From 08e5af3ac05ff56aa487e6cb9a5987630e722f65 Mon Sep 17 00:00:00 2001
From: timo <44401485+Timo972@users.noreply.github.com>
Date: Tue, 29 Sep 2026 14:55:29 +0200
Subject: [PATCH] ci: publish an unsigned tunnel-enabled runner with every
 release

The release prebuild only ships the plain WebDriverAgentRunner scheme, which
embeds the broadcast extension but not the WebDriverAgentTunnel packet-tunnel
extension. The tunnel build existed only as the CI-signed IPA on R2, locked
to the devices in the stored provisioning profiles, so install-time signers
(mobilerun-ios ASC/Xcode backends) had no tunnel artifact to sign for new
phones and the SOCKS5 proxy was unavailable on them.

Build the WebDriverAgentRunnerTunnel scheme unsigned next to the plain runner
and attach it as WebDriverAgentRunnerTunnel-Runner.zip. The tunnel leg checks
out submodules and builds the hev-socks5-tunnel engine first, and fails if
either extension is missing from the zip. build-real.sh takes an APP_NAME
override because this scheme still produces WebDriverAgentRunner-Runner.app.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/prebuild.yml | 29 +++++++++++++++++++++++++++++
 Scripts/ci/build-real.sh       | 12 ++++++++----
 2 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/prebuild.yml b/.github/workflows/prebuild.yml
index da5c0b2ce1..0a11336bba 100644
--- a/.github/workflows/prebuild.yml
+++ b/.github/workflows/prebuild.yml
@@ -8,6 +8,11 @@ name: Prebuild & Publish WDA
 #
 # Builds are unsigned (CODE_SIGNING_ALLOWED=NO in Scripts/ci/build-*.sh); the
 # runner is signed at install time.
+#
+# WebDriverAgentRunnerTunnel-Runner.zip is the same runner with the
+# WebDriverAgentTunnel packet-tunnel extension embedded next to the broadcast
+# extension. Install-time signers must provision it with the
+# packet-tunnel-provider entitlement (Network Extensions on the Apple team).
 
 on:
   release:
@@ -35,6 +40,13 @@ jobs:
             derived_data: appium_wda_ios
             wd: appium_wda_ios/Build/Products/Debug-iphoneos
             zip: WebDriverAgentRunner-Runner.zip
+          - scheme: WebDriverAgentRunnerTunnel
+            destination: generic/platform=iOS
+            derived_data: appium_wda_ios_tunnel
+            wd: appium_wda_ios_tunnel/Build/Products/Debug-iphoneos
+            app: WebDriverAgentRunner-Runner.app
+            zip: WebDriverAgentRunnerTunnel-Runner.zip
+            tunnel: true
           - scheme: WebDriverAgentRunner_tvOS
             destination: generic/platform=tvOS
             derived_data: appium_wda_tvos
@@ -43,9 +55,15 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          # The tunnel extension links hev-socks5-tunnel from a submodule.
+          submodules: ${{ matrix.tunnel && 'recursive' || 'false' }}
       - uses: maxim-lobanov/setup-xcode@v1
         with:
           xcode-version: "${{ env.XCODE_VERSION }}"
+      - name: Build tunnel engine
+        if: ${{ matrix.tunnel }}
+        run: Scripts/build-hev-socks5-tunnel.sh
       - name: Build & zip ${{ matrix.scheme }}-Runner.app
         # Retried because simulator/device enumeration on fresh runners is
         # flaky (same reason the upstream Release workflow retries).
@@ -59,7 +77,18 @@ jobs:
             export DESTINATION="${{ matrix.destination }}"
             export WD="${{ matrix.wd }}"
             export ZIP_PKG_NAME="${{ matrix.zip }}"
+            export APP_NAME="${{ matrix.app }}"
             sh "$GITHUB_WORKSPACE/Scripts/ci/build-real.sh"
+      - name: Verify tunnel extension is embedded
+        if: ${{ matrix.tunnel }}
+        run: |
+          set -euo pipefail
+          # Capture first: `unzip | grep -q` would SIGPIPE unzip under pipefail.
+          listing=$(unzip -l "${{ matrix.zip }}")
+          for appex in WebDriverAgentTunnel WebDriverAgentBroadcast; do
+            grep -Fq "${{ matrix.app }}/PlugIns/$appex.appex/Info.plist" <<< "$listing" || {
+              echo "::error::$appex.appex missing from ${{ matrix.zip }}"; exit 1; }
+          done
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
diff --git a/Scripts/ci/build-real.sh b/Scripts/ci/build-real.sh
index bb41b0b6f3..201a0eac4f 100755
--- a/Scripts/ci/build-real.sh
+++ b/Scripts/ci/build-real.sh
@@ -7,6 +7,10 @@ xcodebuild clean build-for-testing \
   -destination "$DESTINATION" \
   CODE_SIGNING_ALLOWED=NO ARCHS=arm64
 
+# The Tunnel scheme builds the same WebDriverAgentRunner-Runner.app as the
+# plain scheme, so the app name can differ from the scheme name.
+APP_NAME="${APP_NAME:-$SCHEME-Runner.app}"
+
 pushd $WD
 
 # The reason why here excludes several frameworks are:
@@ -16,9 +20,9 @@ pushd $WD
 #   This can be excluded only for real devices.
 # - Xcode 16 started generating 5.9MB of 'Testing.framework', but it might not be necessary for WDA.
 # - libXCTestSwiftSupport is used for Swift testing. WDA doesn't include Swift stuff, thus this is not needed.
-zip -r $ZIP_PKG_NAME $SCHEME-Runner.app \
-    -x "$SCHEME-Runner.app/Frameworks/XC*.framework*" \
-       "$SCHEME-Runner.app/Frameworks/Testing.framework*" \
-       "$SCHEME-Runner.app/Frameworks/libXCTestSwiftSupport.dylib"
+zip -r $ZIP_PKG_NAME $APP_NAME \
+    -x "$APP_NAME/Frameworks/XC*.framework*" \
+       "$APP_NAME/Frameworks/Testing.framework*" \
+       "$APP_NAME/Frameworks/libXCTestSwiftSupport.dylib"
 popd
 mv $WD/$ZIP_PKG_NAME ./