MetaMask · Mrtenz · Nov 20, 2025
diff --git a/.github/actions/add-item-to-project/action.yml b/.github/actions/add-item-to-project/action.yml
@@ -0,0 +1,48 @@
+name: 'Add Issue/PR to Project By Team'
+
+inputs:
+  project-url:
+    description: 'URL of the GitHub Project where items should be added.'
+    required: true
+  team-name:
+    description: 'Team name to match for PR review_requested or requested_team.'
+    required: true
+  team-label:
+    description: 'Label that indicates the Issue/PR belongs to the team.'
+    required: true
+  filter-enabled:
+    description: 'If true, only add items that match the team criteria. If false, add every item.'
+    required: false
+    default: 'true'
+  github-token:
+    description: 'GitHub token with access to the project.'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Add item to project board
+      uses: actions/add-to-project@v1.0.2
+      # If filtering is disabled, the condition is always true.
+      # If filtering is enabled, then:
+      #   - For PRs, check that the PR either has the specified team in requested_team
+      #     or contains the team label.
+      #   - For Issues, check that the issue contains the team label.
+      if: |
+        inputs.filter-enabled != 'true' ||
+        ((github.event_name == 'pull_request' &&
+          (
+            github.event.requested_team.name == inputs.team-name ||
+            contains(github.event.pull_request.labels.*.name, inputs.team-label) ||
+            contains(github.event.pull_request.requested_teams.*.name, inputs.team-name)
+          )
+        )
+        ||
+        (github.event_name == 'issues' &&
+          (
+            contains(github.event.issue.labels.*.name, inputs.team-label)
+          )
+        ))
+      with:
+        project-url: ${{ inputs.project-url }}
+        github-token: ${{ inputs.github-token }}
diff --git a/.github/actions/add-team-label/action.yml b/.github/actions/add-team-label/action.yml
@@ -0,0 +1,37 @@
+name: Add Team Label
+description: "Adds a GitHub team label to a pull request based on the author's entry in the MetaMask topology file."
+
+inputs:
+  team-label-token:
+    description: 'GitHub token with access to read topology.json and add labels to PRs.'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    # Fetch the team label for the PR author from topology.json and expose it as a step output.
+    - name: Get team label
+      id: get-team-label
+      env:
+        GH_TOKEN: ${{ inputs.team-label-token }}
+        USER: ${{ github.event.pull_request.user.login }}
+      shell: bash
+      run: |
+        # Stream topology.json through jq, find the first team where USER appears in members, pm, em, or tl, and emit
+        # its githubLabel.name value.
+        team_label=$(gh api -H 'Accept: application/vnd.github.raw' 'repos/metamask/metamask-planning/contents/topology.json' | jq -r --arg USER "$USER" '.[] | select(any(.members[]?; . == $USER) or (.pm // empty) == $USER or (.em // empty) == $USER or (.tl // empty) == $USER) | .githubLabel.name' | head -n 1)
+        if [ -z "$team_label" ]; then
+          echo "::error::Team label not found for author: $USER. Please open a pull request with your GitHub handle and team label to update topology.json at https://github.com/MetaMask/MetaMask-planning/blob/main/topology.json"
+          exit 1
+        fi
+        echo "TEAM_LABEL=$team_label" >> "$GITHUB_OUTPUT"
+
+    # Apply the retrieved label to the pull request using the GitHub CLI.
+    - name: Add team label
+      env:
+        GH_TOKEN: ${{ secrets.TEAM_LABEL_TOKEN }}
+        PULL_REQUEST_URL: ${{ github.event.pull_request.html_url }}
+        TEAM_LABEL: ${{ steps.get-team-label.outputs.TEAM_LABEL }}
+      shell: bash
+      run: |
+        gh issue edit "$PULL_REQUEST_URL" --add-label "$TEAM_LABEL"
diff --git a/.github/actions/create-release-pr/action.yml b/.github/actions/create-release-pr/action.yml
@@ -0,0 +1,158 @@
+name: Create Release Pull Request
+
+inputs:
+  checkout-base-branch:
+    required: true
+    description: 'The base branch, tag, or SHA for git operations.'
+  release-pr-base-branch:
+    required: true
+    description: 'The base branch, tag, or SHA for the release pull request.'
+  semver-version:
+    required: true
+    description: 'A semantic version, e.g.: "x.y.z".'
+  mobile-build-version:
+    required: false
+    description: 'The build version for the mobile platform.'
+  previous-version-ref:
+    required: true
+    description: 'Previous release version branch name, tag or commit hash (e.g., release/7.7.0, v7.7.0, or 76fbc500034db9779e9ff7ce637ac5be1da0493d). For hotfix releases, pass the literal string "null".'
+  mobile-template-sheet-id:
+    required: false
+    description: 'The Mobile testing sheet template id.'
+    default: '1012668681' # prod sheet template
+  extension-template-sheet-id:
+    required: false
+    description: 'The Extension testing sheet template id.'
