chore: decouple yarn install from build job by weitingsun · Pull Request #26369 · MetaMask/metamask-mobile

weitingsun · 2026-02-20T18:34:52Z

Description

Summary
Splits dependency installation and project setup into a dedicated setup-dependencies job and passes node_modules (and related artifacts) to the build job via workflow artifacts. This keeps setup (no secrets) separate from the build (secrets, signing) and allows setup to run with retries and clear verification before the build consumes the artifact.

Test workflows:
flask-test: https://github.com/MetaMask/metamask-mobile/actions/runs/22597598384
main-exp: https://github.com/MetaMask/metamask-mobile/actions/runs/22597580993
main-test: https://github.com/MetaMask/metamask-mobile/actions/runs/22597573374
main-rc: https://github.com/MetaMask/metamask-mobile/actions/runs/22597559233
main-beta: https://github.com/MetaMask/metamask-mobile/actions/runs/22597549406

OTA workflow: https://github.com/MetaMask/metamask-mobile/actions/runs/22636342972/job/65602623716

Changelog

CHANGELOG entry: Separated yarn install from build job in build.yml

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
I've completed the PR template to the best of my ability
I've included tests if applicable
I've documented my code using JSDoc format if applicable
I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Restructures the GitHub Actions build pipeline to rely on cross-job artifacts and platform-specific runners, which can impact build reliability (especially around native deps/symlinks and iOS pod generation). No app runtime logic changes, but failures would block release builds.

Overview
CI build pipeline now separates dependency setup from signing/build. build.yml adds a per-platform setup-dependencies job that runs yarn install/yarn setup:github-ci (with retries) and uploads a tarballed node_modules artifact; the build job no longer runs yarn install and instead downloads, extracts, and verifies the artifact (including symlink checks) before building.

Platform-specific build prep was adjusted. iOS now explicitly sets up Ruby/Xcode, installs CocoaPods in the build job (to match the runner), writes ios/.xcode.env.local for Xcode scripts, and cleans up any existing signing keychain before configuring signing.

Reusable setup workflow expanded. setup-node-modules.yml gains inputs for platform, build_name, submodule checkout, and tarball vs zip uploads; it runs on platform-specific runners when requested, applies build config for correct generated artifacts, and preserves symlinks via tarball uploads.

builds.yml removes the QUICKNODE_BSC_URL and QUICKNODE_SEI_URL secret mappings.

^{Written by Cursor Bugbot for commit 6986e5b. This will update automatically on new commits. Configure here.}

github-actions · 2026-02-20T18:35:03Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

sonarqubecloud · 2026-02-23T23:18:15Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

…com:MetaMask/metamask-mobile into chore/decouple-yarn-install-in-github-build

…nstall-in-github-build

tommasini · 2026-02-27T22:24:47Z

+          submodules: recursive
+
+      # iOS: Use MetaMask's setup action (handles Node, Ruby, CocoaPods, Xcode). Signing is handled by Configure signing certificates below.
+      - name: Setup iOS environment


This seems to be duplicated, I don't think setup-node-modules.yml file needs to setup ios environment, although I'm not 100% sure

tommasini · 2026-02-27T22:27:48Z

+      - name: Setup iOS environment
+        if: inputs.platform == 'ios'
+        timeout-minutes: 15
+        uses: MetaMask/github-tools/.github/actions/setup-e2e-env@v1


We should use v1.7

Suggested change

uses: MetaMask/github-tools/.github/actions/setup-e2e-env@v1

uses: MetaMask/github-tools/.github/actions/setup-e2e-env@v1.7

Is it really needed since we run yarn setup:github-ci?

removed and only add setup node and setup Ruby, will retest OTA

Argh, it seems that it should be 1.7.0

tommasini · 2026-02-27T22:44:47Z

+            security delete-keychain "$KEYCHAIN_PATH" || true
+          fi
+
+      # iOS: Cache DerivedData (includes ModuleCache.noindex) to speed up Xcode builds


Is this something that could cache a build, and in the future bring the wrong build to the artifact? If yes, maybe it's a risk not worth taken, to speed up Xcode builds

tommasini · 2026-02-27T22:47:26Z

          SECRETS_JSON: ${{ toJSON(secrets) }}
        run: node scripts/validate-secrets-from-config.js

+      # iOS: Regenerate Pods and xcconfig on this runner so paths are correct (not from artifact).


