real-device.yml

on:
  # Reusable: called by the Unit tests workflow after the unit jobs pass, and by
  # the comment-triggered workflow for fork PRs (with an explicit ref).
  workflow_call:
    inputs:
      ref:
        description: Git ref or SHA to check out (e.g. refs/pull/<n>/merge). Empty = the triggering ref.
        type: string
        required: false
        default: ''
  # Also runnable on its own (e.g. against a branch or main).
  workflow_dispatch:

name: CI Real Device Test

# Least privilege: the job only checks out code and runs tests.
permissions:
  contents: read

jobs:
  e2e:
    name: e2e (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        include:
          # Each self-hosted runner has its own attached device(s), so each row
          # points at its own repo variables.
          - os: macOS
            devices: GO_IOS_E2E_DEVICES
            tunnel_devices: GO_IOS_E2E_TUNNEL_DEVICES
            preios17_devices: GO_IOS_E2E_PREIOS17_DEVICES
          - os: Linux
            devices: GO_IOS_E2E_LINUX_DEVICES
            tunnel_devices: GO_IOS_E2E_LINUX_TUNNEL_DEVICES
            preios17_devices: GO_IOS_E2E_LINUX_PREIOS17_DEVICES
    runs-on: [self-hosted, "${{ matrix.os }}"]
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.ref }}

      - name: Install Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: false

      - name: Prepare App Store Connect API key
        env:
          GO_IOS_E2E_ASC_PRIVATE_KEY_B64: ${{ secrets.GO_IOS_E2E_ASC_PRIVATE_KEY_B64 }}
        run: |
          mkdir -p "$RUNNER_TEMP/go-ios-e2e"
          printf '%s' "$GO_IOS_E2E_ASC_PRIVATE_KEY_B64" | base64 --decode > "$RUNNER_TEMP/go-ios-e2e/AuthKey.p8"
          echo "GO_IOS_E2E_ASC_PRIVATE_KEY=$RUNNER_TEMP/go-ios-e2e/AuthKey.p8" >> "$GITHUB_ENV"

      # Commands served over the classic lockdown/usbmux services. These work on
      # every device regardless of iOS version.
      - name: E2E tunnel-free
        env:
          GO_IOS_E2E_DEVICES: ${{ vars[matrix.devices] }}
          GO_IOS_E2E_ASC_KEY_ID: ${{ secrets.GO_IOS_E2E_ASC_KEY_ID }}
          GO_IOS_E2E_ASC_ISSUER_ID: ${{ secrets.GO_IOS_E2E_ASC_ISSUER_ID }}
          # Shared signing identity refreshed by refresh-signing-identity.yml; the
          # signing tests mint per-bundle profiles against it instead of creating
          # certificates (Apple allows only one development certificate).
          GO_IOS_E2E_SIGNING_P12_B64: ${{ secrets.GO_IOS_E2E_SIGNING_P12_B64 }}
          GO_IOS_E2E_SIGNING_CERT_ID: ${{ secrets.GO_IOS_E2E_SIGNING_CERT_ID }}
          GO_IOS_E2E_WDA_ARTIFACT_URL: ${{ vars.GO_IOS_E2E_WDA_ARTIFACT_URL }}
          GO_IOS_E2E_DEVICEKIT_ARTIFACT_URL: ${{ vars.GO_IOS_E2E_DEVICEKIT_ARTIFACT_URL }}
          GO_IOS_E2E_WDA_BUNDLE_ID: ${{ vars.GO_IOS_E2E_WDA_BUNDLE_ID }}
          GO_IOS_E2E_WDA_XCTEST_CONFIG: ${{ vars.GO_IOS_E2E_WDA_XCTEST_CONFIG }}
          GO_IOS_E2E_WDA_URL: ${{ vars.GO_IOS_E2E_WDA_URL }}
          GO_IOS_E2E_WDA_URLS: ${{ vars.GO_IOS_E2E_WDA_URLS }}
          GO_IOS_E2E_DEVICEKIT_URL: ${{ vars.GO_IOS_E2E_DEVICEKIT_URL }}
          GO_IOS_E2E_DEVICEKIT_URLS: ${{ vars.GO_IOS_E2E_DEVICEKIT_URLS }}
        run: go test -tags=e2e -count=1 -v ./test/e2e/

      # Commands that need the iOS 17+ tunnel (RemoteServiceDiscovery /
      # CoreDevice / instruments) plus a mounted Developer Disk Image and
      # Developer Mode on the device. Targets its own device list and is skipped
      # when empty. Requires the `ios tunnel` daemon running on the runner host.
      - name: E2E tunnel (iOS 17+)
        if: ${{ !cancelled() && vars[matrix.tunnel_devices] != '' }}
        env:
          GO_IOS_E2E_DEVICES: ${{ vars[matrix.tunnel_devices] }}
        # Run as root where we can (Linux with passwordless sudo) so the
        # kernel-TUN per-device tunnel tests run instead of being skipped
        # (creating a utun needs CAP_NET_ADMIN). Elsewhere (e.g. macOS, or no
        # passwordless sudo) fall back to a normal run — the kernel cases skip
        # themselves. Isolated Go caches keep root's build artifacts out of the
        # runner user's caches.
        run: |
          if [ "$(uname)" = "Linux" ] && sudo -n true 2>/dev/null; then
            sudo -E env "PATH=$PATH" \
              GOCACHE="$RUNNER_TEMP/go-build-root" GOMODCACHE="$RUNNER_TEMP/go-mod-root" \
              go test -tags=e2e -count=1 -v ./test/e2e/tunnel/
          else
            go test -tags=e2e -count=1 -v ./test/e2e/tunnel/
          fi

      # Pre-iOS17 devices serve the entire go-ios feature set — including the
      # instruments/DTX commands (ps, screenshot, launch/kill) that need the
      # tunnel on iOS 17+ — over usbmuxd with only a mounted Developer Disk Image
      # and no tunnel. Targets its own device list and is skipped when empty.
      - name: E2E pre-iOS17 (tunnel-free, DDI)
        if: ${{ !cancelled() && vars[matrix.preios17_devices] != '' }}
        env:
          GO_IOS_E2E_DEVICES: ${{ vars[matrix.preios17_devices] }}
        run: go test -tags=e2e -count=1 -v ./test/e2e/preios17/