+    default: '295804563' # prod sheet template
+  test-only:
+    required: false
+    description: 'If true, the release will be marked as a test release.'
+    default: 'false'
+  release-sheet-google-document-id:
+    required: false
+    description: 'The Google Document ID for the release notes.'
+    default: '1tsoodlAlyvEUpkkcNcbZ4PM9HuC9cEM80RZeoVv5OCQ' # Prod Release Document
+  platform:
+    required: true
+    description: 'The platform for which the release PR is being created. Must be one of: mobile, extension.'
+  git-user-name:
+    description: 'Git user name for commits. Defaults to metamaskbot.'
+    default: 'metamaskbot'
+  git-user-email:
+    description: 'Git user email for commits. Defaults to metamaskbot@users.noreply.github.com.'
+    default: 'metamaskbot@users.noreply.github.com'
+  github-token:
+    description: 'GitHub token used for authentication.'
+    required: true
+  google-application-creds-base64:
+    description: 'Google application credentials base64 encoded.'
+    required: true
+  github-tools-repository:
+    description: 'The GitHub repository containing the GitHub tools. Defaults to the GitHub tools action repositor, and usually does not need to be changed.'
+    required: false
+    default: ${{ github.action_repository }}
+  github-tools-ref:
+    description: 'The SHA of the action to use. Defaults to the current action ref, and usually does not need to be changed.'
+    required: false
+    default: ${{ github.action_ref }}
+
+runs:
+  using: composite
+  steps:
+    # Step 1: Checkout invoking repository (metamask-mobile | metamask-extension )
+    - name: Checkout invoking repository
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+        ref: ${{ inputs.checkout-base-branch }}
+        token: ${{ inputs.github-token }}
+
+    # Step 2: Checkout github-tools repository
+    - name: Checkout github-tools repository
+      uses: actions/checkout@v4
+      with:
+        repository: ${{ inputs.github-tools-repository }}
+        ref: ${{ inputs.github-tools-ref }}
+        path: github-tools
+
+    # Step 3: Setup environment
+    - name: Checkout and setup environment
+      uses: MetaMask/action-checkout-and-setup@v2
+      with:
+        is-high-risk-environment: true
+
+    # Step 4: Print Input Values
+    - name: Print Input Values
+      env:
+        PLATFORM: ${{ inputs.platform }}
+        CHECKOUT_BASE_BRANCH: ${{ inputs.checkout-base-branch }}
+        RELEASE_PR_BASE_BRANCH: ${{ inputs.release-pr-base-branch }}
+        SEMVER_VERSION: ${{ inputs.semver-version }}
+        PREVIOUS_VERSION_REF: ${{ inputs.previous-version-ref }}
+        TEST_ONLY: ${{ inputs.test-only }}
+        MOBILE_BUILD_VERSION: ${{ inputs.mobile-build-version }}
+        MOBILE_TEMPLATE_SHEET_ID: ${{ inputs.mobile-template-sheet-id }}
+        EXTENSION_TEMPLATE_SHEET_ID: ${{ inputs.extension-template-sheet-id }}
+        RELEASE_SHEET_GOOGLE_DOCUMENT_ID: ${{ inputs.release-sheet-google-document-id }}
+        GIT_USER_NAME: ${{ inputs.git-user-name }}
+        GIT_USER_EMAIL: ${{ inputs.git-user-email }}
+      shell: bash
+      run: |
+        echo "Input Values:"
+        echo "-------------"
+        echo "Platform: $PLATFORM"
+        echo "Checkout Base Branch: $CHECKOUT_BASE_BRANCH"
+        echo "Release PR Base Branch: $RELEASE_PR_BASE_BRANCH"
+        echo "Semver Version: $SEMVER_VERSION"
+        echo "Previous Version Reference: $PREVIOUS_VERSION_REF"
+        echo "Test Only Mode: $TEST_ONLY"
+        if [[ "$PLATFORM" == "mobile" ]]; then
+          echo "Mobile Build Version: $MOBILE_BUILD_VERSION"
+        fi
+        echo "Mobile Template Sheet ID: $MOBILE_TEMPLATE_SHEET_ID"
+        echo "Extension Template Sheet ID: $EXTENSION_TEMPLATE_SHEET_ID"
+        echo "Release Sheet Google Document ID: $RELEASE_SHEET_GOOGLE_DOCUMENT_ID"
+        echo "Git User Name: $GIT_USER_NAME"
+        echo "Git User Email: $GIT_USER_EMAIL"
+        echo "-------------"
+
+    # Step 5: Create Release PR
+    - name: Create Release PR
+      id: create-release-pr
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+        BASE_BRANCH: ${{ inputs.release-pr-base-branch }}
+        GITHUB_REPOSITORY_URL: '${{ github.server_url }}/${{ github.repository }}'
+        TEST_ONLY: ${{ inputs.test-only }}
+        GOOGLE_DOCUMENT_ID: ${{ inputs.release-sheet-google-document-id }}
