Run the iOS E2E suites on request from a maintainer's comment

A pull_request run from a fork gets no id token, so the E2E test jobs no longer run on that event. Instead, a maintainer comments `@react-native-bot e2e-tests` on the pull request and e2e-ios-on-demand.yml runs the suites from the default branch: the apps come from the artifacts a run of the pull request's head already built, the Maestro flows from the pull request, the workflows and scripts from the default branch. The two reusable E2E workflows take the run to download from and the ref to take the flows from as inputs, and the download-artifact action can read another run.

The login label is derived from the calling workflow as `<owner>.<workflow file>`, which is how each repository's workflows are registered on the remote simulator service.

Author: jwajgelt

.github/actions/download-artifact/action.yml

@@ -8,6 +8,14 @@ inputs:
   path:
     description: Destination path
     required: true
+  run-id:
+    description: Workflow run to download from; defaults to the current run
+    required: false
+    default: ''
+  github-token:
+    description: Token with actions:read, needed when run-id is another run
+    required: false
+    default: ''
 
 outputs:
   download-path:
@@ -25,6 +33,8 @@ runs:
       with:
         name: ${{ inputs.name }}
         path: ${{ inputs.path }}
+        run-id: ${{ inputs.run-id || github.run_id }}
+        github-token: ${{ inputs.github-token }}
 
     - name: Wait before attempt 2
       if: ${{ always() && steps.download-1.outcome == 'failure' }}
@@ -41,6 +51,8 @@ runs:
       with:
         name: ${{ inputs.name }}
         path: ${{ inputs.path }}
+        run-id: ${{ inputs.run-id || github.run_id }}
+        github-token: ${{ inputs.github-token }}
 
     - name: Wait before attempt 3
       if: ${{ always() && steps.download-2.outcome == 'failure' }}
@@ -57,3 +69,5 @@ runs:
       with:
         name: ${{ inputs.name }}
         path: ${{ inputs.path }}
+        run-id: ${{ inputs.run-id || github.run_id }}
+        github-token: ${{ inputs.github-token }}

.github/actions/maestro-ios/action.yml

@@ -35,11 +35,16 @@ runs:
       run: export MAESTRO_VERSION=2.6.1; curl -Ls "https://get.maestro.mobile.dev" | bash
     - name: Install sim-remote
       uses: software-mansion-labs/argent-cloud-actions/install@v2
+    - name: Resolve login label
+      # <owner>.<calling workflow file>, the name this job's workflow is registered under.
+      id: login
+      shell: bash
+      run: echo "label=${GITHUB_REPOSITORY_OWNER}.$(basename "${GITHUB_WORKFLOW_REF%%@*}" .yml)" >> "$GITHUB_OUTPUT"
     - name: Acquire remote simulator
       # Logs in with the job's OIDC id token; released in the post step.
       uses: software-mansion-labs/argent-cloud-actions/acquire@v2
       with:
-        label: react-native-e2e
+        label: ${{ steps.login.outputs.label }}
     - name: Set up JDK 17
       uses: actions/setup-java@v5
       with:

