builds.yml

# Single source of truth for all build configurations
# Protected by CODEOWNERS: mobile-platform team
#
# Usage:
#   - CI reads this file to configure builds
#   - Local dev can override via .js.env (takes precedence)
#
# Structure:
#   - env: sets environment variables directly (servers, build config, etc.)
#   - secrets: maps env var names to GitHub Secret names
#   - signing: (optional) AWS role + secret for code signing (omit for dev/simulator builds)
#   - code_fencing: features to include via code fencing
#
# GitHub Environment determines actual secret values - builds.yml just maps the names.
# Signing: AWS Secrets Manager (Account 363762752069) - see Mobile Signer Roles & Secrets doc.

# =============================================================================
# YAML Anchors (reusable config blocks)
# =============================================================================

# Shared env (non-secret): servers + build flags. Production defaults.
# Each build merges <<: *public_envs and overrides only what differs (inline in that build).
_public_envs: &public_envs # Servers (production)
  MM_PORTFOLIO_URL: 'https://portfolio.api.cx.metamask.io'
  SECURITY_ALERTS_API_URL: 'https://security-alerts.api.cx.metamask.io'
  DECODING_API_URL: 'https://signature-insights.api.cx.metamask.io/v1'
  AUTH_SERVICE_URL: 'https://auth-service.api.cx.metamask.io'
  DIGEST_API_URL: 'https://digest.api.cx.metamask.io/api/v1'
  REWARDS_API_URL: 'https://rewards.api.cx.metamask.io'
  BAANX_API_URL: 'https://api.baanx.com'
  # Build flags (production defaults)
  RAMPS_ENVIRONMENT: 'production'
  RAMP_DEV_BUILD: 'false'
  BRIDGE_USE_DEV_APIS: 'false'
  RAMP_INTERNAL_BUILD: 'false'
  IS_TEST: 'false'
  SEEDLESS_ONBOARDING_ENABLED: 'true'
  MM_NOTIFICATIONS_UI_ENABLED: 'true'
  MM_PERMISSIONS_SETTINGS_V1_ENABLED: 'false'
  MM_PERPS_BLOCKED_REGIONS: 'US,CA-ON,GB,BE'
  MM_PERPS_HIP3_ALLOWLIST_MARKETS: ''
  MM_PERPS_HIP3_BLOCKLIST_MARKETS: ''
  MM_PERPS_HIP3_ENABLED: 'true'
  # Temporary flag to enable builds with GitHub Actions, remove it when deprecating bitrise
  BUILDS_ENABLED_WITH_GH_ACTIONS_TEMPORARY: 'true'
  MM_CHARTING_LIBRARY_URL: 'https://va-mmcx-terminal.s3.us-east-2.amazonaws.com/charting_library/'

# Common secrets (shared across ALL builds - same names, GitHub Environment determines values)
_secrets: &secrets # Infrastructure
  MM_SENTRY_AUTH_TOKEN: 'MM_SENTRY_AUTH_TOKEN'
  MM_SENTRY_DSN: 'MM_SENTRY_DSN'
  GOOGLE_SERVICES_B64_IOS: 'GOOGLE_SERVICES_B64_IOS'
  GOOGLE_SERVICES_B64_ANDROID: 'GOOGLE_SERVICES_B64_ANDROID'
  # API Keys
  MM_INFURA_PROJECT_ID: 'MM_INFURA_PROJECT_ID'
  WALLET_CONNECT_PROJECT_ID: 'WALLET_CONNECT_PROJECT_ID'
  MM_FOX_CODE: 'MM_FOX_CODE'
  MM_BRANCH_KEY_LIVE: 'MM_BRANCH_KEY_LIVE'
  MM_BRANCH_KEY_TEST: 'MM_BRANCH_KEY_TEST'
  # Analytics
  SEGMENT_WRITE_KEY: 'SEGMENT_WRITE_KEY'
  SEGMENT_PROXY_URL: 'SEGMENT_PROXY_URL'
  SEGMENT_DELETE_API_SOURCE_ID: 'SEGMENT_DELETE_API_SOURCE_ID'
  SEGMENT_REGULATIONS_ENDPOINT: 'SEGMENT_REGULATIONS_ENDPOINT'
  # Features/Announcements
  FEATURES_ANNOUNCEMENTS_ACCESS_TOKEN: 'FEATURES_ANNOUNCEMENTS_ACCESS_TOKEN'
  FEATURES_ANNOUNCEMENTS_SPACE_ID: 'FEATURES_ANNOUNCEMENTS_SPACE_ID'
  # Firebase
  FCM_CONFIG_API_KEY: 'FCM_CONFIG_API_KEY'
  FCM_CONFIG_AUTH_DOMAIN: 'FCM_CONFIG_AUTH_DOMAIN'
  FCM_CONFIG_STORAGE_BUCKET: 'FCM_CONFIG_STORAGE_BUCKET'
  FCM_CONFIG_PROJECT_ID: 'FCM_CONFIG_PROJECT_ID'
  FCM_CONFIG_MESSAGING_SENDER_ID: 'FCM_CONFIG_MESSAGING_SENDER_ID'
  FCM_CONFIG_APP_ID: 'FCM_CONFIG_APP_ID'
  FCM_CONFIG_MEASUREMENT_ID: 'FCM_CONFIG_MEASUREMENT_ID'
  # QuickNode
  QUICKNODE_MAINNET_URL: 'QUICKNODE_MAINNET_URL'
  QUICKNODE_ARBITRUM_URL: 'QUICKNODE_ARBITRUM_URL'
  QUICKNODE_AVALANCHE_URL: 'QUICKNODE_AVALANCHE_URL'
  QUICKNODE_BASE_URL: 'QUICKNODE_BASE_URL'
  QUICKNODE_LINEA_MAINNET_URL: 'QUICKNODE_LINEA_MAINNET_URL'
  QUICKNODE_MONAD_URL: 'QUICKNODE_MONAD_URL'
  QUICKNODE_OPTIMISM_URL: 'QUICKNODE_OPTIMISM_URL'
  QUICKNODE_POLYGON_URL: 'QUICKNODE_POLYGON_URL'
  QUICKNODE_HYPEREVM_URL: 'QUICKNODE_HYPEREVM_URL'
  # OAuth
  IOS_GOOGLE_CLIENT_ID: 'IOS_GOOGLE_CLIENT_ID'
  IOS_GOOGLE_REDIRECT_URI: 'IOS_GOOGLE_REDIRECT_URI'
  ANDROID_APPLE_CLIENT_ID: 'ANDROID_APPLE_CLIENT_ID'
  ANDROID_GOOGLE_CLIENT_ID: 'ANDROID_GOOGLE_CLIENT_ID'
  ANDROID_GOOGLE_SERVER_CLIENT_ID: 'ANDROID_GOOGLE_SERVER_CLIENT_ID'
  # Card/Baanx
  MM_CARD_BAANX_API_CLIENT_KEY: 'MM_CARD_BAANX_API_CLIENT_KEY'
  # Expo
  EXPO_PROJECT_ID: 'EXPO_PROJECT_ID'

# Signing config (AWS Secrets Manager) - omit for dev/simulator builds
# android_keystore_path: filename in android/keystores/ (build.gradle expects fixed paths)
# GH Environments vs AWS: build-production=prod signer; build-rc & build-beta=rc signer; build-uat/build-e2e/build-exp=uat signer; build-flask-prod=flask prod; build-flask-uat/build-flask-e2e=flask uat
_signing_prod: &signing_prod
  aws_role: 'arn:aws:iam::363762752069:role/metamask-mobile-prod-signer'
  aws_secret: 'metamask-mobile-main-prod-signer-v2'
  android_keystore_path: 'release.keystore'
_signing_rc: &signing_rc
  aws_role: 'arn:aws:iam::363762752069:role/metamask-mobile-rc-signer'
  aws_secret: 'metamask-mobile-main-rc-signer'
  android_keystore_path: 'rc.keystore'
_signing_uat: &signing_uat
  aws_role: 'arn:aws:iam::363762752069:role/metamask-mobile-uat-signer'
  aws_secret: 'metamask-mobile-main-uat-signer'
  android_keystore_path: 'internalRelease.keystore'
_signing_flask_prod: &signing_flask_prod
  aws_role: 'arn:aws:iam::363762752069:role/metamask-mobile-prod-signer'
  aws_secret: 'metamask-mobile-flask-prod-signer-v2'
  android_keystore_path: 'flaskRelease.keystore'
_signing_flask_uat: &signing_flask_uat
  aws_role: 'arn:aws:iam::363762752069:role/metamask-mobile-uat-signer'
  aws_secret: 'metamask-mobile-flask-uat-signer'
  android_keystore_path: 'flask-uat.keystore'

# Main code fencing features
_code_fencing_main: &code_fencing_main
  - preinstalled-snaps
  - keyring-snaps
  - multi-srp
  - solana
  - bitcoin
  - tron

# Beta code fencing features (main + beta feature)
_code_fencing_beta: &code_fencing_beta
  - beta
  - preinstalled-snaps
  - keyring-snaps
  - multi-srp
  - solana
  - bitcoin
  - tron

# Experimental code fencing features (main + experimental)
_code_fencing_experimental: &code_fencing_experimental
  - preinstalled-snaps
  - keyring-snaps
  - multi-srp
  - solana
  - bitcoin
  - tron
  - experimental

# Flask code fencing features (includes experimental)
_code_fencing_flask: &code_fencing_flask
  - flask
  - preinstalled-snaps
  - external-snaps
  - keyring-snaps
  - multi-srp
  - solana
  - bitcoin
  - tron

# =============================================================================
# Build Configurations
# =============================================================================
# Based on client distribution matrix - see docs for full mapping
# Environments: production, rc, test, e2e, exp, dev

builds:
  # ---------------------------------------------------------------------------
  # MAIN BUILDS
  # ---------------------------------------------------------------------------

  # Production release (App Store)
  main-prod:
    github_environment: build-production
    signing: *signing_prod
    env:
      <<: *public_envs
      METAMASK_ENVIRONMENT: 'production'
      METAMASK_BUILD_TYPE: 'main'
    secrets: *secrets
    code_fencing: *code_fencing_main

  # Beta (production APIs, RC signing; TestFlight / Play Store beta track)
  main-beta:
    github_environment: build-beta
    signing: *signing_rc
    env:
      <<: *public_envs
      METAMASK_ENVIRONMENT: 'beta'
      METAMASK_BUILD_TYPE: 'main'
    secrets: *secrets
    code_fencing: *code_fencing_beta

  # Release candidate
  main-rc:
    github_environment: build-rc
    signing: *signing_rc
    env:
      <<: *public_envs
      METAMASK_ENVIRONMENT: 'rc'
      METAMASK_BUILD_TYPE: 'main'
    secrets: *secrets
    code_fencing: *code_fencing_main

  # Test builds (QA)
  main-test:
    github_environment: build-uat
    signing: *signing_uat
    env:
      <<: *public_envs
      METAMASK_ENVIRONMENT: 'test'
      METAMASK_BUILD_TYPE: 'main'
      MM_PORTFOLIO_URL: 'https://portfolio.dev-api.cx.metamask.io'
      REWARDS_API_URL: 'https://rewards.uat-api.cx.metamask.io'
      BAANX_API_URL: 'https://dev.api.baanx.com'
      DIGEST_API_URL: 'https://digest.dev-api.cx.metamask.io/api/v1'
      BRIDGE_USE_DEV_APIS: 'true'
      RAMPS_ENVIRONMENT: 'staging'
      RAMP_DEV_BUILD: 'true'
      RAMP_INTERNAL_BUILD: 'true'
      IS_TEST: 'true'
      IGNORE_BOXLOGS_DEVELOPMENT: 'true'
      IS_SIM_BUILD: 'true'
    secrets: *secrets
    code_fencing: *code_fencing_main

  # E2E test builds (no Sentry)
  main-e2e:
    github_environment: build-e2e
    signing: *signing_uat
    env:
      <<: *public_envs
      METAMASK_ENVIRONMENT: 'e2e'
      METAMASK_BUILD_TYPE: 'main'
      MM_PORTFOLIO_URL: 'https://portfolio.dev-api.cx.metamask.io'
      REWARDS_API_URL: 'https://rewards.uat-api.cx.metamask.io'
      BAANX_API_URL: 'https://dev.api.baanx.com'
      DIGEST_API_URL: 'https://digest.dev-api.cx.metamask.io/api/v1'
      BRIDGE_USE_DEV_APIS: 'true'
      RAMPS_ENVIRONMENT: 'staging'
      RAMP_INTERNAL_BUILD: 'true'
      RAMP_DEV_BUILD: 'true'
      IS_TEST: 'true'
      IGNORE_BOXLOGS_DEVELOPMENT: 'true'
      IS_SIM_BUILD: 'true'
    secrets: *secrets
    code_fencing: *code_fencing_main

  # Experimental builds
  main-exp:
    github_environment: build-exp
    signing: *signing_uat
    env:
      <<: *public_envs
      METAMASK_ENVIRONMENT: 'exp'
      METAMASK_BUILD_TYPE: 'main'
      MM_PORTFOLIO_URL: 'https://portfolio.dev-api.cx.metamask.io'
      REWARDS_API_URL: 'https://rewards.uat-api.cx.metamask.io'
      BAANX_API_URL: 'https://dev.api.baanx.com'
      DIGEST_API_URL: 'https://digest.dev-api.cx.metamask.io/api/v1'
      BRIDGE_USE_DEV_APIS: 'true'
      RAMPS_ENVIRONMENT: 'staging'
      RAMP_INTERNAL_BUILD: 'true'
      RAMP_DEV_BUILD: 'true'
      IS_TEST: 'false'
      MM_ENABLE_SETTINGS_PAGE_DEV_OPTIONS: 'true'
    secrets: *secrets
    code_fencing: *code_fencing_experimental

  # Local development / Expo development build (Runway .app for simulator)
  main-dev:
    github_environment: build-exp
    env:
      <<: *public_envs
      METAMASK_ENVIRONMENT: 'dev'
      METAMASK_BUILD_TYPE: 'main'
      MM_PORTFOLIO_URL: 'https://portfolio.dev-api.cx.metamask.io'
      REWARDS_API_URL: 'https://rewards.uat-api.cx.metamask.io'
      BAANX_API_URL: 'https://dev.api.baanx.com'
      DIGEST_API_URL: 'https://digest.dev-api.cx.metamask.io/api/v1'
      BRIDGE_USE_DEV_APIS: 'true'
      RAMPS_ENVIRONMENT: 'staging'
      RAMP_INTERNAL_BUILD: 'true'
      RAMP_DEV_BUILD: 'true'
      IS_TEST: 'false'
      MM_ENABLE_SETTINGS_PAGE_DEV_OPTIONS: 'true'
      IS_SIM_BUILD: 'true'
      CONFIGURATION: 'Debug'
      DEV_OAUTH_CONFIG: 'true'
    secrets: *secrets
    code_fencing: *code_fencing_main

  # ---------------------------------------------------------------------------
  # FLASK BUILDS
  # ---------------------------------------------------------------------------

  # Flask production release
  flask-prod:
    github_environment: build-flask-prod
    signing: *signing_flask_prod
    env:
      <<: *public_envs
      METAMASK_ENVIRONMENT: 'production'
      METAMASK_BUILD_TYPE: 'flask'
    secrets: *secrets
    code_fencing: *code_fencing_flask

  # Flask test builds (QA)
  flask-test:
    github_environment: build-flask-uat
    signing: *signing_flask_uat
    env:
      <<: *public_envs
      METAMASK_ENVIRONMENT: 'test'
      METAMASK_BUILD_TYPE: 'flask'
      MM_PORTFOLIO_URL: 'https://portfolio.dev-api.cx.metamask.io'
      REWARDS_API_URL: 'https://rewards.uat-api.cx.metamask.io'
      BAANX_API_URL: 'https://dev.api.baanx.com'
      DIGEST_API_URL: 'https://digest.dev-api.cx.metamask.io/api/v1'
      BRIDGE_USE_DEV_APIS: 'true'
      RAMPS_ENVIRONMENT: 'staging'
      RAMP_INTERNAL_BUILD: 'true'
      RAMP_DEV_BUILD: 'true'
      IS_TEST: 'true'
      IGNORE_BOXLOGS_DEVELOPMENT: 'true'
      IS_SIM_BUILD: 'true'
    secrets: *secrets
    code_fencing: *code_fencing_flask

  # Flask E2E test builds (no Sentry)
  flask-e2e:
    github_environment: build-flask-e2e
    signing: *signing_flask_uat
    env:
      <<: *public_envs
      METAMASK_ENVIRONMENT: 'e2e'
      METAMASK_BUILD_TYPE: 'flask'
      MM_PORTFOLIO_URL: 'https://portfolio.dev-api.cx.metamask.io'
      REWARDS_API_URL: 'https://rewards.uat-api.cx.metamask.io'
      BAANX_API_URL: 'https://dev.api.baanx.com'
      DIGEST_API_URL: 'https://digest.dev-api.cx.metamask.io/api/v1'
      BRIDGE_USE_DEV_APIS: 'true'
      RAMPS_ENVIRONMENT: 'staging'
      RAMP_INTERNAL_BUILD: 'true'
      RAMP_DEV_BUILD: 'true'
      IS_TEST: 'true'
      IGNORE_BOXLOGS_DEVELOPMENT: 'true'
      IS_SIM_BUILD: 'true'
    secrets: *secrets
    code_fencing: *code_fencing_flask

  # Flask local development / Expo development build (Runway .app for simulator)
  flask-dev:
    github_environment: build-flask-uat
    env:
      <<: *public_envs
      METAMASK_ENVIRONMENT: 'dev'
      METAMASK_BUILD_TYPE: 'flask'
      MM_PORTFOLIO_URL: 'https://portfolio.dev-api.cx.metamask.io'
      REWARDS_API_URL: 'https://rewards.uat-api.cx.metamask.io'
      BAANX_API_URL: 'https://dev.api.baanx.com'
      DIGEST_API_URL: 'https://digest.dev-api.cx.metamask.io/api/v1'
      BRIDGE_USE_DEV_APIS: 'true'
      RAMPS_ENVIRONMENT: 'staging'
      RAMP_DEV_BUILD: 'true'
      RAMP_INTERNAL_BUILD: 'true'
      IS_TEST: 'false'
      MM_ENABLE_SETTINGS_PAGE_DEV_OPTIONS: 'true'
      IS_SIM_BUILD: 'true'
      CONFIGURATION: 'Debug'
      DEV_OAUTH_CONFIG: 'true'
    secrets: *secrets
    code_fencing: *code_fencing_flask

  # ─────────────────────────────────────────────────────────────────────────────
  # QA Builds (legacy - for internal testing)
  # ─────────────────────────────────────────────────────────────────────────────

  # QA production build
  qa-prod:
    github_environment: build-uat
    signing: *signing_uat
    env:
      <<: *public_envs
      METAMASK_ENVIRONMENT: 'production'
      METAMASK_BUILD_TYPE: 'qa'
    secrets:
      <<: *secrets
      # QA uses QA Segment project
      SEGMENT_WRITE_KEY: SEGMENT_WRITE_KEY_QA
      SEGMENT_PROXY_URL: SEGMENT_PROXY_URL_QA
      SEGMENT_DELETE_API_SOURCE_ID: SEGMENT_DELETE_API_SOURCE_ID_QA
      SEGMENT_REGULATIONS_ENDPOINT: SEGMENT_REGULATIONS_ENDPOINT_QA
      # QA uses UAT OAuth credentials
      IOS_GOOGLE_CLIENT_ID: MAIN_IOS_GOOGLE_CLIENT_ID_UAT
      IOS_GOOGLE_REDIRECT_URI: MAIN_IOS_GOOGLE_REDIRECT_URI_UAT
      ANDROID_GOOGLE_CLIENT_ID: MAIN_ANDROID_GOOGLE_CLIENT_ID_UAT
      ANDROID_APPLE_CLIENT_ID: MAIN_ANDROID_APPLE_CLIENT_ID_UAT
      ANDROID_GOOGLE_SERVER_CLIENT_ID: MAIN_ANDROID_GOOGLE_SERVER_CLIENT_ID_UAT
      MM_CARD_BAANX_API_CLIENT_KEY: MM_CARD_BAANX_API_CLIENT_KEY_UAT
    code_fencing: *code_fencing_main

  # QA dev build / Expo development build (Runway .app for simulator)
  qa-dev:
    github_environment: build-uat
    env:
      <<: *public_envs
      METAMASK_ENVIRONMENT: 'dev'
      METAMASK_BUILD_TYPE: 'qa'
      MM_PORTFOLIO_URL: 'https://portfolio.dev-api.cx.metamask.io'
      REWARDS_API_URL: 'https://rewards.uat-api.cx.metamask.io'
      BAANX_API_URL: 'https://dev.api.baanx.com'
      DIGEST_API_URL: 'https://digest.dev-api.cx.metamask.io/api/v1'
      BRIDGE_USE_DEV_APIS: 'true'
      RAMPS_ENVIRONMENT: 'staging'
      RAMP_INTERNAL_BUILD: 'true'
      RAMP_DEV_BUILD: 'true'
      IS_TEST: 'false'
      MM_ENABLE_SETTINGS_PAGE_DEV_OPTIONS: 'true'
      IS_SIM_BUILD: 'true'
      CONFIGURATION: 'Debug'
      DEV_OAUTH_CONFIG: 'true'
    secrets:
      <<: *secrets
      # QA uses QA Segment project
      SEGMENT_WRITE_KEY: SEGMENT_WRITE_KEY_QA
      SEGMENT_PROXY_URL: SEGMENT_PROXY_URL_QA
      SEGMENT_DELETE_API_SOURCE_ID: SEGMENT_DELETE_API_SOURCE_ID_QA
      SEGMENT_REGULATIONS_ENDPOINT: SEGMENT_REGULATIONS_ENDPOINT_QA
      # QA uses UAT OAuth credentials
      IOS_GOOGLE_CLIENT_ID: MAIN_IOS_GOOGLE_CLIENT_ID_UAT
      IOS_GOOGLE_REDIRECT_URI: MAIN_IOS_GOOGLE_REDIRECT_URI_UAT
      ANDROID_GOOGLE_CLIENT_ID: MAIN_ANDROID_GOOGLE_CLIENT_ID_UAT
      ANDROID_APPLE_CLIENT_ID: MAIN_ANDROID_APPLE_CLIENT_ID_UAT
      ANDROID_GOOGLE_SERVER_CLIENT_ID: MAIN_ANDROID_GOOGLE_SERVER_CLIENT_ID_UAT
      MM_CARD_BAANX_API_CLIENT_KEY: MM_CARD_BAANX_API_CLIENT_KEY_UAT
    code_fencing: *code_fencing_main