chore: stabilize Maestro CI

.github/actions/preinstall-android-sdk/action.yml

@@ -0,0 +1,28 @@
+name: Pre-install Android SDK packages
+description: >-
+  Retried install of the Android emulator + api-34 system image; clears partial
+  downloads between attempts so a corrupt archive self-heals.
+
+runs:
+  using: composite
+  steps:
+    - name: Install emulator + system image
+      shell: bash
+      run: |
+        set -u
+        SDK="${ANDROID_HOME:-${ANDROID_SDK_ROOT:-/usr/local/lib/android/sdk}}"
+        SDKMANAGER="$SDK/cmdline-tools/latest/bin/sdkmanager"
+        IMAGE="system-images;android-34;google_apis;x86_64"
+        yes | "$SDKMANAGER" --licenses >/dev/null 2>&1 || true
+        for attempt in 1 2 3; do
+          echo "sdkmanager install attempt $attempt"
+          if "$SDKMANAGER" --install "emulator" "$IMAGE" --channel=0; then
+            echo "SDK packages installed on attempt $attempt"
+            exit 0
+          fi
+          echo "Install failed (attempt $attempt); clearing partial downloads and retrying"
+          rm -rf "$SDK/emulator" "$SDK/system-images/android-34/google_apis/x86_64"
+          sleep 10
+        done
+        echo "sdkmanager failed to install emulator + system image after 3 attempts"
+        exit 1

.github/scripts/assert-maestro-shards.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Emits the shard list the PR matrices fan out over and asserts every flow's
+# test-<N> tag falls inside it, so drift fails loud instead of a flow silently
+# never running.
+SHARD_COUNT=14
+FLOWS_DIR=".maestro/tests"
+
+declared=()
+for n in $(seq 1 "$SHARD_COUNT"); do declared+=("$n"); done
+
+# Match the same `- test-N` list-item shape run-maestro.sh greps
+found="$(grep -rhoE "^[[:space:]]*-[[:space:]]*['\"]?test-[0-9]+" "$FLOWS_DIR" \
+  --include='*.yaml' --include='*.yml' \
+  | grep -oE '[0-9]+' | sort -n -u)"
+
+missing=()
+for n in "${declared[@]}"; do
+  printf '%s\n' "$found" | grep -qx "$n" || missing+=("$n")
+done
+
+extra=()
+while IFS= read -r n; do
+  [ -z "$n" ] && continue
+  if [ "$n" -lt 1 ] || [ "$n" -gt "$SHARD_COUNT" ]; then
+    extra+=("$n")
+  fi
+done <<< "$found"
+
+if [ ${#missing[@]} -gt 0 ] || [ ${#extra[@]} -gt 0 ]; then
+  echo "::error title=Maestro shard drift::Flow test-<N> tags do not match the declared 1..${SHARD_COUNT} shard list."
+  [ ${#missing[@]} -gt 0 ] && echo "  Shards with no flow tagged test-<N>: ${missing[*]}"
+  [ ${#extra[@]} -gt 0 ] && echo "  Flows tagged outside 1..${SHARD_COUNT}: ${extra[*]}"
+  exit 1
+fi
+
+json="$(printf '%s,' "${declared[@]}")"
+json="[${json%,}]"
+echo "Maestro shard coverage OK: test-1..test-${SHARD_COUNT} all present, none out of range."
+echo "shards=${json}"
+if [ -n "${GITHUB_OUTPUT:-}" ]; then
+  echo "shards=${json}" >> "$GITHUB_OUTPUT"
+fi

.github/scripts/run-maestro.sh

@@ -5,10 +5,37 @@ PLATFORM="${1:-${PLATFORM:-android}}"
 SHARD="${2:-${SHARD:-default}}"
 FLOWS_DIR=".maestro/tests"
 MAIN_REPORT="maestro-report.xml"
-MAX_RERUN_ROUNDS="${MAX_RERUN_ROUNDS:-3}"
+MAX_RERUN_ROUNDS="${MAX_RERUN_ROUNDS:-2}"
 RERUN_REPORT_PREFIX="maestro-rerun"
 export MAESTRO_DRIVER_STARTUP_TIMEOUT="${MAESTRO_DRIVER_STARTUP_TIMEOUT:-120000}"
 
+# Linux has timeout, macOS has gtimeout (Homebrew coreutils)
+TIMEOUT_BIN="$(command -v timeout || command -v gtimeout || true)"
+
+# Bound each `maestro test` so a wedged CoreSimulator child can't hang the job;
+# 124/137 = timed out, annotated as an environment failure.
+run_maestro_test() {
+  local rc=0
+  if [ -n "$TIMEOUT_BIN" ]; then
+    "$TIMEOUT_BIN" -k 30s 35m maestro test "$@" || rc=$?
+  else
+    maestro test "$@" || rc=$?
+  fi
+  if [ "$rc" -eq 124 ] || [ "$rc" -eq 137 ]; then
+    echo "::error title=Maestro run timed out::A 'maestro test' invocation exceeded 35m and was terminated (likely a wedged CoreSimulator). This is an environment failure, not an app or test regression."
+  fi
+  return 0
+}
+
+# The deeplink-login flow logs a live session token; scrub it before the logs
+# upload as a public artifact. perl -i works on both Linux and macOS.
+redact_uploaded_logs() {
+  local logs_dir="$HOME/.maestro/tests"
+  [ -d "$logs_dir" ] || return 0
+  find "$logs_dir" -type f -print0 \
+    | xargs -0 perl -pi -e 's/&token=[A-Za-z0-9_-]+/&token=***REDACTED***/g' 2>/dev/null || true
+}
+
 if [ "$PLATFORM" = "android" ]; then
   APP_ID="chat.rocket.android"
 else
@@ -32,8 +59,24 @@ else
   fi
 fi
 
+# Probe the E2E server up front so an outage surfaces as one clear annotation
+# instead of opaque flow failures. data.js is the source of the server URL.
+E2E_SERVER="$(sed -n "s/^[[:space:]]*server:[[:space:]]*['\"]\([^'\"]*\)['\"].*/\1/p" .maestro/scripts/data.js | head -1)"
+if [ -z "$E2E_SERVER" ]; then
+  echo "::error title=E2E server URL not found::Could not scrape 'server' from .maestro/scripts/data.js — its format may have changed. This is a CI config failure, not an app or test regression."
+  exit 3
+fi
+echo "Preflight: checking E2E server ${E2E_SERVER} ..."
+PREFLIGHT_CODE="$(curl -s -o /dev/null -w '%{http_code}' --max-time 25 --retry 3 --retry-all-errors --retry-delay 5 "${E2E_SERVER}/api/info" || true)"
+if [ "$PREFLIGHT_CODE" != "200" ]; then
+  echo "::error title=E2E server unreachable::${E2E_SERVER}/api/info returned HTTP ${PREFLIGHT_CODE:-000} — the test server is likely down. This is an environment failure, not an app or test regression."
+  exit 3
+fi
+echo "Preflight OK: ${E2E_SERVER}/api/info -> 200"
+
 MAPFILE="$(mktemp)"
-trap 'rm -f "$MAPFILE"' EXIT
+# Redact on every exit path, before the always() upload reads the logs
+trap 'rm -f "$MAPFILE"; redact_uploaded_logs' EXIT
 
 while IFS= read -r -d '' file; do
   if grep -qE "^[[:space:]]*-[[:space:]]*['\"]?test-${SHARD}['\"]?([[:space:]]*$|[[:space:]]*,|[[:space:]]*\\])" "$file"; then
@@ -69,33 +112,36 @@ done < "$MAPFILE"
 echo "Main run will execute:"
 printf '  %s\n' "${FLOW_FILES[@]}"
 
-if [ "$PLATFORM" = "android" ]; then
-  adb shell settings put system show_touches 1 || true
-  adb install -r "app-release.apk" || true
-  adb shell monkey -p "$APP_ID" -c android.intent.category.LAUNCHER 1 || true
-  sleep 6
-  adb shell am force-stop "$APP_ID" || true
-
-  maestro test "${FLOW_FILES[@]}" \
-    -e APP_ID="$APP_ID" \
-    --exclude-tags=util \
-    --include-tags="test-${SHARD}" \
-    --exclude-tags=ios-only \
-    --format junit \
-    --output "$MAIN_REPORT" || true
+run_main_suite() {
+  rm -f "$MAIN_REPORT"
+  if [ "$PLATFORM" = "android" ]; then
+    adb shell settings put system show_touches 1 || true
+    adb install -r "app-release.apk" || true
 
-else
-  maestro test "${FLOW_FILES[@]}" \
-    -e APP_ID="$APP_ID" \
-    --exclude-tags=util \
-    --include-tags="test-${SHARD}" \
-    --exclude-tags=android-only \
-    --format junit \
-    --output "$MAIN_REPORT" || true
-fi
+    run_maestro_test "${FLOW_FILES[@]}" \
+      -e APP_ID="$APP_ID" \
+      --exclude-tags=util \
+      --include-tags="test-${SHARD}" \
+      --exclude-tags=ios-only \
+      --format junit \
+      --output "$MAIN_REPORT"
+  else
+    run_maestro_test "${FLOW_FILES[@]}" \
+      -e APP_ID="$APP_ID" \
+      --exclude-tags=util \
+      --include-tags="test-${SHARD}" \
+      --exclude-tags=android-only \
+      --format junit \
+      --output "$MAIN_REPORT"
+  fi
+}
+
+run_main_suite
 
+# No JUnit output = startup failure; go red for a human re-run instead of
+# auto-retrying, which would hide real startup breakage.
 if [ ! -f "$MAIN_REPORT" ]; then
-  echo "Main report not found"
+  echo "::error title=Maestro session produced no report::The Maestro run produced no JUnit output (session/driver-startup failure or a timeout — see the annotation above). Re-run the failed job if this looks transient."
   exit 1
 fi
 
@@ -147,21 +193,21 @@ while [ ${#CURRENT_FAILS[@]} -gt 0 ] && [ "$ROUND" -le "$MAX_RERUN_ROUNDS" ]; do
   RPT="${RERUN_REPORT_PREFIX}-round-${ROUND}.xml"
 
   if [ "$PLATFORM" = "android" ]; then
-    maestro test "${CURRENT_FAILS[@]}" \
+    run_maestro_test "${CURRENT_FAILS[@]}" \
       -e APP_ID="$APP_ID" \
       --exclude-tags=util \
       --include-tags="test-${SHARD}" \
       --exclude-tags=ios-only \
       --format junit \
-      --output "$RPT" || true
+      --output "$RPT"
   else
-    maestro test "${CURRENT_FAILS[@]}" \
+    run_maestro_test "${CURRENT_FAILS[@]}" \
       -e APP_ID="$APP_ID" \
       --exclude-tags=util \
       --include-tags="test-${SHARD}" \
       --exclude-tags=android-only \
       --format junit \
-      --output "$RPT" || true
+      --output "$RPT"
   fi
 
   if [ ! -f "$RPT" ]; then
@@ -209,4 +255,12 @@ done
 
 echo "Retry strategy finished with remaining failures:"
 printf '%s\n' "${CURRENT_FAILS[@]}"
+
+# The server can also blip after preflight; scan the local logs and annotate so
+# an environment failure doesn't read like an app bug.
+SERVER_ERR="$(grep -rhoE "Non-retryable error [0-9]{3}|Connection refused|Failed to connect|UnknownHostException|ConnectException|Read timed out" "$HOME/.maestro/tests/" 2>/dev/null | sort -u | head -5 | paste -sd '; ' - || true)"
+if [ -n "$SERVER_ERR" ]; then
+  echo "::error title=E2E server error during run::A test-setup REST call to ${E2E_SERVER:-the test server} failed mid-run (${SERVER_ERR}). The shard failure is likely a server/environment flake, not an app or test regression."
+fi
+
 exit 1

.github/workflows/build-develop.yml

@@ -40,3 +40,71 @@ jobs:
     secrets: inherit
     with:
       trigger: develop
+
+  # Single writer of the AVD + SDK caches: PR-written caches aren't visible to
+  # other PRs, so develop seeds them and the shards restore read-only.
+  seed-android-avd:
+    name: Seed Android AVD Cache
+    if: ${{ github.repository == 'RocketChat/Rocket.Chat.ReactNative' }}
+    runs-on: ubuntu-latest
+    env:
+      ANDROID_AVD_HOME: /home/runner/.android/avd
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Setup Java
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Cache Android AVD
+        id: avd-cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.android/avd/*
+            ~/.android/adb*
+          key: avd-${{ runner.os }}-api34
+
+      # The emulator + system image live outside ~/.android/avd — cache them
+      # separately so shards don't each re-download ~1 GB.
+      - name: Cache Android SDK packages (emulator + system image)
+        id: sdk-cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            /usr/local/lib/android/sdk/emulator
+            /usr/local/lib/android/sdk/system-images/android-34/google_apis/x86_64
+          key: android-sdk-emu-${{ runner.os }}-api34
+
+      # Retried install so a corrupt partial download self-heals
+      - name: Pre-install Android SDK packages (cache miss only)
+        if: steps.sdk-cache.outputs.cache-hit != 'true'
+        uses: ./.github/actions/preinstall-android-sdk
+
+      - name: Enable KVM group permissions
+        if: steps.avd-cache.outputs.cache-hit != 'true'
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+
+      - name: Generate AVD snapshot (cache miss only)
+        if: steps.avd-cache.outputs.cache-hit != 'true'
+        uses: reactivecircus/android-emulator-runner@e89f39f1abbbd05b1113a29cf4db69e7540cae5a # v2.37.0
+        timeout-minutes: 45
+        with:
+          api-level: 34
+          disk-size: 4096M
+          arch: x86_64
+          target: google_apis
+          profile: pixel_7_pro
+          cores: 4
+          ram-size: 6144M
+          force-avd-creation: true
+          disable-animations: true
+          emulator-boot-timeout: 900
+          emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none -accel on
+          script: echo "AVD snapshot generated for cache"

.github/workflows/build-pr.yml

@@ -52,15 +52,31 @@ jobs:
     needs: [e2e-hold]
     secrets: inherit
 
+  # Validates flow tags and emits the shard list both matrices fan out over.
+  e2e-shards:
+    name: E2E Shard Preflight
+    if: ${{ github.repository == 'RocketChat/Rocket.Chat.ReactNative' }}
+    needs: [e2e-hold]
+    runs-on: ubuntu-latest
+    outputs:
+      shards: ${{ steps.shards.outputs.shards }}
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Assert Maestro shard coverage
+        id: shards
+        run: bash .github/scripts/assert-maestro-shards.sh
+
   e2e-run-android:
     name: E2E Run Android
     if: ${{ github.repository == 'RocketChat/Rocket.Chat.ReactNative' }}
     uses: ./.github/workflows/maestro-android.yml
-    needs: [e2e-build-android]
+    needs: [e2e-build-android, e2e-shards]
     secrets: inherit
     strategy:
       matrix:
-        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14]
+        shard: ${{ fromJSON(needs.e2e-shards.outputs.shards) }}
       fail-fast: false
     with:
       shard: ${{ matrix.shard }}
@@ -76,11 +92,11 @@ jobs:
     name: E2E Run iOS
     if: ${{ github.repository == 'RocketChat/Rocket.Chat.ReactNative' }}
     uses: ./.github/workflows/maestro-ios.yml
-    needs: [e2e-build-ios]
+    needs: [e2e-build-ios, e2e-shards]
     secrets: inherit
     strategy:
       matrix:
-        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14]
+        shard: ${{ fromJSON(needs.e2e-shards.outputs.shards) }}
       fail-fast: false
     with:
       shard: ${{ matrix.shard }}