.github/workflows/e2e-ios-on-demand.yml

@@ -0,0 +1,117 @@
+name: E2E iOS on demand
+
+# Runs the iOS Maestro E2E suites against a pull request when a maintainer
+# comments `@react-native-bot e2e-tests` on it. The apps come from the
+# artifacts a run of the pull request's head already built, the Maestro flows
+# from the pull request, and the workflows and scripts from the default branch.
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: e2e-ios-on-demand-${{ github.event.issue.number }}
+  cancel-in-progress: true
+
+jobs:
+  request:
+    if: >-
+      github.event.issue.pull_request != null &&
+      startsWith(github.event.comment.body, '@react-native-bot e2e-tests') &&
+      contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
+    outputs:
+      head-sha: ${{ steps.find.outputs.head-sha }}
+      run-id: ${{ steps.find.outputs.run-id }}
+    steps:
+      - name: Find the pull request's build
+        id: find
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          PR: ${{ github.event.issue.number }}
+        run: |
+          set -euo pipefail
+          sha=$(gh api "repos/$GH_REPO/pulls/$PR" --jq .head.sha)
+          needed="RNTesterApp-NewArch-Debug RNTesterApp-NewArch-Release RNTestProject-Debug RNTestProject-Release react-native-package"
+          run_id=
+          for id in $(gh api "repos/$GH_REPO/actions/runs?head_sha=$sha&per_page=30" --jq '.workflow_runs[].id'); do
+            have=$(gh api "repos/$GH_REPO/actions/runs/$id/artifacts?per_page=100" --jq '.artifacts[].name')
+            missing=
+            for name in $needed; do
+              grep -qx "$name" <<<"$have" || missing="$missing $name"
+            done
+            if [ -z "$missing" ]; then
+              run_id=$id
+              break
+            fi
+          done
+          if [ -z "$run_id" ]; then
+            echo "::error::no run of $sha has built all of: $needed"
+            exit 1
+          fi
+          echo "head-sha=$sha" >> "$GITHUB_OUTPUT"
+          echo "run-id=$run_id" >> "$GITHUB_OUTPUT"
+      - name: Acknowledge the request
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          COMMENT: ${{ github.event.comment.id }}
+        run: gh api -X POST "repos/$GH_REPO/issues/comments/$COMMENT/reactions" -f content=rocket > /dev/null
+
+  rntester:
+    needs: request
+    uses: ./.github/workflows/e2e-ios-rntester.yml
+    permissions:
+      contents: read
+      actions: read
+      id-token: write
+    with:
+      artifact-run-id: ${{ needs.request.outputs.run-id }}
+      flows-ref: ${{ needs.request.outputs.head-sha }}
+      fail-on-error: true
+
+  templateapp:
+    needs: request
+    uses: ./.github/workflows/e2e-ios-templateapp.yml
+    permissions:
+      contents: read
+      actions: read
+      id-token: write
+    with:
+      artifact-run-id: ${{ needs.request.outputs.run-id }}
+      flows-ref: ${{ needs.request.outputs.head-sha }}
+      fail-on-error: true
+
+  report:
+    needs: [request, rntester, templateapp]
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Comment the results
+        env:
+          GH_TOKEN: ${{ secrets.REACT_NATIVE_BOT_GITHUB_TOKEN || github.token }}
+          GH_REPO: ${{ github.repository }}
+          PR: ${{ github.event.issue.number }}
+          REQUEST: ${{ needs.request.result }}
+          HEAD_SHA: ${{ needs.request.outputs.head-sha }}
+          RNTESTER: ${{ needs.rntester.outputs.status }}
+          TEMPLATEAPP: ${{ needs.templateapp.outputs.status }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          if [ "$REQUEST" != "success" ]; then
+            body="iOS E2E: no run of the pull request's head has built the apps yet, see [the request]($RUN_URL)."
+          else
+            body="iOS E2E on ${HEAD_SHA:0:7} ([run]($RUN_URL)): RNTester **${RNTESTER:-skipped}**, template app **${TEMPLATEAPP:-skipped}**."
+          fi
+          gh api -X POST "repos/$GH_REPO/issues/$PR/comments" -f body="$body" > /dev/null

.github/workflows/e2e-ios-rntester.yml

@@ -2,6 +2,7 @@ name: E2E iOS RNTester
 
 permissions:
   contents: read
+  actions: read
   id-token: write
 
 on:
@@ -10,13 +11,24 @@ on:
       fail-on-error:
         type: boolean
         default: false
+      artifact-run-id:
+        description: Run to take the app artifacts from; defaults to this run
+        type: string
+        default: ''
+      flows-ref:
+        description: Ref to take the Maestro flows from; defaults to the checked-out tree
+        type: string
+        default: ''
     outputs:
       status:
         description: 'The result of the E2E tests (success or failure)'
         value: ${{ jobs.report.outputs.status }}
 
