ci(mobile-e2e): support clerk-android snapshot input + auto-run on Renovate android-pin PRs

- Adds optional clerk_android_ref / clerk_android_snapshot_suffix workflow_dispatch
  inputs. When set, the Android job checks out clerk-android at that ref,
  publishes a snapshot to mavenLocal, and patches packages/expo/android/build.gradle
  to consume it before running the Maestro suite. This is what clerk-android's
  manual-release.yml expo-compat gate dispatches against.
- Adds a pull_request trigger scoped to packages/expo/android/build.gradle, gated
  to renovate[bot], so Renovate's clerkAndroid pin bumps get verified before merge.
- Bumps JDK to 21 (required by clerk-android; Expo Android build works fine on 21).
- iOS job restricted to workflow_dispatch (the new path filter doesn't apply to it).

Author: chriscanin

.github/workflows/mobile-e2e.yml

@@ -23,6 +23,20 @@ on:
         description: "Maestro tags to exclude (comma-separated)"
         required: false
         default: "manual,skip"
+      clerk_android_ref:
+        description: "clerk-android git ref to publish as a mavenLocal snapshot and test @clerk/expo against. Leave empty to test the versions already pinned in packages/expo/android/build.gradle."
+        required: false
+        default: ""
+      clerk_android_snapshot_suffix:
+        description: "Suffix appended to the clerk-android version when clerk_android_ref is set (e.g. '-compat-12345678'). Required when clerk_android_ref is set."
+        required: false
+        default: ""
+  # Auto-run on Renovate PRs that bump the clerkAndroid* pins. The dep bump is
+  # already applied at the PR's merge ref, so we just need to build + Maestro
+  # against it — no clerk-android checkout/snapshot publish is needed in this path.
+  pull_request:
+    paths:
+      - "packages/expo/android/build.gradle"
 
 env:
   EXPO_INSTANCE_NAME: clerkstage-with-native-components
@@ -34,6 +48,9 @@ concurrency:
 jobs:
   android:
     name: Android
+    # Restrict pull_request runs to Renovate to avoid burning emulator time on
+    # human PRs that touch the same path. Manual dispatches always run.
+    if: github.event_name != 'pull_request' || github.event.pull_request.user.login == 'renovate[bot]'
     runs-on: 'blacksmith-8vcpu-ubuntu-2204'
     timeout-minutes: 45
     defaults:
@@ -47,9 +64,17 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: clerk/clerk-expo-quickstart
-          ref: ${{ inputs.quickstart_ref }}
+          ref: ${{ inputs.quickstart_ref || 'main' }}
           path: clerk-expo-quickstart
 
+      - name: Checkout clerk-android
+        if: inputs.clerk_android_ref != ''
+        uses: actions/checkout@v4
+        with:
+          repository: clerk/clerk-android
+          ref: ${{ inputs.clerk_android_ref }}
+          path: clerk-android
+
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
@@ -94,11 +119,55 @@ jobs:
           echo "password=$password" >> "$GITHUB_OUTPUT"
           echo "user_id=$user_id" >> "$GITHUB_OUTPUT"
 
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: 17
+          # 21 (not 17) because clerk-android requires it to build. Expo's
+          # quickstart Android build works with 21 as well.
+          java-version: 21
+
+      - name: Validate clerk-android snapshot inputs
+        if: inputs.clerk_android_ref != '' && inputs.clerk_android_snapshot_suffix == ''
+        run: |
+          echo "::error::clerk_android_ref is set but clerk_android_snapshot_suffix is empty. Provide a suffix (e.g. '-compat-${{ github.run_id }}')."
+          exit 1
+
+      - name: Compute clerk-android snapshot versions
+        id: android_versions
+        if: inputs.clerk_android_ref != ''
+        working-directory: clerk-android
+        run: |
+          suffix="${{ inputs.clerk_android_snapshot_suffix }}"
+          api="$(awk -F= '/^CLERK_API_VERSION=/{print $2}' gradle.properties | tr -d '[:space:]')${suffix}"
+          ui="$(awk -F= '/^CLERK_UI_VERSION=/{print $2}' gradle.properties | tr -d '[:space:]')${suffix}"
+          telemetry="$(awk -F= '/^CLERK_TELEMETRY_VERSION=/{print $2}' gradle.properties | tr -d '[:space:]')${suffix}"
+          echo "api=$api" >> "$GITHUB_OUTPUT"
+          echo "ui=$ui" >> "$GITHUB_OUTPUT"
+          echo "telemetry=$telemetry" >> "$GITHUB_OUTPUT"
+
+      - name: Publish clerk-android snapshot to mavenLocal
+        if: inputs.clerk_android_ref != ''
+        working-directory: clerk-android
+        run: |
+          sed -i "s/^CLERK_API_VERSION=.*/CLERK_API_VERSION=${{ steps.android_versions.outputs.api }}/" gradle.properties
+          sed -i "s/^CLERK_UI_VERSION=.*/CLERK_UI_VERSION=${{ steps.android_versions.outputs.ui }}/" gradle.properties
+          sed -i "s/^CLERK_TELEMETRY_VERSION=.*/CLERK_TELEMETRY_VERSION=${{ steps.android_versions.outputs.telemetry }}/" gradle.properties
+          chmod +x gradlew
+          ./gradlew :source:api:publishToMavenLocal :source:ui:publishToMavenLocal :source:telemetry:publishToMavenLocal -x signMavenPublication
+
+      - name: Patch @clerk/expo build.gradle to use snapshot
+        if: inputs.clerk_android_ref != ''
+        run: |
+          sed -i "s/clerkAndroidApiVersion = \".*\"/clerkAndroidApiVersion = \"${{ steps.android_versions.outputs.api }}\"/" packages/expo/android/build.gradle
+          sed -i "s/clerkAndroidUiVersion = \".*\"/clerkAndroidUiVersion = \"${{ steps.android_versions.outputs.ui }}\"/" packages/expo/android/build.gradle
+          # Expo autolinks via the root project's repositories; adding mavenLocal()
+          # to the expo module's build.gradle is sufficient for gradle resolution.
+          if ! grep -q "mavenLocal()" packages/expo/android/build.gradle; then
+            sed -i '/^repositories\s*{/a \  mavenLocal()' packages/expo/android/build.gradle || true
+          fi
+          echo "=== Patched @clerk/expo build.gradle ==="
+          grep -A 2 -B 2 "clerkAndroid\|mavenLocal" packages/expo/android/build.gradle | head -20
 
       - name: Install Maestro
         run: |
@@ -110,7 +179,8 @@ jobs:
         env:
           CLERK_TEST_EMAIL: ${{ steps.user.outputs.email }}
           CLERK_TEST_PASSWORD: ${{ steps.user.outputs.password }}
-          EXCLUDE_TAGS: ${{ inputs.exclude_tags }}
+          # inputs.exclude_tags is empty on pull_request triggers; fall back to the same default
+          EXCLUDE_TAGS: ${{ inputs.exclude_tags || 'manual,skip' }}
         with:
           api-level: 34
           target: google_apis
@@ -142,6 +212,8 @@ jobs:
 
   ios:
     name: iOS
+    # iOS isn't affected by the Android pin bump path filter; only run on manual dispatch.
+    if: github.event_name == 'workflow_dispatch'
     runs-on: macos-15
     timeout-minutes: 60
     steps: