Repository navigation
Conversation
The two iOS E2E test jobs move from macos-26-large to ubuntu-latest and drive a simulator on a remote macOS host instead of a local one. App builds stay on macOS. The Maestro action installs the sim-remote CLI, takes a machine for the job (released when the job ends, also on failure or cancellation) and puts sim-remote's stand-ins for xcrun, xcodebuild, plutil and friends on PATH, so the stock Maestro CLI runs unchanged. The runner script tunnels Metro's port to the remote simulator in Debug and skips foregrounding a simulator that is not local. The job authenticates with the OIDC id token GitHub mints for it, so no secret is needed; the workflows grant `id-token: write` for that. RNTester runs on iPhone 18 Pro / iOS 27.0, the simulators the remote hosts provide.
meta-cla
Bot
added
the
CLA Signed
facebook-github-tools
Bot
added
the
Shared with Meta
| - name: Install sim-remote | ||
| uses: software-mansion-labs/argent-cloud-actions/install@v2 | ||
| - name: Acquire remote simulator | ||
| # Logs in with the job's OIDC id token; released in the post step. |
There was a problem hiding this comment.
This seems to don't work for forked PRs right? We also can't invoke this with pull_request_target as we won't be able to test the code from the user PR then.
There was a problem hiding this comment.
Like I mentioned in the discussion on the contributors discord, we should be able to checkout the PR head even from the pull_request_target trigger, by passing the ref explicitly to the checkout action, while still running the workflow itself from the PR target.
...but then the build from the fork could access protected scopes (secrets, the OIDC token we create here, or even other OIDC tokens you may have set up), the same goes for the js helper scripts from the E2E flow.
I feel like it should be fine that way, since the only step that has defined access to anything would be the test step (so build cannot exfil any secrets/the token), but you could still try to do something in the maestro tests themselves to get access to Argent Cloud.
Maybe having a maintainer's manual approval for the workflow would be a good way to go about this, so that there's a pair of eyes that can verify there's no attempt to steal the token before the workflow runs?
There was a problem hiding this comment.
Maybe having a maintainer's manual approval for the workflow would be a good way to go about this, so that there's a pair of eyes that can verify there's no attempt to steal the token before the workflow runs?
I think that the best would be to have something like a @react-native-bot e2e-tests comment that triggers a workflow, running off of target_pull_request which runs the tests. That workflow can then pull the .apk/.ipa from the artifacts of the PR and execute it isnide the remote simulator and report the results.
There was a problem hiding this comment.
Made the changes as suggested.
7469beb to
a1780f7
Compare
A pull_request run from a fork gets no id token, so the E2E test jobs no longer run on that event. Instead, a maintainer comments `@react-native-bot e2e-tests` on the pull request and e2e-ios-on-demand.yml runs the suites from the default branch: the apps come from the artifacts a run of the pull request's head already built, the Maestro flows from the pull request, the workflows and scripts from the default branch. The two reusable E2E workflows take the run to download from and the ref to take the flows from as inputs, and the download-artifact action can read another run. The login label is derived from the calling workflow as `<owner>.<workflow file>`, which is how each repository's workflows are registered on the remote simulator service.
a1780f7 to
9fd2d32
Compare
This branch has not been deployed
2 participants
Summary:
Runs the two iOS Maestro E2E test jobs on
ubuntu-latestagainst an Argent Cloud remote simulator instead of onmacos-26-large.App builds themselves stay on macOS.
The Maestro action installs the
sim-remoteCLI, acquires a remote simulator runner and releases it when the job ends, and puts stand-ins forxcrun,xcodebuildandplutilon PATH so the stock Maestro CLI runs unchanged.In Debug the runner script tunnels Metro's port to the remote simulator.
The job authenticates with the OIDC id token GitHub issues to it, so no secret needs to be added; the workflows grant
id-token: writefor that. RNTester runs on iPhone 18 Pro / iOS 27.0, the simulators the remote hosts provide.Changelog:
[INTERNAL] [CHANGED] - Run the iOS Maestro E2E tests on Linux against remote simulators
Test Plan:
Same change run from a copy of this repository: https://github.com/software-mansion-labs/react-native/actions/runs/38882658376
RNTester 48/48 flows in Debug and Release, template app 1/1 in both flavors. The RNTester jobs took about 35 minutes each, against 71 to 102 minutes for the current
macos-26-largejobs onmainon the same day.