 jobs:
   test:
+    # A pull_request run has no id token to log into the remote simulators
+    # with; the suite runs on request from e2e-ios-on-demand.yml instead.
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     outputs:
       status: ${{ steps.report-status.outputs.status }}
@@ -30,10 +42,24 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
       - name: Download App
-        uses: actions/download-artifact@v7
+        uses: ./.github/actions/download-artifact
         with:
           name: RNTesterApp-NewArch-${{ matrix.flavor }}
           path: /tmp/RNTesterBuild/RNTester.app
+          run-id: ${{ inputs.artifact-run-id }}
+          github-token: ${{ github.token }}
+      - name: Checkout the Maestro flows under test
+        if: ${{ inputs.flows-ref != '' }}
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.flows-ref }}
+          path: .flows-under-test
+          sparse-checkout: packages/rn-tester/.maestro
+      - name: Use the Maestro flows under test
+        if: ${{ inputs.flows-ref != '' }}
+        run: |
+          rm -rf packages/rn-tester/.maestro
+          mv .flows-under-test/packages/rn-tester/.maestro packages/rn-tester/.maestro
       - name: Check downloaded folder content
         run: ls -lR /tmp/RNTesterBuild
       - name: Run E2E Tests

.github/workflows/e2e-ios-templateapp.yml

@@ -2,6 +2,7 @@ name: E2E iOS Template App
 
 permissions:
   contents: read
+  actions: read
   id-token: write
 
 on:
@@ -10,6 +11,14 @@ on:
       fail-on-error:
         type: boolean
         default: false
+      artifact-run-id:
+        description: Run to take the app and package artifacts from; defaults to this run, which then builds them
+        type: string
+        default: ''
+      flows-ref:
+        description: Ref to take the Maestro flows from; defaults to the checked-out tree
+        type: string
+        default: ''
     outputs:
       status:
         description: 'The result of the E2E tests (success or failure)'
@@ -18,6 +27,7 @@ on:
 jobs:
   # Building needs Xcode; the tests drive a remote simulator from Linux.
   build:
+    if: inputs.artifact-run-id == ''
     runs-on: macos-26-large
     strategy:
       fail-fast: false
@@ -101,6 +111,11 @@ jobs:
 
   test:
     needs: build
+    # A pull_request run has no id token to log into the remote simulators
+    # with; the suite runs on request from e2e-ios-on-demand.yml instead.
+    if: >-
+      always() && github.event_name != 'pull_request' &&
+      (needs.build.result == 'success' || needs.build.result == 'skipped')
     runs-on: ubuntu-latest
     outputs:
       status: ${{ steps.report-status.outputs.status }}
@@ -120,6 +135,8 @@ jobs:
         with:
           name: RNTestProject-${{ matrix.flavor }}
           path: /tmp/RNTestProjectBuild/RNTestProject.app
+          run-id: ${{ inputs.artifact-run-id }}
+          github-token: ${{ github.token }}
       - name: Check downloaded folder content
         run: ls -l /tmp/RNTestProjectBuild/RNTestProject.app
       - name: Download React Native Package
@@ -128,6 +145,20 @@ jobs:
         with:
           name: react-native-package
           path: /tmp/react-native-tmp
+          run-id: ${{ inputs.artifact-run-id }}
+          github-token: ${{ github.token }}
+      - name: Checkout the Maestro flows under test
+        if: ${{ inputs.flows-ref != '' }}
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.flows-ref }}
+          path: .flows-under-test
+          sparse-checkout: scripts/e2e/.maestro
+      - name: Use the Maestro flows under test
+        if: ${{ inputs.flows-ref != '' }}
+        run: |
+          rm -rf scripts/e2e/.maestro
+          mv .flows-under-test/scripts/e2e/.maestro scripts/e2e/.maestro
       - name: Configure git
         if: ${{ matrix.flavor == 'Debug' }}
         shell: bash

.github/workflows/test-all.yml

@@ -10,6 +10,7 @@ on:
 
 permissions:
   contents: read
+  actions: read
   id-token: write
 
 jobs: