ci: Replace use of github-tools workflows with versioned actions (MetaMask#23799)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

This replaces all use of `MetaMask/github-tools` _workflows_, usually
referenced by a specific commit hash, with (composite) _actions_,
referenced by a version. This has several benefits:

- We can update actions used simply by creating a new release in the
`github-tools` repository, propagating the changes to all repositories
using the version.
   - Breaking changes can still be made by creating a major release.
- Actions have access to certain variables that workflows don't have
access to, letting us omit input options like `github-tools-ref`.
- In cases where we're already running other steps, using an action
avoids spinning up a new runner.

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:

## **Related issues**

Fixes:

## **Manual testing steps**

```gherkin
Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [ ] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Replaces calls to MetaMask/github-tools reusable workflows with
versioned composite actions (@v1) across CI/E2E/release/ops workflows,
updating refs, steps, and required inputs.
> 
> - **Workflows migrated from reusable workflows to versioned actions
(`@v1`)**:
> - `add-team-label`, `automated-rca` (adds `github-token`),
`changelog-check`, `log-merge-group-failure`,
`publish-slack-release-testing-status`,
`remove-rca-needed-label-sheets`, `stale-issue-pr`,
`stable-branch-sync`, `update-release-changelog`.
> - Release PR workflows: `create-release-pr.yml` (switch to action
`create-release-pr@v1`), `create-release-pr-legacy.yml` (adds explicit
step with inputs/secrets via action).
> - E2E build/test: `build-android-e2e.yml`, `build-ios-e2e.yml`,
`run-e2e-workflow.yml`, `run-e2e-smoke-tests-android-flask.yml` (use
`setup-e2e-env@v1`/`configure-keystore@v1`).
> - **Ref updates/structural changes**:
> - Replace pinned SHAs with `@v1`; add `runs-on` and explicit `steps`
where needed; move secrets to action inputs (`with`) as required.
> - Merge utilities: update `merge-stable-sync-pr.yml` and
`merge-version-bump-pr.yml` refs to `merge-approved-pr@v1`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
fae9f6e. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: Mrtenz

.github/workflows/add-team-label.yml

@@ -7,7 +7,11 @@ on:
 
 jobs:
   add-team-label:
+    name: Add team label
     if: ${{ !github.event.pull_request.head.repo.fork }}
-    uses: metamask/github-tools/.github/workflows/add-team-label.yml@7fe185fdb0e60981c898e88d82e44ff33f604daa
-    secrets:
-      TEAM_LABEL_TOKEN: ${{ secrets.TEAM_LABEL_TOKEN }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add team label
+        uses: MetaMask/github-tools/.github/actions/add-team-label@v1
+        with:
+          team-label-token: ${{ secrets.TEAM_LABEL_TOKEN }}

.github/workflows/automated-rca.yml

@@ -10,9 +10,14 @@ permissions:
 
 jobs:
   automated-rca:
-    uses: MetaMask/github-tools/.github/workflows/post-gh-rca.yml@5da154078ddf6c022ed89dc3dbf378594afb8266
-    with:
-      repo-owner: ${{ github.repository_owner }}
-      repo-name: ${{ github.event.repository.name }}
-      issue-number: ${{ github.event.issue.number }}
-      issue-labels: '["Sev0-urgent", "Sev1-high"]'
+    name: Automated RCA
+    runs-on: ubuntu-latest
+    steps:
+      - name: Automated RCA
+        uses: MetaMask/github-tools/.github/actions/post-gh-rca@v1
+        with:
+          repo-owner: ${{ github.repository_owner }}
+          repo-name: ${{ github.event.repository.name }}
+          issue-number: ${{ github.event.issue.number }}
+          issue-labels: '["Sev0-urgent", "Sev1-high"]'
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build-android-e2e.yml

@@ -56,7 +56,7 @@ jobs:
           echo "✅ System images installed"
 
       - name: Setup Android Build Environment
-        uses: MetaMask/github-tools/.github/actions/setup-e2e-env@6742ebe1a3541cb13972d65352a0622a6a6677db
+        uses: MetaMask/github-tools/.github/actions/setup-e2e-env@v1
         with:
           platform: android
           setup-simulator: false

.github/workflows/build-ios-e2e.yml

@@ -67,7 +67,7 @@ jobs:
 
       # Install Node.js, Xcode tools, and other iOS development dependencies
       - name: Installing iOS Environment Setup
-        uses: MetaMask/github-tools/.github/actions/setup-e2e-env@6742ebe1a3541cb13972d65352a0622a6a6677db
+        uses: MetaMask/github-tools/.github/actions/setup-e2e-env@v1
         with:
           platform: ios
           setup-simulator: false

.github/workflows/changelog-check.yml

@@ -1,22 +1,23 @@
-name: ChangeLog Check
+name: Check Changelog
 
 on:
   pull_request:
     types: [opened, synchronize, labeled, unlabeled]
 
 jobs:
   check-changelog:
+    name: Check Changelog
+    runs-on: ubuntu-latest
     # Asking engineers to update CHANGELOG.md increases the potential for
     # conflicts across all pull requests.
     # Disable this workflow until we can refine the new changelog process.
     if: false
-
-    uses: MetaMask/github-tools/.github/workflows/changelog-check.yml@91e349d177db2c569e03c7aa69d2acb404b62f75
-    with:
-      base-branch: ${{ github.event.pull_request.base.ref }}
-      head-ref: ${{ github.head_ref }}
-      labels: ${{ toJSON(github.event.pull_request.labels) }}
-      pr-number: ${{ github.event.pull_request.number }}
-      repo: ${{ github.repository }}
-    secrets:
-      gh-token: ${{ secrets.PR_TOKEN }}
+    steps:
+      - name: Check changelog
+        uses: MetaMask/github-tools/.github/actions/check-changelog@v1
+        with:
+          base-branch: ${{ github.event.pull_request.base.ref }}
+          head-ref: ${{ github.head_ref }}
+          labels: ${{ toJSON(github.event.pull_request.labels) }}
+          pr-number: ${{ github.event.pull_request.number }}
+          repo: ${{ github.repository }}

.github/workflows/ci.yml

@@ -576,13 +576,16 @@ jobs:
 
   log-merge-group-failure:
     name: Log merge group failure
+    runs-on: ubuntu-latest
     # Only run this job if the merge group event fails, skip on forks
     if: ${{ github.event_name == 'merge_group' && failure() && !github.event.repository.fork }}
     needs:
       - check-all-jobs-pass
-    uses: metamask/github-tools/.github/workflows/log-merge-group-failure.yml@6bbad335a01fce1a9ec1eabd9515542c225d46c0
-    secrets:
-      GOOGLE_APPLICATION_CREDENTIALS: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
-      GOOGLE_SERVICE_ACCOUNT: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
-      SPREADSHEET_ID: ${{ secrets.GOOGLE_MERGE_QUEUE_SPREADSHEET_ID }}
-      SHEET_NAME: ${{ secrets.GOOGLE_MERGE_QUEUE_SHEET_NAME }}
+    steps:
+      - name: Log merge group failure to Google Sheets
+        uses: MetaMask/github-tools/.github/actions/log-merge-group-failure@v1
+        with:
+          google-application-credentials: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
+          google-service-account: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
+          spreadsheet-id: ${{ secrets.GOOGLE_MERGE_QUEUE_SPREADSHEET_ID }}
+          sheet-name: ${{ secrets.GOOGLE_MERGE_QUEUE_SHEET_NAME }}

.github/workflows/create-release-pr-legacy.yml

@@ -19,21 +19,24 @@ jobs:
       id-token: write
 
   create-release-pr:
+    name: Create release pull request
+    runs-on: ubuntu-latest
     needs: generate-build-version
-    uses: MetaMask/github-tools/.github/workflows/create-release-pr.yml@fc6fe1a3fb591f6afa61f0dbbe7698bd50fab9c7
-    with:
-      platform: mobile
-      base-branch: ${{ inputs.base-branch }}
-      semver-version: ${{ inputs.semver-version }}
-      previous-version-tag: ${{ inputs.previous-version-tag }}
-      mobile-build-version: ${{ needs.generate-build-version.outputs.build-version }}
-      github-tools-version: fc6fe1a3fb591f6afa61f0dbbe7698bd50fab9c7
-
-    secrets:
-      # This token needs read permissions to metamask-planning & write permissions to metamask-mobile
-      github-token: ${{ secrets.PR_TOKEN }}
-      google-application-creds-base64: ${{ secrets.GCP_RLS_SHEET_ACCOUNT_BASE64 }}
     permissions:
       contents: write
       pull-requests: write
+    steps:
+      - name: Create Release pull request
+        uses: MetaMask/github-tools/.github/actions/create-release-pr@v1
+        with:
+          platform: mobile
+          checkout-base-branch: ${{ inputs.base-branch }}
+          release-pr-base-branch: ${{ inputs.base-branch }}
+          semver-version: ${{ inputs.semver-version }}
+          previous-version-ref: ${{ inputs.previous-version-tag }}
+          mobile-build-version: ${{ needs.generate-build-version.outputs.build-version }}
+          google-application-creds-base64: ${{ secrets.GCP_RLS_SHEET_ACCOUNT_BASE64 }}
+          # This token needs read permissions to metamask-planning & write
+          # permissions to metamask-mobile.
+          github-token: ${{ secrets.PR_TOKEN }}
 

.github/workflows/create-release-pr.yml

@@ -85,7 +85,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Create Release PR
-        uses: MetaMask/github-tools/.github/actions/create-release-pr@v1.1.2
+        uses: MetaMask/github-tools/.github/actions/create-release-pr@v1
         with:
           platform: mobile
           checkout-base-branch: ${{ needs.resolve-bases.outputs.checkout_base }}

.github/workflows/merge-stable-sync-pr.yml

@@ -15,11 +15,11 @@ jobs:
         github.event.comment.author_association == 'MEMBER' ||
         github.event.comment.author_association == 'OWNER'
       )
-    uses: MetaMask/github-tools/.github/workflows/merge-approved-pr.yml@7c0ab4db1e9c1d5673fe7958e8959f1842edbebd
+    uses: MetaMask/github-tools/.github/workflows/merge-approved-pr.yml@v1
     with:
       pr-number: ${{ github.event.issue.number }}
       # Merge PRs from stable-main-X.Y.Z into main
       required-base-branch: 'main'
       head-branch-pattern: '^stable-main-[0-9]+\.[0-9]+\.[0-9]+$'
     secrets:
-      github-token: ${{ secrets.METAMASK_MOBILE_BRANCH_SYNC_TOKEN }}
+      github-token: ${{ secrets.METAMASK_MOBILE_BRANCH_SYNC_TOKEN }}

.github/workflows/merge-version-bump-pr.yml

@@ -15,11 +15,11 @@ jobs:
         github.event.comment.author_association == 'MEMBER' ||
         github.event.comment.author_association == 'OWNER'
       )
-    uses: MetaMask/github-tools/.github/workflows/merge-approved-pr.yml@7c0ab4db1e9c1d5673fe7958e8959f1842edbebd
+    uses: MetaMask/github-tools/.github/workflows/merge-approved-pr.yml@v1
     with:
       pr-number: ${{ github.event.issue.number }}
       # Merge PRs from version-bump/X.Y.Z into main
       required-base-branch: 'main'
       head-branch-pattern: '^version-bump/[0-9]+\.[0-9]+\.[0-9]+$'
     secrets:
-      github-token: ${{ secrets.METAMASK_MOBILE_BRANCH_SYNC_TOKEN }}
+      github-token: ${{ secrets.METAMASK_MOBILE_BRANCH_SYNC_TOKEN }}