Why paths wouldn't be or couldn't be correct here that we would need to re install pods?

we don't run pod install in setup-node-modules because it has to be on the same runner when we build iOS. I've modified the comment.

tommasini · 2026-02-27T22:47:40Z

+      - name: Setup iOS environment
+        if: matrix.platform == 'ios'
+        timeout-minutes: 15
+        uses: MetaMask/github-tools/.github/actions/setup-e2e-env@v1


Suggested change

uses: MetaMask/github-tools/.github/actions/setup-e2e-env@v1

uses: MetaMask/github-tools/.github/actions/setup-e2e-env@v1.7

Wondering if running yarn install on this action make us vulnerable to post install scripts attacks

Good catching, replacing it with Ruby + CocoaPods + Xcode

github-actions · 2026-03-02T21:49:35Z

🔍 Smart E2E Test Selection

Selected E2E tags: None (no tests recommended)
Selected Performance tags: None (no tests recommended)
Risk Level: low
AI Confidence: 90%

click to see 🤖 AI reasoning details

E2E Test Selection:
The changes in this PR are purely CI/CD infrastructure changes affecting the production build workflow (build.yml) and the reusable node_modules setup workflow (setup-node-modules.yml), plus a minor removal of two secrets from builds.yml.

Key findings:

build.yml changes: Refactored to use a new setup-dependencies job that creates node_modules tarballs, changed from hardcoded Node.js v20 to .nvmrc, restructured iOS setup steps (Ruby, Xcode, CocoaPods), added keychain cleanup. These are build optimization changes.
setup-node-modules.yml changes: Added new inputs (platform, build_name, use-tarball, checkout-submodules), platform-specific runners, tarball creation to preserve symlinks. This is a reusable workflow enhancement.
builds.yml changes: Removed QUICKNODE_BSC_URL and QUICKNODE_SEI_URL secrets - infrastructure secrets not used in E2E tests.

Why no E2E tests needed:

The E2E test workflows (run-e2e-workflow.yml, run-e2e-smoke-tests-*.yml) do NOT use setup-node-modules.yml - they have their own setup using MetaMask/github-tools/.github/actions/setup-e2e-env
No application code is changed
No test code or test infrastructure is changed
The changes are focused on optimizing the production build process, not the E2E test pipeline
The build workflow changes will be validated by the build workflow itself when it runs

These CI/CD changes don't require E2E test validation as they don't affect the app functionality or the E2E test execution path.

Performance Test Selection:
These changes are purely CI/CD infrastructure changes affecting build workflows (build.yml, setup-node-modules.yml) and build configuration (builds.yml). No application code is changed that could impact app performance. The changes optimize the build process (tarball artifacts, platform-specific runners) but don't affect runtime performance of the app. No performance tests are needed.

View GitHub Actions results

decouple yarn install from build job

faeb8d0

weitingsun requested a review from a team as a code owner February 20, 2026 18:34

metamaskbot added the team-mobile-platform Mobile Platform team label Feb 20, 2026

github-actions Bot added the size-M label Feb 20, 2026

cursor Bot reviewed Feb 20, 2026

View reviewed changes

Comment thread .github/workflows/build.yml Outdated

weitingsun had a problem deploying to build-exp February 20, 2026 18:41 — with GitHub Actions Failure

weitingsun had a problem deploying to build-exp February 20, 2026 18:44 — with GitHub Actions Failure

weitingsun temporarily deployed to build-exp February 20, 2026 19:58 — with GitHub Actions Inactive

weitingsun temporarily deployed to build-e2e February 20, 2026 20:02 — with GitHub Actions Inactive

increase timeout

7d46d66

cursor Bot reviewed Feb 23, 2026

View reviewed changes

Comment thread .github/workflows/build.yml Outdated

weitingsun had a problem deploying to build-exp February 23, 2026 22:21 — with GitHub Actions Failure

