/Cirrus until Namespace parity is ready, and it cannot download namespace-built APKs — they live in Namespace's artifact store, not GitHub's), performance tests, report-fixture-validation (PR comments), SonarCloud analysis + quality gate (would collide with the real run's analysis of the same commit), cleanup-ci-js-deps, check-all-jobs-pass, log-merge-group-failure.

Normal CI runs (runner_provider empty/current) and Bitrise shadow runs are unaffected — every new clause short-circuits to the previous behavior when the provider is not namespace.

Rollout:

1. Create the new variable (can be prepared in advance — merging this PR alone changes nothing for Linux):

   gh variable set NAMESPACE_SHADOW_LINUX_AUTO_DISPATCH --body false --repo MetaMask/metamask-mobile

2. Greenlight Linux auto-dispatch: set the variable to true.

3. Kill switch (either pipeline, no code PR needed): set the respective variable back to false.

Pre-merge verification (done): with NAMESPACE_SHADOW_LINUX_AUTO_DISPATCH=true and NAMESPACE_SHADOW_AUTO_DISPATCH=false, "CI (Namespace shadow)" was dispatched on this branch — shadow ci.yml run (auto-dispatched by the ready_for_review event, superseding the initial manual run via the ci.yml concurrency group — the auto-dispatch gate itself verified in the process) — in parallel with the normal pull_request run:

• Linux quality jobs (dedupe, lint, scripts, unit/integration/component tests…) ran on namespace-profile-metamask-ci-linux ✅
• Build Android E2E APKs + Android E2E smoke ran on namespace-profile-metamask-android-build ✅
• Check diff and Build iOS Apps (and all downstream iOS jobs) skipped — the iOS flag gate works ✅
• Smart E2E selection / Sonar / PR-comment / Appium jobs skipped — nothing touches the PR ✅
• The parallel normal run was unaffected (regular runners, regular behavior) ✅
• The dispatcher's auto-runs on earlier pushes were correctly skipped while both flags were false ✅

Changelog

CHANGELOG entry: null

Related issues

Fixes: N/A — no Jira ticket yet (number can be added to the PR title later). Related prior work: #32893 (NAMESPACE_SHADOW_AUTO_DISPATCH, iOS-only namespace shadow), INFRA-3631 / INFRA-3678 (Namespace evaluation), INFRA-3679 (Bitrise shadow pattern).

Manual testing steps

Feature: Namespace shadow CI with independent iOS and Linux pipeline flags

  Scenario: Linux pipeline disabled (default)
    Given NAMESPACE_SHADOW_LINUX_AUTO_DISPATCH is unset or "false"
    And NAMESPACE_SHADOW_AUTO_DISPATCH is "true"
    When the shadow dispatches ci.yml with runner_provider=namespace
    Then only the iOS pipeline runs (current behavior)
    And dedupe, scripts, unit/component/integration tests are skipped

  Scenario: Linux-only shadow run
    Given NAMESPACE_SHADOW_LINUX_AUTO_DISPATCH is "true"
    And NAMESPACE_SHADOW_AUTO_DISPATCH is "false"
    When the shadow dispatches ci.yml with runner_provider=namespace
    Then the quality jobs run on namespace-profile-metamask-ci-linux runners
    And the Android APK build and Android E2E smoke shards run on namespace-profile-metamask-android-build runners
    And Appium Android stays skipped
    And check-diff and build-ios-apps (and all downstream iOS jobs) are skipped
    And no macOS runner is used

  Scenario: both pipelines enabled
    Given both variables are "true"
    When the shadow dispatches ci.yml
    Then the Linux jobs and the iOS build + E2E smoke pipeline both run

  Scenario: auto-dispatch gate
    Given at least one of the two variables is "true"
    When a same-repo pull request is opened or synchronized, or a commit is pushed to main
    Then the shadow dispatcher fires (fork PRs never dispatch)
    And with both variables "false" only manual workflow_dispatch runs

  Scenario: no interference with normal CI
    Given a regular pull_request ci.yml run (runner_provider is empty)
    Then all conditions short-circuit to the previous behavior
    And Bitrise shadow runs remain iOS-only

  Scenario: validation
    Given the two modified workflow files
    When actionlint runs against them
    Then no errors are reported (verified locally)

Screenshots/Recordings

CI workflow change — evidence is the verification runs:

Before

Namespace shadow runs were iOS-only: example run (Linux/Android jobs hard-skipped for runner_provider=namespace).

After

Linux-pipeline shadow run with NAMESPACE_SHADOW_LINUX_AUTO_DISPATCH=true, iOS flag off: shadow run 29453403464 — Linux + Android jobs on Namespace runners, iOS jobs skipped, parallel normal PR run unaffected.

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

• I've tested on Android
  • Ideally on a mid-range device; emulator is acceptable
• I've tested with a power user scenario
  • Use these power-user SRPs to import wallets with many accounts and tokens
• I've instrumented key operations with Sentry traces for production performance metrics
  • See trace() for usage and addToken for an example

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[metamask-ci]

PR template — items to address before "Ready for review"

Warnings — informational, address before merging:

• Pre-merge author checklist has unchecked items (e.g. "I've tested on Android"). Every box must be consciously checked — see docs/readme/ready-for-review.md.

See docs/readme/ready-for-review.md for the full Definition of Ready for Review.

[metamask-ci]

PR template — items to address before "Ready for review"

Warnings — informational, address before merging:

• Pre-merge author checklist has unchecked items (e.g. "I've tested on Android"). Every box must be consciously checked — see docs/readme/ready-for-review.md.

See docs/readme/ready-for-review.md for the full Definition of Ready for Review.

[github-actions]

🔍 Smart E2E Test Selection

• Selected E2E tags: None (no tests recommended)
• Selected Performance tags: None (no tests recommended)
• Risk Level: low
• AI Confidence: 97%

click to see 🤖 AI reasoning details

E2E Test Selection:
Both changed files are GitHub Actions CI workflow files with purely infrastructure-level changes:

1. .github/workflows/ci-namespace-shadow.yml: Updates comments and the dispatch if: condition to add NAMESPACE_SHADOW_LINUX_AUTO_DISPATCH as an additional trigger variable alongside the existing NAMESPACE_SHADOW_AUTO_DISPATCH. No app code, no test logic.

2. .github/workflows/ci.yml: Expands the Namespace shadow CI pipeline from iOS-only to also support a Linux pipeline (lint, unit tests, scripts, Android build + E2E smoke) when NAMESPACE_SHADOW_LINUX_AUTO_DISPATCH=true. All changes are conditional if: expressions on job definitions — specifically updating inputs.runner_provider != 'namespace' to (inputs.runner_provider != 'namespace' || vars.NAMESPACE_SHADOW_LINUX_AUTO_DISPATCH == 'true') across multiple jobs (dedupe, git-safe-dependencies, scripts, js-bundle-size-check, check-workflows, prepare-ci-js-deps, unit-tests, sonar, component-view-tests, integration-tests, build-android-apks, e2e-smoke-tests-android, build-ios-apps, appium-smoke-tests-android).

No application source code, test specs, page objects, selectors, flows, or performance-sensitive code was modified. These are purely CI infrastructure plumbing changes that control when jobs run on Namespace shadow infrastructure — they have zero impact on any user-facing functionality or test behavior. No E2E smoke tags are warranted.

Performance Test Selection:
No application code, performance-sensitive flows, or performance test specs were modified. The changes are purely CI workflow conditional expressions affecting when jobs run on Namespace shadow infrastructure. No performance impact whatsoever.

View GitHub Actions results

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud