test(expo): address Sean's iOS review feedback

P1 (cache honesty): the compat-gate pin steps mutate the working tree
(packages/expo/app.plugin.js, packages/expo/android/build.gradle), but the
bin-hash that keys the .app / .apk cache was computed from `git ls-tree -r
HEAD`, which reads committed blobs. A stale cache hit could install an OLD
SDK ref while claiming to test a new one. Fold clerk_ios_ref,
clerk_android_ref, and clerk_android_snapshot_suffix into the hash on both
jobs so the cache key reflects what's actually being built.

P2 (Swift tests on production code): pulled the two pure predicates the
existing tests were mirroring — `isSuccessfulAuth` (from
ClerkAuthWrapperViewController.viewDidDisappear) and the presentWhenReady
guard (from ClerkAuthNativeView) — into ClerkAuthLogic.swift in the pod
source files. ClerkViewFactory.swift now imports ClerkExpo and calls
ClerkAuthSessionLogic; ClerkExpoModule.swift's view layer now calls
ClerkPresentationLogic. The XCTest files `@testable import ClerkExpo`
and exercise the same public symbols production runs against — no more
duplicated logic to drift. The maxPresentationAttempts constant lives on
the production type so a bump can't silently break the test.

P2 (forgot-password OAuth automated): split google-sso-from-forgot-password
into two files. The original bug was that tapping "Sign in with Google"
from the forgot-password screen was a silent no-op on iOS — that part is
now automated by asserting the system OAuth presentation appears
("Wants to Use" / "accounts.google.com" / "Continue" / "google.com").
The actual Google credentialed completion still needs real OAuth and lives
in google-sso-from-forgot-password-manual.yaml with the `manual` tag, so
the default workflow exclude (manual,skip) keeps it out of CI but it's
runnable as a one-off.

P2 (local scripts pre-filter): Maestro's `--exclude-tags` is a no-op when
explicit file paths are passed, which run-ios.sh / run-android.sh /
run-regressions.sh all do. Added scripts/lib/filter-flows.sh — a shared
helper that scans each flow's YAML frontmatter for tag-list entries
matching the excluded set — and routed all three scripts through it
before they invoke maestro.

Author: chriscanin

.github/workflows/mobile-e2e.yml

@@ -238,13 +238,27 @@ jobs:
         # the workflow file (which encodes the quickstart-modification rules),
         # and the quickstart source itself. node_modules, android/, and ios/
         # are excluded (they're build outputs / regenerated by prebuild).
+        #
+        # Also fold the compat-gate ref inputs into the hash. The "Pin clerk-*"
+        # steps above mutate the working tree (app.plugin.js, build.gradle),
+        # but `git ls-tree -r HEAD` reads committed blobs and would miss those
+        # patches — a stale cache hit could then install the OLD SDK refs while
+        # claiming to test the new ones. Including the input strings here makes
+        # the cache key honest about what's actually being built.
         id: bin-hash
+        env:
+          CLERK_IOS_REF: ${{ inputs.clerk_ios_ref }}
+          CLERK_ANDROID_REF: ${{ inputs.clerk_android_ref }}
+          CLERK_ANDROID_SNAPSHOT_SUFFIX: ${{ inputs.clerk_android_snapshot_suffix }}
         run: |
           expo_tree=$(git ls-tree -r HEAD packages/expo .github/workflows/mobile-e2e.yml | grep -v "/dist/")
           qs_tree=$(git -C clerk-expo-quickstart ls-tree -r HEAD NativeComponentQuickstart | grep -vE "node_modules|/android/|/ios/")
-          hash=$(printf '%s\n%s\n' "$expo_tree" "$qs_tree" | sha256sum | cut -c1-16)
+          hash=$(printf '%s\n%s\nios=%s\nandroid=%s\nsnapshot=%s\n' \
+            "$expo_tree" "$qs_tree" \
+            "$CLERK_IOS_REF" "$CLERK_ANDROID_REF" "$CLERK_ANDROID_SNAPSHOT_SUFFIX" \
+            | sha256sum | cut -c1-16)
           echo "hash=$hash" >> "$GITHUB_OUTPUT"
-          echo "Binary source hash: $hash"
+          echo "Binary source hash: $hash (ios=$CLERK_IOS_REF android=$CLERK_ANDROID_REF snapshot=$CLERK_ANDROID_SNAPSHOT_SUFFIX)"
 
       - name: Restore Android APK cache
         # On hit, the entire build path below is skipped. Cache key includes
@@ -637,13 +651,22 @@ jobs:
           grep -nE "clerkAndroid(Api|Ui)Version" "$file" | head
 
       - name: Compute binary source hash
+        # See the matching step in the Android job for the rationale on folding
+        # the compat-gate ref inputs into the hash — same logic applies here.
         id: bin-hash
+        env:
+          CLERK_IOS_REF: ${{ inputs.clerk_ios_ref }}
+          CLERK_ANDROID_REF: ${{ inputs.clerk_android_ref }}
+          CLERK_ANDROID_SNAPSHOT_SUFFIX: ${{ inputs.clerk_android_snapshot_suffix }}
         run: |
           expo_tree=$(git ls-tree -r HEAD packages/expo .github/workflows/mobile-e2e.yml | grep -v "/dist/")
           qs_tree=$(git -C clerk-expo-quickstart ls-tree -r HEAD NativeComponentQuickstart | grep -vE "node_modules|/android/|/ios/")
-          hash=$(printf '%s\n%s\n' "$expo_tree" "$qs_tree" | sha256sum | cut -c1-16)
+          hash=$(printf '%s\n%s\nios=%s\nandroid=%s\nsnapshot=%s\n' \
+            "$expo_tree" "$qs_tree" \
+            "$CLERK_IOS_REF" "$CLERK_ANDROID_REF" "$CLERK_ANDROID_SNAPSHOT_SUFFIX" \
+            | sha256sum | cut -c1-16)
           echo "hash=$hash" >> "$GITHUB_OUTPUT"
-          echo "Binary source hash: $hash"
+          echo "Binary source hash: $hash (ios=$CLERK_IOS_REF android=$CLERK_ANDROID_REF snapshot=$CLERK_ANDROID_SNAPSHOT_SUFFIX)"
 
       - name: Restore iOS .app cache
         id: app-cache

integration/mobile/flows/sign-in/google-sso-from-forgot-password-manual.yaml

@@ -0,0 +1,37 @@
+# MANUAL REGRESSION: full end-to-end Google OAuth completion from the
+# forgot-password screen. The launch-only portion is automated in
+# google-sso-from-forgot-password.yaml; this variant adds the steps after the
+# system permission dialog, which requires real Google credentials and a real
+# OAuth completion, neither of which exist on CI.
+#
+# Tagged `manual` so the default workflow's `--exclude-tags manual,skip` keeps
+# it out of automated runs. To run locally:
+#   maestro test \
+#     --exclude-tags androidOnly \
+#     integration/mobile/flows/sign-in/google-sso-from-forgot-password-manual.yaml
+appId: com.clerk.clerkexpoquickstart
+tags:
+  - regression
+  - manual
+  - iosOnly
+---
+- runFlow: ../common/open-app.yaml
+- runFlow: ../common/assert-signed-out.yaml
+- tapOn:
+    text: "Enter your email or username"
+- inputText: ${CLERK_TEST_EMAIL}
+- tapOn:
+    text: "Continue"
+    index: 0
+- waitForAnimationToEnd:
+    timeout: 3000
+- tapOn:
+    text: "Forgot password?"
+- waitForAnimationToEnd:
+    timeout: 3000
+- tapOn:
+    text: "Sign in with Google"
+- waitForAnimationToEnd:
+    timeout: 8000
+# Manual step: complete Google sign-in. After return, assert home screen.
+- runFlow: ../common/assert-signed-in.yaml

integration/mobile/flows/sign-in/google-sso-from-forgot-password.yaml

@@ -1,20 +1,21 @@
-# REGRESSION: iOS OAuth (SSO) sign-in failed silently when initiated from
-# the forgot-password screen of the native AuthView.
+# REGRESSION (automated portion): iOS OAuth sign-in launched silently from the
+# forgot-password screen of the native AuthView — tapping "Sign in with Google"
+# did nothing visible, with no ASWebAuthenticationSession opening. This flow
+# verifies the LAUNCH only: navigate to forgot-password, tap the SSO button,
+# and assert that the system OAuth presentation actually appears.
 #
-# The quickstart app does not have a custom forgot-password screen, so this
-# flow navigates within the native AuthView to reach the forgot-password step
-# and then initiates Google SSO from there.
-#
-# NOTE: This flow requires a real Google OAuth flow. Marked as manual + regression.
+# The post-launch Google account-picker can't run on CI without a stubbed /
+# test-mode OAuth provider, so the flow cancels the system dialog after
+# verifying it appeared. The full-completion variant lives in
+# google-sso-from-forgot-password-manual.yaml.
 appId: com.clerk.clerkexpoquickstart
 tags:
   - regression
-  - manual
   - iosOnly
 ---
 - runFlow: ../common/open-app.yaml
 - runFlow: ../common/assert-signed-out.yaml
-# Enter an email to get to the password screen where "Forgot password?" is available
+# Enter an email to get to the password screen where "Forgot password?" is available.
 - tapOn:
     text: "Enter your email or username"
 - inputText: ${CLERK_TEST_EMAIL}
@@ -23,15 +24,32 @@ tags:
     index: 0
 - waitForAnimationToEnd:
     timeout: 3000
-# Now on the password screen, tap "Forgot password?" to reach that step
+# Now on the password screen, tap "Forgot password?" to reach that step.
 - tapOn:
     text: "Forgot password?"
 - waitForAnimationToEnd:
     timeout: 3000
-# Tap Google SSO from the forgot-password context
+- takeScreenshot: debug-sso-forgot-password-pre-tap
+# This is the regression-critical step. Before the fix this tap was a silent
+# no-op. After the fix iOS opens an ASWebAuthenticationSession, which first
+# shows a system permission dialog ("<App> Wants to Use <domain> to Sign In",
+# with Cancel/Continue buttons). We assert ANY of the system-provided strings
+# is visible — that's enough to prove OAuth actually launched.
 - tapOn:
     text: "Sign in with Google"
-- waitForAnimationToEnd:
-    timeout: 8000
-# Manual step: complete Google sign-in. After return, assert home screen.
-- runFlow: ../common/assert-signed-in.yaml
+- extendedWaitUntil:
+    visible: "Wants to Use|accounts\\.google\\.com|google\\.com|Continue"
+    timeout: 10000
+- takeScreenshot: debug-sso-forgot-password-launched
+# Cancel the OAuth flow — completing the Google sign-in needs real credentials
+# we don't have on CI. We've already verified what the regression cares about
+# (the launch). Be lenient about what cancel-target is on screen since the
+# exact label varies between the iOS permission dialog (Cancel) and the
+# loaded Safari sheet (Done / Cancel).
+- runFlow:
+    when:
+      visible: "Cancel|Done"
+    commands:
+      - tapOn:
+          text: "Cancel|Done"
+          optional: true

integration/mobile/scripts/lib/filter-flows.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Pre-filters Maestro flow files by tag exclusion.
+#
+# Background: `maestro test --exclude-tags X,Y` only filters when invoked
+# against a directory. When you pass explicit file paths (which run-ios.sh /
+# run-android.sh / run-regressions.sh all do, because flows live in nested
+# directories that Maestro does not auto-recurse into), the --exclude-tags
+# flag is silently ignored and every file is executed regardless of tag.
+#
+# This helper closes that hole by scanning each file for an exact tag match
+# in its YAML frontmatter and dropping any file whose tag list intersects
+# the excluded set, before the file list ever reaches Maestro.
+#
+# Usage:
+#   source ./lib/filter-flows.sh
+#   filtered=$(filter_flows "manual,skip,androidOnly" "${FLOW_FILES[@]}")
+#   readarray -t KEEP <<< "$filtered"   # or pipe to xargs -n 1
+#
+# Stdout: kept file paths (one per line, in input order).
+# Stderr: a one-line "Skip <path> (...)" notice for each dropped file.
+
+filter_flows() {
+  local excluded_csv="$1"; shift
+  if [[ -z "$excluded_csv" ]]; then
+    printf '%s\n' "$@"
+    return 0
+  fi
+  local pattern
+  pattern=$(printf '%s' "$excluded_csv" | sed 's/,/|/g')
+  local f
+  for f in "$@"; do
+    if [[ ! -f "$f" ]]; then
+      echo "Skip $f (file not found)" >&2
+      continue
+    fi
+    # Match a list-item tag entry in the YAML frontmatter, e.g.
+    #   tags:
+    #     - manual
+    # We deliberately anchor on `^\s*-\s*<tag>\s*$` so a flow body that
+    # happens to contain the word "manual" doesn't get filtered out.
+    if grep -qE "^[[:space:]]*-[[:space:]]*(${pattern})[[:space:]]*\$" "$f"; then
+      echo "Skip $f (matches excluded tag in ${excluded_csv})" >&2
+    else
+      printf '%s\n' "$f"
+    fi
+  done
+}

integration/mobile/scripts/run-android.sh

@@ -4,6 +4,8 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FLOWS_DIR="$SCRIPT_DIR/../flows"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/lib/filter-flows.sh"
 
 if [[ -f "$SCRIPT_DIR/../config/.env" ]]; then
   set -a
@@ -18,20 +20,28 @@ if ! command -v maestro >/dev/null 2>&1; then
 fi
 
 echo "==> Running all non-manual flows on Android..."
-# Maestro does not auto-recurse into subdirectories. Pass each flow file
-# explicitly to pick up flows/sign-in/, flows/profile/, etc. Skip the
-# flows/common/ directory — those are subflows invoked via runFlow.
-# Use while-read to stay compatible with macOS bash 3.2 (no mapfile).
-FLOW_FILES=()
+ALL_FLOWS=()
 while IFS= read -r f; do
-  FLOW_FILES+=("$f")
+  ALL_FLOWS+=("$f")
 done < <(find "$FLOWS_DIR" -type f -name "*.yaml" ! -path "*/common/*")
 
+# Maestro's --exclude-tags is a no-op when explicit file paths are passed,
+# so pre-filter the list ourselves before handing it off.
+KEEP=()
+while IFS= read -r f; do
+  [[ -z "$f" ]] && continue
+  KEEP+=("$f")
+done < <(filter_flows "iosOnly,manual,skip" "${ALL_FLOWS[@]}")
+
+if [[ ${#KEEP[@]} -eq 0 ]]; then
+  echo "No flows to run after tag filtering." >&2
+  exit 0
+fi
+
 maestro --platform android test \
-  --exclude-tags iosOnly,manual,skip \
   -e CLERK_TEST_EMAIL="${CLERK_TEST_EMAIL}" \
   -e CLERK_TEST_PASSWORD="${CLERK_TEST_PASSWORD}" \
   -e CLERK_TEST_EMAIL_SECONDARY="${CLERK_TEST_EMAIL_SECONDARY:-}" \
   -e CLERK_TEST_PASSWORD_SECONDARY="${CLERK_TEST_PASSWORD_SECONDARY:-}" \
   "$@" \
-  "${FLOW_FILES[@]}"
+  "${KEEP[@]}"

integration/mobile/scripts/run-ios.sh

@@ -4,6 +4,8 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FLOWS_DIR="$SCRIPT_DIR/../flows"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/lib/filter-flows.sh"
 
 if [[ -f "$SCRIPT_DIR/../config/.env" ]]; then
   set -a
@@ -18,20 +20,31 @@ if ! command -v maestro >/dev/null 2>&1; then
 fi
 
 echo "==> Running all non-manual flows on iOS..."
-# Maestro does not auto-recurse into subdirectories. Pass each flow file
-# explicitly to pick up flows/sign-in/, flows/profile/, etc. Skip the
-# flows/common/ directory — those are subflows invoked via runFlow.
+# Collect every flow file under flows/, excluding the common/ subflow dir.
 # Use while-read to stay compatible with macOS bash 3.2 (no mapfile).
-FLOW_FILES=()
+ALL_FLOWS=()
 while IFS= read -r f; do
-  FLOW_FILES+=("$f")
+  ALL_FLOWS+=("$f")
 done < <(find "$FLOWS_DIR" -type f -name "*.yaml" ! -path "*/common/*")
 
+# Maestro's --exclude-tags is a no-op when explicit file paths are passed,
+# so pre-filter the list ourselves before handing it off. See
+# scripts/lib/filter-flows.sh for the why.
+KEEP=()
+while IFS= read -r f; do
+  [[ -z "$f" ]] && continue
+  KEEP+=("$f")
+done < <(filter_flows "androidOnly,manual,skip" "${ALL_FLOWS[@]}")
+
+if [[ ${#KEEP[@]} -eq 0 ]]; then
+  echo "No flows to run after tag filtering." >&2
+  exit 0
+fi
+
 maestro --platform ios test \
-  --exclude-tags androidOnly,manual,skip \
   -e CLERK_TEST_EMAIL="${CLERK_TEST_EMAIL}" \
   -e CLERK_TEST_PASSWORD="${CLERK_TEST_PASSWORD}" \
   -e CLERK_TEST_EMAIL_SECONDARY="${CLERK_TEST_EMAIL_SECONDARY:-}" \
   -e CLERK_TEST_PASSWORD_SECONDARY="${CLERK_TEST_PASSWORD_SECONDARY:-}" \
   "$@" \
-  "${FLOW_FILES[@]}"
+  "${KEEP[@]}"

integration/mobile/scripts/run-regressions.sh

@@ -6,6 +6,8 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FLOWS_DIR="$SCRIPT_DIR/../flows"
 PLATFORM="${1:-both}"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/lib/filter-flows.sh"
 
 REGRESSION_FLOWS=(
   "$FLOWS_DIR/sign-in/google-sso-from-forgot-password.yaml"
@@ -22,29 +24,42 @@ if [[ -f "$SCRIPT_DIR/../config/.env" ]]; then
   set +a
 fi
 
+# Maestro's --exclude-tags is a no-op when explicit file paths are passed.
+# Pre-filter the regression list for each platform before invoking Maestro
+# so a flow tagged `manual` or `skip` (or for the other platform) cannot
+# sneak in just because it's listed above.
 run_on() {
   local platform_name="$1"
-  shift
+  local exclude_tags="$2"
+  shift 2
+
   echo "==> Running regression flows on $platform_name..."
-  for flow in "${REGRESSION_FLOWS[@]}"; do
-    if [[ -f "$flow" ]]; then
-      maestro test "$@" "$flow"
-    else
-      echo "Skipping missing flow: $flow"
-    fi
+  KEEP=()
+  while IFS= read -r f; do
+    [[ -z "$f" ]] && continue
+    KEEP+=("$f")
+  done < <(filter_flows "$exclude_tags" "${REGRESSION_FLOWS[@]}")
+
+  if [[ ${#KEEP[@]} -eq 0 ]]; then
+    echo "No regression flows to run on $platform_name after filtering." >&2
+    return 0
+  fi
+
+  for flow in "${KEEP[@]}"; do
+    maestro test "$@" "$flow"
   done
 }
 
 case "$PLATFORM" in
   ios)
-    run_on "iOS" --device "${MAESTRO_DEVICE:-iPhone 16 Pro}" --exclude-tags androidOnly
+    run_on "iOS" "androidOnly,manual,skip" --device "${MAESTRO_DEVICE:-iPhone 16 Pro}"
     ;;
   android)
-    run_on "Android" --exclude-tags iosOnly
+    run_on "Android" "iosOnly,manual,skip"
     ;;
   both)
-    run_on "iOS" --device "${MAESTRO_DEVICE:-iPhone 16 Pro}" --exclude-tags androidOnly
-    run_on "Android" --exclude-tags iosOnly
+    run_on "iOS" "androidOnly,manual,skip" --device "${MAESTRO_DEVICE:-iPhone 16 Pro}"
+    run_on "Android" "iosOnly,manual,skip"
     ;;
   *)
     echo "Usage: $0 [ios|android|both]" >&2