release: 8.7.0

.depcheckrc.yml

@@ -38,6 +38,8 @@ ignores:
   # ESBuild is used for AI E2E script compilation
   - 'esbuild'
   - 'esbuild-register'
+  # Used via `node -r @babel/register` in package.json scripts (not an import)
+  - '@babel/register'
   # tsx runs all scripts/tooling/*.ts files directly (CLI wrapper, MCP server, yarn pre/post hooks, report CLI)
   - 'tsx'
   # agent-device is used as a CLI (`yarn agent-device`), not imported
@@ -152,6 +154,9 @@ ignores:
   # Used in Yarn plugin for preview builds
   - '@yarnpkg/core'
 
+  # Consumed by the Yarn plugin and agent hooks, outside of app source
+  - '@metamask/tooling-insight'
+
   # Babel plugins referenced in babel.config.js by their short name (without
   # the `babel-plugin-` prefix). Babel resolves them correctly at build time
   # but depcheck doesn't recognize the indirect reference. See babel.config.js

.detoxrc.js

@@ -36,15 +36,6 @@ module.exports = {
     retries: process.env.CI ? 1 : 0,
   },
   configurations: {
-    'ios.sim.apiSpecs': {
-      device: 'ios.simulator',
-      app: process.env.CI ? `ios.${process.env.METAMASK_BUILD_TYPE}.release` : 'ios.debug',
-      testRunner: {
-        args: {
-          "$0": "node tests/smoke/api-specs/run-api-spec-tests.js",
-        },
-      },
-    },
     'android.emu.main': {
       device: 'android.emulator',
       app: 'android.debug',

.e2e.env.example

@@ -28,6 +28,11 @@ export PREBUILT_ANDROID_TEST_APK_PATH='build/MetaMask-Test.apk'
 # export SKIP_APP_REINSTALL=true
 export SKIP_APP_REINSTALL=false
 
+# Playwright Appium: reuse one WebDriver session per worker (emulator/simulator).
+# Default is on when unset. Set false to force per-test deleteSession (rollback).
+# BrowserStack ignores this and never reuses sessions.
+# export APPIUM_SESSION_REUSE=false
+
 export TEST_SRP_1=
 export TEST_SRP_2=
 export TEST_SRP_3=

.eslintrc.js

@@ -84,8 +84,6 @@ const utilNumberImportBurndownFiles = [
   'app/components/UI/Stake/components/StakingBalance/StakingBanners/ClaimBanner/ClaimBanner.tsx',
   'app/components/UI/Stake/components/StakingConfirmation/TokenValueStack/TokenValueStack.test.tsx',
   'app/components/UI/Stake/components/StakingConfirmation/TokenValueStack/TokenValueStack.tsx',
-  'app/components/UI/Stake/components/StakingConfirmation/YouReceiveCard/YouReceiveCard.test.tsx',
-  'app/components/UI/Stake/components/StakingConfirmation/YouReceiveCard/YouReceiveCard.tsx',
   'app/components/UI/Stake/hooks/useBalance.ts',
   'app/components/UI/UrlAutocomplete/Result.tsx',
   'app/components/Views/GasEducationCarousel/index.js',
@@ -98,9 +96,7 @@ const utilNumberImportBurndownFiles = [
   'app/components/Views/confirmations/components/info/typed-sign-v3v4/simulation/components/native-value-display/native-value-display.tsx',
   'app/components/Views/confirmations/components/info/typed-sign-v3v4/simulation/components/value-display/value-display.tsx',
   'app/components/Views/confirmations/components/transactions/custom-amount/custom-amount.tsx',
-  'app/components/Views/confirmations/context/send-context/utils.ts',
   'app/components/Views/confirmations/external/staking/hooks/useStakingDetails.ts',
-  'app/components/Views/confirmations/hooks/earn/useCustomAmount.tsx',
   'app/components/Views/confirmations/hooks/gas/useCancelSpeedupGas/useCancelSpeedupGas.ts',
   'app/components/Views/confirmations/hooks/send/useBalance.ts',
   'app/components/Views/confirmations/hooks/send/useCurrencyConversions.ts',
@@ -263,6 +259,55 @@ module.exports = {
         ],
       },
     },
+    // MMQA-2174 / MMQA-2173: re-apply after *.{ts,tsx} override which replaces no-restricted-syntax
+    {
+      files: ['tests/page-objects/**/*.{js,ts}', 'tests/flows/**/*.{js,ts}'],
+      excludedFiles: [
+        'tests/page-objects/**/*.test.ts',
+        'tests/page-objects/**/*.test.js',
+        'tests/flows/**/*.test.ts',
+        'tests/flows/**/*.test.js',
+      ],
+      rules: {
+        // UnifiedGestures Identifier stays out of this error list so legacy PO
+        // usages remain warn-only via no-restricted-imports (MMQA-2174).
+        'no-restricted-syntax': [
+          'error',
+          {
+            selector: 'WithStatement',
+            message: 'With statements are not allowed',
+          },
+          {
+            selector: 'SequenceExpression',
+            message: 'Sequence expressions are not allowed',
+          },
+        ],
+      },
+    },
+    {
+      files: ['tests/smoke-appium/**/*.{js,ts}', 'tests/smoke/**/*.{js,ts}'],
+      excludedFiles: [
+        'tests/smoke-appium/**/*.test.ts',
+        'tests/smoke/**/*.test.ts',
+      ],
+      rules: {
+        'no-restricted-syntax': [
+          'error',
+          {
+            selector: 'WithStatement',
+            message: 'With statements are not allowed',
+          },
+          {
+            selector: 'SequenceExpression',
+            message: 'Sequence expressions are not allowed',
+          },
+          {
+            selector: "Identifier[name='UnifiedGestures']",
+            message: 'Use Gestures instead of UnifiedGestures.',
+          },
+        ],
+      },
+    },
     {
       files: ['*.js', '*.jsx'],
       parser: '@babel/eslint-parser',

.github/CODEOWNERS

@@ -50,7 +50,6 @@ scripts/build.sh                                            @MetaMask/mobile-pla
 fingerprint.config.js                                       @MetaMask/mobile-platform
 builds.yml                                                  @MetaMask/mobile-platform
 .github/workflows/generate-build-version.yml                @MetaMask/mobile-platform
-.github/workflows/commit-build-version.yml                  @MetaMask/mobile-platform
 .github/workflows/push-eas-update.yml                       @MetaMask/mobile-admins
 .github/workflows/build-and-upload-to-testflight.yml        @MetaMask/mobile-admins
 .github/workflows/upload-to-testflight.yml                  @MetaMask/mobile-admins
@@ -373,18 +372,15 @@ tests/websocket/                                                @MetaMask/qa
 .github/workflows/run-appium-smoke-tests-ios.yml                @MetaMask/qa
 .github/workflows/run-e2e-workflow.yml                          @MetaMask/qa
 .github/workflows/run-e2e-api-specs.yml                         @MetaMask/qa
-.github/workflows/run-e2e-smoke-tests-android.yml               @MetaMask/qa
 .github/workflows/run-e2e-smoke-tests-android-flask.yml         @MetaMask/qa
-.github/workflows/run-e2e-smoke-tests-ios.yml                   @MetaMask/qa
 .github/workflows/run-e2e-smoke-tests-ios-flask.yml             @MetaMask/qa
 .github/workflows/rerun-ci-on-skipped-e2e-labels.yml            @MetaMask/qa
 .github/workflows/update-e2e-fixtures.yml                       @MetaMask/qa
 .github/workflows/qa-stats.yml                                  @MetaMask/qa
 .github/workflows/flaky-test-report.yml                         @MetaMask/qa
 .github/workflows/performance-test-runner.yml                   @MetaMask/qa
 .github/workflows/run-performance-e2e.yml                       @MetaMask/qa
-.github/workflows/run-performance-e2e-experimental.yml          @MetaMask/qa
-.github/workflows/run-performance-e2e-release.yml               @MetaMask/qa
+.github/workflows/run-performance-e2e-manual.yml                @MetaMask/qa
 .github/workflows/run-system-tests.yml                          @MetaMask/qa
 .github/scripts/e2e-*.mjs                                       @MetaMask/qa
 .github/scripts/collect-qa-stats.mjs                            @MetaMask/qa