weitingsun had a problem deploying to build-exp February 23, 2026 22:26 — with GitHub Actions Failure

fix CocoaPods path reuse

fc17887

cursor Bot reviewed Feb 23, 2026

View reviewed changes

Comment thread .github/workflows/build.yml

use find instead of ls

029ea36

cursor Bot reviewed Feb 23, 2026

View reviewed changes

Comment thread .github/workflows/build.yml Outdated

Comment thread .github/workflows/build.yml Outdated

Merge branch 'main' into chore/decouple-yarn-install-in-github-build

9e326b4

weitingsun self-assigned this Feb 24, 2026

weitingsun added 2 commits February 23, 2026 21:43

skip cocopods in setup

71d8050

Merge branch 'chore/decouple-yarn-install-in-github-build' of github.…

bbbfff6

…com:MetaMask/metamask-mobile into chore/decouple-yarn-install-in-github-build

weitingsun added this to PR review queue Feb 24, 2026

github-project-automation Bot moved this to Needs dev review in PR review queue Feb 24, 2026

weitingsun temporarily deployed to build-exp February 24, 2026 06:02 — with GitHub Actions Inactive

Merge branch 'main' into chore/decouple-yarn-install-in-github-build

06d0f17

cursor Bot reviewed Feb 24, 2026

View reviewed changes

Comment thread .github/workflows/build.yml

Merge remote-tracking branch 'origin/main' into chore/decouple-yarn-i…

b531fb9

…nstall-in-github-build

tommasini reviewed Feb 27, 2026

View reviewed changes

Comment thread .github/workflows/setup-node-modules.yml

tommasini reviewed Feb 27, 2026

View reviewed changes

simplify build.yml and setup-node-modules.yml

4368006

weitingsun requested a review from tommasini February 28, 2026 00:51

weitingsun added 2 commits February 27, 2026 16:53

Merge branch 'main' into chore/decouple-yarn-install-in-github-build

48aae77

fix ruby setup to match ci.yml

1afba56

weitingsun temporarily deployed to build-exp February 28, 2026 01:18 — with GitHub Actions Inactive

tommasini previously approved these changes Mar 2, 2026

View reviewed changes

github-project-automation Bot moved this from Review in progress to Review finalised - Ready to be merged in PR review queue Mar 2, 2026

tommasini reviewed Mar 2, 2026

View reviewed changes

Comment thread .github/workflows/build.yml Outdated

use .nvmrc for Node version in workflows

76b53e7

weitingsun dismissed tommasini’s stale review via 76b53e7 March 2, 2026 20:00

tommasini previously approved these changes Mar 2, 2026

View reviewed changes

erge branch 'main' into chore/decouple-yarn-install-in-github-build

6986e5b

weitingsun dismissed tommasini’s stale review via 6986e5b March 2, 2026 21:47

weitingsun requested a review from tommasini March 2, 2026 21:48

tommasini approved these changes Mar 2, 2026

View reviewed changes

weitingsun added this pull request to the merge queue Mar 2, 2026

Merged via the queue into main with commit 4111b2d Mar 2, 2026
63 checks passed

weitingsun deleted the chore/decouple-yarn-install-in-github-build branch March 2, 2026 22:28

github-project-automation Bot moved this from Review finalised - Ready to be merged to Merged, Closed or Archived in PR review queue Mar 2, 2026

github-actions Bot locked and limited conversation to collaborators Mar 2, 2026

metamaskbot added the release-7.69.0 Issue or pull request that will be included in release 7.69.0 label Mar 2, 2026

	uses: MetaMask/github-tools/.github/actions/setup-e2e-env@v1
	uses: MetaMask/github-tools/.github/actions/setup-e2e-env@v1.7

Uh oh!

Conversation

weitingsun commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changelog

Related issues

Manual testing steps

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

Uh oh!

github-actions Bot commented Feb 20, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Feb 23, 2026

Quality Gate passed

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Mar 2, 2026

🔍 Smart E2E Test Selection

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

weitingsun commented Feb 20, 2026 •

edited

Loading