mobile-e2e.yml

# Manual mobile e2e for @clerk/expo native components.
# Clones clerk-expo-quickstart, builds the NativeComponentQuickstart app,
# and runs Maestro flows on iOS simulator and Android emulator.
#
# Secrets:
#   INTEGRATION_STAGING_INSTANCE_KEYS — JSON map of named staging test instances
#     ({ "<name>": { "pk": "pk_test_...", "sk": "sk_test_..." } }).
#     Same secret used by /integration (Playwright) staging jobs. We read the
#     entry named EXPO_INSTANCE_NAME (set in env: below).
#
# Test users are provisioned per-run via Clerk Backend API and deleted at
# teardown — same pattern as /integration's createBapiUser.
name: "Mobile e2e (@clerk/expo)"

on:
  workflow_dispatch:
    inputs:
      quickstart_ref:
        description: "clerk-expo-quickstart git ref (branch, tag, or SHA)"
        required: false
        default: "main"
      exclude_tags:
        description: "Maestro tags to exclude (comma-separated)"
        required: false
        default: "manual,skip"
      flows_filter:
        description: "Optional: substring filter for flow paths (e.g. 'sign-in/email-password'). Empty = all flows."
        required: false
        default: ""

env:
  EXPO_INSTANCE_NAME: clerkstage-with-native-components
  # Override the quickstart's checked-in .npmrc, which points pnpm/npm/npx at a
  # local verdaccio registry (http://localhost:4873) that doesn't exist on CI.
  NPM_CONFIG_REGISTRY: https://registry.npmjs.org/

concurrency:
  group: mobile-e2e-${{ github.ref }}
  cancel-in-progress: true

jobs:
  android:
    name: Android
    runs-on: 'blacksmith-8vcpu-ubuntu-2204'
    timeout-minutes: 45
    defaults:
      run:
        working-directory: .
    steps:
      - name: Checkout @clerk/javascript
        uses: actions/checkout@v4

      - name: Checkout clerk-expo-quickstart
        uses: actions/checkout@v4
        with:
          repository: clerk/clerk-expo-quickstart
          ref: ${{ inputs.quickstart_ref }}
          path: clerk-expo-quickstart

      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm

      - name: Install monorepo deps
        run: pnpm install --frozen-lockfile

      - name: Build @clerk/expo
        run: pnpm turbo build --filter=@clerk/expo...

      - name: Pack @clerk/expo
        # `pnpm pack` resolves workspace:^ deps to real versions in the
        # packed tarball, which is what we need so the quickstart (outside
        # the workspace) can install it.
        run: pnpm --filter @clerk/expo pack --pack-destination /tmp/clerk-expo-pkg

      - name: Point quickstart at packed @clerk/expo and configure for CI
        working-directory: clerk-expo-quickstart/NativeComponentQuickstart
        run: |
          # The quickstart's main pins @clerk/expo to a local verdaccio
          # snapshot version which doesn't exist on public npm. Swap it for
          # the tarball we just packed.
          tarball=$(ls /tmp/clerk-expo-pkg/clerk-expo-*.tgz | head -1)
          jq --arg t "file:$tarball" '.dependencies["@clerk/expo"] = $t' package.json > package.json.tmp
          mv package.json.tmp package.json
          # Disable Apple Sign-In in the @clerk/expo plugin. Its default behavior
          # injects the com.apple.developer.applesignin entitlement during prebuild,
          # which makes Expo CLI's simulatorBuildRequiresCodeSigning() return true
          # and demand a development signing identity even for simulator builds —
          # CI doesn't have one. Maestro flows can't exercise Apple Sign-In without
          # an Apple Developer team configured anyway.
          # The plugin may be listed as a bare string "@clerk/expo" OR in array
          # form ["@clerk/expo", { ...config }] (the quickstart uses the latter
          # with a theme config). Handle both: rewrite the bare form, or merge
          # appleSignIn: false into the existing config object.
          jq '.expo.plugins |= map(
            if . == "@clerk/expo" then ["@clerk/expo", {"appleSignIn": false}]
            elif type == "array" and .[0] == "@clerk/expo" then [.[0], ((.[1] // {}) + {"appleSignIn": false})]
            else . end
          )' app.json > app.json.tmp
          mv app.json.tmp app.json
          # The quickstart's app.json ships with placeholder bundle ids
          # ("com.yourcompany.yourapp") but the Maestro flows in
          # integration-mobile/flows reference "com.clerk.clerkexpoquickstart".
          # Align them so launchApp/clearAppState target the installed app.
          jq '.expo.ios.bundleIdentifier = "com.clerk.clerkexpoquickstart" | .expo.android.package = "com.clerk.clerkexpoquickstart"' app.json > app.json.tmp
          mv app.json.tmp app.json
          # Strip expo-dev-client. With it installed, even release-variant
          # builds boot into the dev launcher and try to reach Metro at a
          # LAN IP unreachable from CI's emulator/simulator, leaving every
          # Maestro flow stuck on a blank screen.
          jq 'del(.dependencies["expo-dev-client"], .devDependencies["expo-dev-client"])' package.json > package.json.tmp
          mv package.json.tmp package.json

      - name: Cache quickstart node_modules
        uses: actions/cache@v4
        with:
          path: clerk-expo-quickstart/NativeComponentQuickstart/node_modules
          key: quickstart-nm-${{ runner.os }}-${{ hashFiles('clerk-expo-quickstart/NativeComponentQuickstart/package.json', 'packages/expo/package.json') }}
          restore-keys: |
            quickstart-nm-${{ runner.os }}-

      - name: Install quickstart deps
        working-directory: clerk-expo-quickstart/NativeComponentQuickstart
        # --ignore-workspace because the quickstart dir is nested inside the
        # javascript checkout; without this, pnpm walks up and treats the
        # outer monorepo as the workspace and skips the quickstart entirely.
        run: pnpm install --ignore-workspace --no-frozen-lockfile

      - name: Stub missing image assets
        working-directory: clerk-expo-quickstart/NativeComponentQuickstart
        # The quickstart's app.json references splash-icon.png and android
        # adaptive-icon variants that aren't actually committed. Fill them in
        # from icon.png so prebuild's image-asset mods don't fail with ENOENT.
        run: |
          cd assets/images
          for f in splash-icon.png android-icon-foreground.png android-icon-background.png android-icon-monochrome.png; do
            [ -f "$f" ] || cp icon.png "$f"
          done

      - name: Resolve Clerk instance keys
        id: keys
        env:
          INTEGRATION_STAGING_INSTANCE_KEYS: ${{ secrets.INTEGRATION_STAGING_INSTANCE_KEYS }}
        run: node scripts/resolve-instance-keys.mjs INTEGRATION_STAGING_INSTANCE_KEYS "$EXPO_INSTANCE_NAME"

      - name: Write quickstart .env
        working-directory: clerk-expo-quickstart/NativeComponentQuickstart
        run: |
          echo "EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY=${{ steps.keys.outputs.pk }}" > .env

      - name: Provision test user via BAPI
        id: user
        env:
          CLERK_SECRET_KEY: ${{ steps.keys.outputs.sk }}
        run: |
          email="ci-${GITHUB_RUN_ID}-${RANDOM}+clerk_test@clerkcookie.com"
          username="ci_${GITHUB_RUN_ID}_${RANDOM}"
          password="ClerkCI!$(openssl rand -hex 8)Aa1"
          http_code=$(curl -sS -o /tmp/bapi_response.json -w "%{http_code}" -X POST https://api.clerkstage.dev/v1/users \
            -H "Authorization: Bearer $CLERK_SECRET_KEY" \
            -H "Content-Type: application/json" \
            -d "{\"email_address\":[\"$email\"],\"username\":\"$username\",\"password\":\"$password\"}")
          if [ "$http_code" -lt 200 ] || [ "$http_code" -ge 300 ]; then
            echo "::error::BAPI user creation failed (HTTP $http_code)"
            jq . /tmp/bapi_response.json 2>/dev/null || cat /tmp/bapi_response.json
            exit 1
          fi
          response=$(cat /tmp/bapi_response.json)
          user_id=$(echo "$response" | jq -er '.id')
          echo "::add-mask::$password"
          echo "email=$email" >> "$GITHUB_OUTPUT"
          echo "password=$password" >> "$GITHUB_OUTPUT"
          echo "user_id=$user_id" >> "$GITHUB_OUTPUT"

      - name: Diagnose Clerk instance + user visibility
        # When sign-in flows fail with "Element not found: Enter your password",
        # the AuthView pivoted to sign-up because the frontend didn't recognize
        # the BAPI-provisioned user. Most likely cause: the pk in
        # INTEGRATION_STAGING_INSTANCE_KEYS[$EXPO_INSTANCE_NAME] points at a
        # different Clerk instance than the sk does. This step logs both
        # sides so we can confirm or rule that out from a single run.
        env:
          CLERK_SECRET_KEY: ${{ steps.keys.outputs.sk }}
          PK: ${{ steps.keys.outputs.pk }}
          USER_ID: ${{ steps.user.outputs.user_id }}
          EMAIL: ${{ steps.user.outputs.email }}
        run: |
          set +e
          echo "== publishable key frontend host =="
          fapi_host=$(echo "$PK" | sed -E 's/^pk_(test|live)_//' | base64 -d 2>/dev/null | tr -d '$' || true)
          echo "fapi_host=$fapi_host"
          echo
          echo "== sk -> /v1/users/USER_ID (does BAPI see the user just created?) =="
          curl -sS -H "Authorization: Bearer $CLERK_SECRET_KEY" "https://api.clerkstage.dev/v1/users/$USER_ID" \
            | jq '{id, email_addresses: [.email_addresses[].email_address], password_enabled, banned, locked, primary_email_address_id, object}'
          echo
          echo "== sk -> /v1/users?email_address=EMAIL (alternative lookup) =="
          curl -sS -H "Authorization: Bearer $CLERK_SECRET_KEY" \
            --data-urlencode "email_address[]=$EMAIL" -G \
            "https://api.clerkstage.dev/v1/users" \
            | jq '[.[] | {id, email_addresses: [.email_addresses[].email_address]}]'
          echo
          echo "== pk -> FAPI /v1/client/sign_ins (does the frontend recognize the user?) =="
          curl -sS -X POST "https://$fapi_host/v1/client/sign_ins?__clerk_api_version=2025-04-10&_clerk_js_version=5" \
            -H "Authorization: Bearer $PK" \
            -H "Content-Type: application/x-www-form-urlencoded" \
            --data-urlencode "identifier=$EMAIL" \
            | jq '{status: (.response // .errors // .)}'
          echo
          echo "== If the user is visible to BAPI but the FAPI call returns 'not_found' or pivots to sign_up, pk and sk are for different instances. =="

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17

      - name: Cache Gradle
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ runner.os }}-${{ hashFiles('packages/expo/package.json', 'clerk-expo-quickstart/NativeComponentQuickstart/package.json') }}
          restore-keys: |
            gradle-${{ runner.os }}-

      - name: Enable KVM
        # Required so the x86_64 Android emulator can use hardware accel.
        # Without it the emulator falls back to software rendering and is
        # multiple times slower to boot and run.
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: AVD cache
        uses: actions/cache@v4
        id: avd-cache
        with:
          path: |
            ~/.android/avd/*
            ~/.android/adb*
          key: avd-34-google_apis-x86_64-v1

      - name: Create AVD snapshot
        # On cache miss, boot the emulator once with snapshot saving so a
        # warm-boot snapshot ends up in ~/.android/avd/*. Subsequent runs
        # hit the cache and skip this step.
        if: steps.avd-cache.outputs.cache-hit != 'true'
        uses: reactivecircus/android-emulator-runner@v2
        with:
          api-level: 34
          target: google_apis
          arch: x86_64
          force-avd-creation: false
          emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim
          disable-animations: false
          script: echo "Generated AVD snapshot for caching."

      - name: Install Maestro
        run: |
          curl -Ls "https://get.maestro.mobile.dev" | bash
          echo "$HOME/.maestro/bin" >> "$GITHUB_PATH"

      - name: Run Android e2e
        uses: reactivecircus/android-emulator-runner@v2
        env:
          CLERK_TEST_EMAIL: ${{ steps.user.outputs.email }}
          CLERK_TEST_PASSWORD: ${{ steps.user.outputs.password }}
          EXCLUDE_TAGS: ${{ inputs.exclude_tags }}
          FLOWS_FILTER: ${{ inputs.flows_filter }}
        with:
          api-level: 34
          target: google_apis
          arch: x86_64
          force-avd-creation: false
          emulator-options: -no-snapshot-save -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim
          disable-animations: true
          # reactivecircus/android-emulator-runner runs each line of `script` in a
          # separate `sh -c` invocation, so cwd doesn't persist between commands.
          # Use a folded scalar (>-) plus `&&` chains so the entire pipeline runs
          # in one shell invocation. Maestro doesn't auto-recurse into subdirs,
          # so we pass each flow file explicitly via find.
          script: >-
            cd clerk-expo-quickstart/NativeComponentQuickstart &&
            npx expo prebuild --clean &&
            ( ok=0; for i in 1 2 3; do if npx expo run:android --variant release --no-bundler; then ok=1; break; fi; echo "expo run:android attempt $i failed; retrying in 15s"; sleep 15; done; [ "$ok" = 1 ] ) &&
            cd ../../integration-mobile &&
            find flows -type f -name "*.yaml" ! -path "*/common/*"
            ${FLOWS_FILTER:+-path "*$FLOWS_FILTER*"} -print0
            | xargs -0 maestro test --exclude-tags "$EXCLUDE_TAGS"

      - name: Upload Maestro artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: maestro-android
          path: ~/.maestro/tests

      - name: Cleanup test user
        if: always() && steps.user.outputs.user_id != ''
        env:
          CLERK_SECRET_KEY: ${{ steps.keys.outputs.sk }}
          USER_ID: ${{ steps.user.outputs.user_id }}
        run: |
          curl -fsS -X DELETE "https://api.clerkstage.dev/v1/users/$USER_ID" \
            -H "Authorization: Bearer $CLERK_SECRET_KEY" || true

  ios:
    name: iOS
    runs-on: macos-15
    timeout-minutes: 60
    steps:
      - name: Checkout @clerk/javascript
        uses: actions/checkout@v4

      - name: Checkout clerk-expo-quickstart
        uses: actions/checkout@v4
        with:
          repository: clerk/clerk-expo-quickstart
          ref: ${{ inputs.quickstart_ref }}
          path: clerk-expo-quickstart

      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm

      - name: Install monorepo deps
        run: pnpm install --frozen-lockfile

      - name: Build @clerk/expo
        run: pnpm turbo build --filter=@clerk/expo...

      - name: Pack @clerk/expo
        # `pnpm pack` resolves workspace:^ deps to real versions in the
        # packed tarball, which is what we need so the quickstart (outside
        # the workspace) can install it.
        run: pnpm --filter @clerk/expo pack --pack-destination /tmp/clerk-expo-pkg

      - name: Point quickstart at packed @clerk/expo and configure for CI
        working-directory: clerk-expo-quickstart/NativeComponentQuickstart
        run: |
          # The quickstart's main pins @clerk/expo to a local verdaccio
          # snapshot version which doesn't exist on public npm. Swap it for
          # the tarball we just packed.
          tarball=$(ls /tmp/clerk-expo-pkg/clerk-expo-*.tgz | head -1)
          jq --arg t "file:$tarball" '.dependencies["@clerk/expo"] = $t' package.json > package.json.tmp
          mv package.json.tmp package.json
          # Disable Apple Sign-In in the @clerk/expo plugin. Its default behavior
          # injects the com.apple.developer.applesignin entitlement during prebuild,
          # which makes Expo CLI's simulatorBuildRequiresCodeSigning() return true
          # and demand a development signing identity even for simulator builds —
          # CI doesn't have one. Maestro flows can't exercise Apple Sign-In without
          # an Apple Developer team configured anyway.
          # The plugin may be listed as a bare string "@clerk/expo" OR in array
          # form ["@clerk/expo", { ...config }] (the quickstart uses the latter
          # with a theme config). Handle both: rewrite the bare form, or merge
          # appleSignIn: false into the existing config object.
          jq '.expo.plugins |= map(
            if . == "@clerk/expo" then ["@clerk/expo", {"appleSignIn": false}]
            elif type == "array" and .[0] == "@clerk/expo" then [.[0], ((.[1] // {}) + {"appleSignIn": false})]
            else . end
          )' app.json > app.json.tmp
          mv app.json.tmp app.json
          # The quickstart's app.json ships with placeholder bundle ids
          # ("com.yourcompany.yourapp") but the Maestro flows in
          # integration-mobile/flows reference "com.clerk.clerkexpoquickstart".
          # Align them so launchApp/clearAppState target the installed app.
          jq '.expo.ios.bundleIdentifier = "com.clerk.clerkexpoquickstart" | .expo.android.package = "com.clerk.clerkexpoquickstart"' app.json > app.json.tmp
          mv app.json.tmp app.json
          # Strip expo-dev-client. With it installed, even release-variant
          # builds boot into the dev launcher and try to reach Metro at a
          # LAN IP unreachable from CI's emulator/simulator, leaving every
          # Maestro flow stuck on a blank screen.
          jq 'del(.dependencies["expo-dev-client"], .devDependencies["expo-dev-client"])' package.json > package.json.tmp
          mv package.json.tmp package.json

      - name: Cache quickstart node_modules
        uses: actions/cache@v4
        with:
          path: clerk-expo-quickstart/NativeComponentQuickstart/node_modules
          key: quickstart-nm-${{ runner.os }}-${{ hashFiles('clerk-expo-quickstart/NativeComponentQuickstart/package.json', 'packages/expo/package.json') }}
          restore-keys: |
            quickstart-nm-${{ runner.os }}-

      - name: Install quickstart deps
        working-directory: clerk-expo-quickstart/NativeComponentQuickstart
        # --ignore-workspace because the quickstart dir is nested inside the
        # javascript checkout; without this, pnpm walks up and treats the
        # outer monorepo as the workspace and skips the quickstart entirely.
        run: pnpm install --ignore-workspace --no-frozen-lockfile

      - name: Stub missing image assets
        working-directory: clerk-expo-quickstart/NativeComponentQuickstart
        # The quickstart's app.json references splash-icon.png and android
        # adaptive-icon variants that aren't actually committed. Fill them in
        # from icon.png so prebuild's image-asset mods don't fail with ENOENT.
        run: |
          cd assets/images
          for f in splash-icon.png android-icon-foreground.png android-icon-background.png android-icon-monochrome.png; do
            [ -f "$f" ] || cp icon.png "$f"
          done

      - name: Resolve Clerk instance keys
        id: keys
        env:
          INTEGRATION_STAGING_INSTANCE_KEYS: ${{ secrets.INTEGRATION_STAGING_INSTANCE_KEYS }}
        run: node scripts/resolve-instance-keys.mjs INTEGRATION_STAGING_INSTANCE_KEYS "$EXPO_INSTANCE_NAME"

      - name: Write quickstart .env
        working-directory: clerk-expo-quickstart/NativeComponentQuickstart
        run: |
          echo "EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY=${{ steps.keys.outputs.pk }}" > .env

      - name: Provision test user via BAPI
        id: user
        env:
          CLERK_SECRET_KEY: ${{ steps.keys.outputs.sk }}
        run: |
          email="ci-${GITHUB_RUN_ID}-${RANDOM}+clerk_test@clerkcookie.com"
          username="ci_${GITHUB_RUN_ID}_${RANDOM}"
          password="ClerkCI!$(openssl rand -hex 8)Aa1"
          http_code=$(curl -sS -o /tmp/bapi_response.json -w "%{http_code}" -X POST https://api.clerkstage.dev/v1/users \
            -H "Authorization: Bearer $CLERK_SECRET_KEY" \
            -H "Content-Type: application/json" \
            -d "{\"email_address\":[\"$email\"],\"username\":\"$username\",\"password\":\"$password\"}")
          if [ "$http_code" -lt 200 ] || [ "$http_code" -ge 300 ]; then
            echo "::error::BAPI user creation failed (HTTP $http_code)"
            jq . /tmp/bapi_response.json 2>/dev/null || cat /tmp/bapi_response.json
            exit 1
          fi
          response=$(cat /tmp/bapi_response.json)
          user_id=$(echo "$response" | jq -er '.id')
          echo "::add-mask::$password"
          echo "email=$email" >> "$GITHUB_OUTPUT"
          echo "password=$password" >> "$GITHUB_OUTPUT"
          echo "user_id=$user_id" >> "$GITHUB_OUTPUT"

      - name: Diagnose Clerk instance + user visibility
        # When sign-in flows fail with "Element not found: Enter your password",
        # the AuthView pivoted to sign-up because the frontend didn't recognize
        # the BAPI-provisioned user. Most likely cause: the pk in
        # INTEGRATION_STAGING_INSTANCE_KEYS[$EXPO_INSTANCE_NAME] points at a
        # different Clerk instance than the sk does. This step logs both
        # sides so we can confirm or rule that out from a single run.
        env:
          CLERK_SECRET_KEY: ${{ steps.keys.outputs.sk }}
          PK: ${{ steps.keys.outputs.pk }}
          USER_ID: ${{ steps.user.outputs.user_id }}
          EMAIL: ${{ steps.user.outputs.email }}
        run: |
          set +e
          echo "== publishable key frontend host =="
          fapi_host=$(echo "$PK" | sed -E 's/^pk_(test|live)_//' | base64 -d 2>/dev/null | tr -d '$' || true)
          echo "fapi_host=$fapi_host"
          echo
          echo "== sk -> /v1/users/USER_ID (does BAPI see the user just created?) =="
          curl -sS -H "Authorization: Bearer $CLERK_SECRET_KEY" "https://api.clerkstage.dev/v1/users/$USER_ID" \
            | jq '{id, email_addresses: [.email_addresses[].email_address], password_enabled, banned, locked, primary_email_address_id, object}'
          echo
          echo "== sk -> /v1/users?email_address=EMAIL (alternative lookup) =="
          curl -sS -H "Authorization: Bearer $CLERK_SECRET_KEY" \
            --data-urlencode "email_address[]=$EMAIL" -G \
            "https://api.clerkstage.dev/v1/users" \
            | jq '[.[] | {id, email_addresses: [.email_addresses[].email_address]}]'
          echo
          echo "== pk -> FAPI /v1/client/sign_ins (does the frontend recognize the user?) =="
          curl -sS -X POST "https://$fapi_host/v1/client/sign_ins?__clerk_api_version=2025-04-10&_clerk_js_version=5" \
            -H "Authorization: Bearer $PK" \
            -H "Content-Type: application/x-www-form-urlencoded" \
            --data-urlencode "identifier=$EMAIL" \
            | jq '{status: (.response // .errors // .)}'
          echo
          echo "== If the user is visible to BAPI but the FAPI call returns 'not_found' or pivots to sign_up, pk and sk are for different instances. =="

      - name: Cache CocoaPods downloads
        uses: actions/cache@v4
        with:
          path: |
            ~/Library/Caches/CocoaPods
            ~/.cocoapods/repos
          key: cocoapods-${{ runner.os }}-${{ hashFiles('packages/expo/package.json', 'clerk-expo-quickstart/NativeComponentQuickstart/package.json') }}
          restore-keys: |
            cocoapods-${{ runner.os }}-

      - name: Cache Xcode DerivedData
        # Includes SPM checkouts and incremental build artifacts. Wider key
        # than the old spm-only cache so it actually invalidates when the
        # quickstart's deps change, not just when @clerk/expo's do.
        uses: actions/cache@v4
        with:
          path: ~/Library/Developer/Xcode/DerivedData
          key: deriveddata-${{ runner.os }}-${{ hashFiles('packages/expo/package.json', 'clerk-expo-quickstart/NativeComponentQuickstart/package.json') }}
          restore-keys: |
            deriveddata-${{ runner.os }}-

      - name: Install Maestro
        run: |
          curl -Ls "https://get.maestro.mobile.dev" | bash
          echo "$HOME/.maestro/bin" >> "$GITHUB_PATH"

      - name: Build and run iOS e2e
        env:
          CLERK_TEST_EMAIL: ${{ steps.user.outputs.email }}
          CLERK_TEST_PASSWORD: ${{ steps.user.outputs.password }}
          EXCLUDE_TAGS: ${{ inputs.exclude_tags }}
          FLOWS_FILTER: ${{ inputs.flows_filter }}
        run: |
          cd clerk-expo-quickstart/NativeComponentQuickstart
          npx expo prebuild --clean
          # Pick the first available iOS simulator and boot it so expo
          # run:ios builds for the simulator (no code-signing certs on CI)
          # rather than defaulting to a physical device.
          SIM_UDID=$(xcrun simctl list devices --json | jq -r '[.devices | to_entries[] | select(.key | startswith("com.apple.CoreSimulator.SimRuntime.iOS")) | .value[] | select(.isAvailable == true)] | first | .udid')
          if [ -z "$SIM_UDID" ] || [ "$SIM_UDID" = "null" ]; then
            echo "::error::No available iOS simulator found"
            xcrun simctl list devices
            exit 1
          fi
          echo "Using simulator $SIM_UDID"
          xcrun simctl boot "$SIM_UDID" 2>/dev/null || true
          xcrun simctl bootstatus "$SIM_UDID" -b
          npx expo run:ios --device "$SIM_UDID" --configuration Release --no-bundler
          cd ../../integration-mobile
          # Maestro doesn't auto-recurse into subdirectories; pass each flow explicitly.
          find flows -type f -name "*.yaml" ! -path "*/common/*" \
            ${FLOWS_FILTER:+-path "*$FLOWS_FILTER*"} -print0 | \
            xargs -0 maestro test --exclude-tags "$EXCLUDE_TAGS,androidOnly"

      - name: Upload Maestro artifacts on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: maestro-ios
          path: ~/.maestro/tests

      - name: Cleanup test user
        if: always() && steps.user.outputs.user_id != ''
        env:
          CLERK_SECRET_KEY: ${{ steps.keys.outputs.sk }}
          USER_ID: ${{ steps.user.outputs.user_id }}
        run: |
          curl -fsS -X DELETE "https://api.clerkstage.dev/v1/users/$USER_ID" \
            -H "Authorization: Bearer $CLERK_SECRET_KEY" || true