.github/actions/find-reusable-build/action.yml

@@ -14,6 +14,12 @@ description: >-
   `event: pull_request` to let the fingerprint itself act as the cross-PR
   deduplication key.
 
+  Each tier is swept once per run status (`success`, `in_progress`, `failure`,
+  then `completed`) so that one crowded page of recent runs cannot consume the
+  candidate window. A donor only needs to have uploaded its artifacts, not to
+  have finished: the native build publishes the app roughly 25-35 minutes before
+  the run completes, since E2E tests keep the run alive well past that point.
+
 inputs:
   fingerprint:
     description: 'The @expo/fingerprint hash the candidate must match'
@@ -44,17 +50,23 @@ inputs:
     required: false
     default: 'build-source-hash'
   max-candidates-per-branch:
-    description: 'How many recent runs to inspect per branch-scoped tier (same-branch, base-branch)'
+    description: >-
+      How many recent runs to inspect per branch-scoped tier (same-branch,
+      base-branch), per conclusion sweep. Because sweeps filter server-side on
+      run conclusion, this budget is spent on terminal runs rather than on
+      in-flight ones — which matters most for the base-branch tier, where `main`
+      CI runs longer than the merge cadence, so a large share of the newest runs
+      are always still building.
     required: false
     default: '10'
   max-candidates-cross-pr:
     description: >-
       How many recent `pull_request`-event runs (across all branches) to inspect
-      in the cross-PR tier. The fingerprint filter is highly discriminating, so
-      the practical cost is one `listCommitStatusesForRef` call per candidate
-      until a run-specific status match is found.
+      in the cross-PR tier, per conclusion sweep. The fingerprint filter is highly
+      discriminating, so the practical cost is one `listCommitStatusesForRef` call
+      per candidate until a run-specific status match is found.
     required: false
-    default: '30'
+    default: '50'
   main-branch-only:
     description: >-
       When true, only search the base branch (typically `main`) for reusable
@@ -147,7 +159,7 @@ runs:
             : requiredArtifacts;
 
           const maxCandidates = Number(MAX_CANDIDATES) || 10;
-          const maxCandidatesCrossPr = Number(MAX_CANDIDATES_CROSS_PR) || 30;
+          const maxCandidatesCrossPr = Number(MAX_CANDIDATES_CROSS_PR) || 50;
           const currentRunId = String(CURRENT_RUN_ID);
 
           // Three-tier discovery:
@@ -248,48 +260,128 @@ runs:
           const seenRunIds = new Set();
           seenRunIds.add(currentRunId);
 
-          for (const tier of tiers) {
-            core.info(`Searching tier: ${tier.label}`);
-            let runs;
+          // Rate-limit accounting. The `/rate_limit` endpoint is itself free, so
+          // reading it before and after the search costs nothing and tells us how
+          // much of the hourly core budget one lookup actually consumes.
+          async function readRateLimit() {
+            try {
+              const { data } = await github.rest.rateLimit.get();
+              return data.resources.core;
+            } catch (err) {
+              core.info(`rateLimit.get failed: ${err.message}`);
+              return null;
+            }
+          }
+
+          const rateLimitBefore = await readRateLimit();
+
+          async function logRateLimit() {
+            const after = await readRateLimit();
+            if (!after) return;
+            const used = rateLimitBefore ? rateLimitBefore.remaining - after.remaining : null;
+            const resetAt = new Date(after.reset * 1000).toISOString();
+            core.info(
+              `Rate limit (core): ${after.remaining}/${after.limit} remaining, ` +
+              `${used === null ? 'unknown' : used} request(s) used by this lookup, resets at ${resetAt}`,
+            );
+            if (after.remaining < after.limit * 0.1) {
+              core.warning(
+                `GitHub API core rate limit is low: ${after.remaining}/${after.limit} remaining until ${resetAt}`,
+              );
+            }
+          }
+
+          // Each tier is swept once per run status below, applied server-side via
+          // the `status` filter so that a single crowded page of recent runs can't
+          // consume a tier's candidate window. On a busy repo the newest runs are
+          // dominated by in-flight runs and by runs that concurrency cancelled
+          // mid-build; sweeping per status keeps each category's budget separate.
+          //
+          // Order matters, and it is deliberately not "terminal states first":
+          //
+          //   success     - a fully green run is the most conservative donor.
+          //   in_progress - a run only needs to have *uploaded* its artifacts to be
+          //                 a valid donor; it does not need to have finished. The
+          //                 native build completes roughly 25-35 minutes before the
+          //                 run itself does, because E2E tests keep the run alive
+          //                 long after the `.app` is published. Skipping these runs
+          //                 discarded a complete, verified build for that entire
+          //                 window - measured at 8 of 18 cold-fingerprint rebuilds,
+          //                 one of them with a donor that had been ready 32 minutes.
+          //                 `hasAllArtifacts` below is what makes this safe: a run
+          //                 mid-upload simply fails that check and is skipped.
+          //   failure     - a run can fail on a job unrelated to the native build
+          //                 while still holding complete artifacts.
+          //   completed   - last resort; picks up cancelled, timed-out and neutral
+          //                 runs, preserving reach.
+          //
+          // `queued` is intentionally not swept: such runs cannot have artifacts yet,
+          // so they would only cost API calls.
+          const statusSweeps = ['success', 'in_progress', 'failure', 'completed'];
+
+          async function listCandidates(tier, status) {
             try {
               const { data } = await github.rest.actions.listWorkflowRuns({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 workflow_id: WORKFLOW_FILE,
+                status,
                 ...tier.params,
               });
-              runs = data.workflow_runs || [];
+              return data.workflow_runs || [];
             } catch (err) {
-              core.warning(`listWorkflowRuns failed for tier "${tier.label}": ${err.message}`);
-              continue;
+              core.warning(
+                `listWorkflowRuns failed for tier "${tier.label}" (status=${status}): ${err.message}`,
+              );
+              return [];
             }
+          }
 
+          async function findMatch(tier, runs) {
             for (const run of runs) {
               const runIdStr = String(run.id);
               if (seenRunIds.has(runIdStr)) continue;
               seenRunIds.add(runIdStr);
 
               if (tier.skipHeadBranch && run.head_branch === tier.skipHeadBranch) continue;
 
-              if (run.status !== 'completed') continue;
-
+              // Deliberately no `run.status === 'completed'` gate: artifact
+              // availability, not run completion, is what makes a donor usable, and
+              // `hasAllArtifacts` verifies that below.
               if (!(await hasRunFingerprintStatus(run.head_sha, run.id))) {
                 core.info(`Run ${run.id} has no run-specific ${STATUS_CONTEXT} status matching fingerprint ${TARGET_FINGERPRINT}`);
                 continue;
               }
 
               if (!(await hasAllArtifacts(run.id))) continue;
 
+              return run;
+            }
+            return null;
+          }
+
+          for (const tier of tiers) {
+            core.info(`Searching tier: ${tier.label}`);
+
+            for (const status of statusSweeps) {
+              const runs = await listCandidates(tier, status);
+              core.info(`  sweep status=${status}: ${runs.length} run(s) returned`);
+
+              const match = await findMatch(tier, runs);
+              if (!match) continue;
+
               core.info(
-                `Match: tier="${tier.label}" run=${run.id} sha=${run.head_sha} branch=${run.head_branch} url=${run.html_url}`,
+                `Match: tier="${tier.label}" status=${status} run=${match.id} sha=${match.head_sha} branch=${match.head_branch} url=${match.html_url}`,
               );
               core.setOutput('found', 'true');
-              core.setOutput('run-id', runIdStr);
-              core.setOutput('source-sha', run.head_sha);
-              core.setOutput('source-branch', run.head_branch || '');
+              core.setOutput('run-id', String(match.id));
+              core.setOutput('source-sha', match.head_sha);
+              core.setOutput('source-branch', match.head_branch || '');
+              await logRateLimit();
               return;
             }
           }
 
           core.info('No reusable build found across any tier');
+          await logRateLimit();
           setNotFound();

.github/actions/setup-e2e-env/action.yml

@@ -325,12 +325,22 @@ runs:
       if: ${{ inputs.runner_provider != 'namespace' && inputs.runner_provider != 'bitrise' }}
       uses: actions/cache@v4
       with:
+        # NOTE: actions/cache archives directories recursively and does NOT
+        # honour `!` exclusion patterns for directory contents (resolvePaths
+        # runs with implicitDescendants: false). Gradle/CMake intermediates
+        # that Android native builds write inside node_modules (~4-5 GB
+        # uncompressed) are instead deleted by the "Clean native build
+        # intermediates from node_modules" step in build-android-e2e.yml
+        # before the post-job save runs.
         path: |
           node_modules
           .yarn/install-state.gz
-        key: ${{ inputs.cache-prefix }}-yarn-v2-${{ inputs.platform }}-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
+        # v3: bump to drop existing entries polluted with those build
+        # intermediates — a cache hit is never re-saved, so without the bump
+        # the fat archives would keep being served forever.
+        key: ${{ inputs.cache-prefix }}-yarn-v3-${{ inputs.platform }}-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
         restore-keys: |
-          ${{ inputs.cache-prefix }}-yarn-v2-${{ inputs.platform }}-${{ runner.os }}-
+          ${{ inputs.cache-prefix }}-yarn-v3-${{ inputs.platform }}-${{ runner.os }}-
       continue-on-error: true
 
     - name: Install JavaScript dependencies with retry

.github/actions/smart-e2e-selection/action.yml

@@ -155,8 +155,8 @@ runs:
           echo "SKIPPED=true" >> "$GITHUB_OUTPUT"
           echo "SKIP_REASON=PR targets a release or stable branch (release/* or stable)" >> "$GITHUB_OUTPUT"
           echo "ai_confidence=100" >> "$GITHUB_OUTPUT"
-          # Release/stable target → the scheduled performance workflow covers these branches.
-          # No need to also trigger the PR performance job.
+          # Release/stable target → performance runs are label-only. Return []
+          # so AI output cannot automatically trigger the PR performance job.
           echo "ai_performance_test_tags=[]" >> "$GITHUB_OUTPUT"
         else
           echo "✅ Running AI analysis for PR #$PR_NUMBER"

.github/guidelines/E2E_DECISION_TREE.md

@@ -61,7 +61,7 @@ Runs only when all of the following are true:
 
 ## (Exceptional) force Appium iOS smoke tests on PRs
 
-Appium iOS smoke tests are skipped on PRs by default (they still run on every `main` push/schedule). To also run them on a PR, add the `run-appium-ios-tests` label. Smart E2E Selection still controls which suites run. CI re-runs automatically when the label is added or removed.
+Appium iOS smoke tests are skipped on PRs by default (they still run on every `main` push/schedule). They also run automatically on a PR when shared smoke infra or Appium specs change (`tests/page-objects/**`, `tests/selectors/**`, `tests/locators/**`, `tests/framework/**`, `tests/smoke-appium/**`). To force them on any other PR, add the `run-appium-ios-tests` label. Smart E2E Selection still controls which suites run. CI re-runs automatically when the label is added or removed.
 
 ## E2E flakiness detection in PRs