Repository navigation
ci: publish an unsigned tunnel-enabled runner with every release - #37
Merged
Merged
Conversation
The release prebuild only ships the plain WebDriverAgentRunner scheme, which embeds the broadcast extension but not the WebDriverAgentTunnel packet-tunnel extension. The tunnel build existed only as the CI-signed IPA on R2, locked to the devices in the stored provisioning profiles, so install-time signers (mobilerun-ios ASC/Xcode backends) had no tunnel artifact to sign for new phones and the SOCKS5 proxy was unavailable on them. Build the WebDriverAgentRunnerTunnel scheme unsigned next to the plain runner and attach it as WebDriverAgentRunnerTunnel-Runner.zip. The tunnel leg checks out submodules and builds the hev-socks5-tunnel engine first, and fails if either extension is missing from the zip. build-real.sh takes an APP_NAME override because this scheme still produces WebDriverAgentRunner-Runner.app. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
sleynsol
approved these changes
Sep 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The release prebuild (
prebuild.yml) only ships the plainWebDriverAgentRunnerscheme, which contains the broadcast extension but not theWebDriverAgentTunnelpacket-tunnel extension. The tunnel build exists only as the CI-signedWebDriverAgentRunnerTunnel.ipaon R2. That IPA is signed with provisioning profiles stored as repository secrets, so it only installs on devices already listed in them.mobilerun-ios's install-time signers (ASC and Xcode backends) already provision a packet-tunnel extension when the artifact contains one. Because no unsigned tunnel artifact is published, phones signed at install time never get the extension, and
ConnectProxy(SOCKS5) cannot work on them. Seen on the demo hostdroidrun-ios-host-1, where an iOS 26 phone could not set a proxy.What
prebuild.yml: newbuild-realmatrix leg for theWebDriverAgentRunnerTunnelscheme. It builds unsigned like the others, with submodules checked out andScripts/build-hev-socks5-tunnel.shrun first, and is attached to the release asWebDriverAgentRunnerTunnel-Runner.zip. It is also covered bySHA256SUMSand reachable viareleases/latest/download/WebDriverAgentRunnerTunnel-Runner.zip.WebDriverAgentTunnel.appexorWebDriverAgentBroadcast.appexis missing from the zip.Scripts/ci/build-real.sh: optionalAPP_NAME(defaults to$SCHEME-Runner.app), because the Tunnel scheme still producesWebDriverAgentRunner-Runner.app. The existing legs are unchanged.The existing plain zips and the signed R2 workflow are untouched.
Verification
I ran the leg's commands locally (Xcode 27.0, arm64 Mac): submodule init,
build-hev-socks5-tunnel.sh, thenbuild-real.shwith this leg's matrix values. Result:WebDriverAgentRunnerTunnel-Runner.zip, 1.5 MB, containingWebDriverAgentRunner-Runner.app:com.facebook.WebDriverAgentRunner.xctrunnerPlugIns/WebDriverAgentBroadcast.appex:…xctrunner.broadcast,com.apple.broadcast-services-uploadPlugIns/WebDriverAgentTunnel.appex:…xctrunner.tunnel,com.apple.networkextension.packet-tunnelNot verified yet:
Consumer
After the next release, mobilerun-ios hosts that need the proxy set:
and reinstall the runner once per phone (
mobilerun-ios setup <udid> --reinstall).🤖 Generated with Claude Code