+        GOOGLE_APPLICATION_CREDENTIALS_BASE64: ${{ secrets.google-application-creds-base64 }}
+        NEW_VERSION: ${{ inputs.semver-version }}
+        MOBILE_TEMPLATE_SHEET_ID: ${{ inputs.mobile-template-sheet-id }}
+        EXTENSION_TEMPLATE_SHEET_ID: ${{ inputs.extension-template-sheet-id }}
+        PLATFORM: ${{ inputs.platform }}
+        PREVIOUS_VERSION_REF: ${{ inputs.previous-version-ref }}
+        SEMVER_VERSION: ${{ inputs.semver-version }}
+        MOBILE_BUILD_VERSION: ${{ inputs.mobile-build-version }}
+        GIT_USER_NAME: ${{ inputs.git-user-name }}
+        GIT_USER_EMAIL: ${{ inputs.git-user-email }}
+      working-directory: ${{ github.workspace }}
+      run: |
+        # Execute the script from github-tools
+        ./github-tools/.github/scripts/create-platform-release-pr.sh \
+          "$PLATFORM" \
+          "$PREVIOUS_VERSION_REF" \
+          "$SEMVER_VERSION" \
+          "$MOBILE_BUILD_VERSION" \
+          "$GIT_USER_NAME" \
+          "$GIT_USER_EMAIL"
+
+    # Step 6: Upload commits.csv as artifact (if generated)
+    - name: Upload commits.csv artifact
+      if: ${{ hashFiles('commits.csv') != '' }}
+      uses: actions/upload-artifact@v4
+      with:
+        name: commits-csv
+        path: commits.csv
+        if-no-files-found: error
+
diff --git a/.github/actions/flaky-test-report/action.yml b/.github/actions/flaky-test-report/action.yml
@@ -0,0 +1,51 @@
+name: Flaky Test Report
+
+inputs:
+  repository:
+    description: 'Repository name (e.g. metamask-extension)'
+    required: true
+  workflow_id:
+    description: 'Workflow ID to analyze (e.g. main.yml)'
+    required: true
+  github-token:
+    description: 'GitHub token with repo and actions:read access'
+    required: true
+  slack-webhook-flaky-tests:
+    description: 'Slack webhook URL for flaky test reports'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Checkout github-tools repository
+      uses: actions/checkout@v4
+      with:
+        repository: MetaMask/github-tools
+        path: github-tools
+
+    - name: Set up Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version-file: ./github-tools/.nvmrc
+        cache-dependency-path: ./github-tools/yarn.lock
+        cache: yarn
+
+    - name: Enable Corepack
+      working-directory: ./github-tools
+      shell: bash
+      run: corepack enable
+
+    - name: Install dependencies
+      working-directory: ./github-tools
+      shell: bash
+      run: yarn --immutable
+
+    - name: Run flaky test report script
+      env:
+        REPOSITORY: ${{ inputs.repository }}
+        WORKFLOW_ID: ${{ inputs.workflow_id }}
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+        SLACK_WEBHOOK_FLAKY_TESTS: ${{ inputs.slack-webhook-flaky-tests }}
+      working-directory: ./github-tools
+      shell: bash
+      run: node .github/scripts/create-flaky-test-report.mjs
diff --git a/.github/actions/get-release-timelines/action.yml b/.github/actions/get-release-timelines/action.yml
@@ -0,0 +1,50 @@
+name: Get Release Timelines
+
+inputs:
+  version:
+    required: true
+    description: The version of the release.
+  github-token:
+    required: true
+    description: The GitHub token used for authentication.
+  runway-app-id:
+    required: true
+    description: The Runway application ID.
+  runway-api-key:
+    required: true
+    description: The Runway API key.
+  github-tools-repository:
+    description: 'The GitHub repository containing the GitHub tools. Defaults to the GitHub tools action repositor, and usually does not need to be changed.'
+    required: false
+    default: ${{ github.action_repository }}
+  github-tools-ref:
+    description: 'The SHA of the action to use. Defaults to the current action ref, and usually does not need to be changed.'
+    required: false
+    default: ${{ github.action_ref }}
+
+runs:
+  using: composite
+  steps:
+    - name: Checkout GitHub tools repository
+      uses: actions/checkout@v5
+      with:
+        repository: ${{ inputs.github-tools-repository }}
+        ref: ${{ inputs.github-tools-ref }}
+        path: ./github-tools
+
+    - name: Get release timelines
+      env:
+        OWNER: ${{ github.repository_owner }}
+        REPOSITORY: ${{ github.event.repository.name }}
+        VERSION: ${{ inputs.version }}
+        RUNWAY_APP_ID: ${{ inputs.runway-app-id }}
+        RUNWAY_API_KEY: ${{ inputs.runway-api-key }}
+        GH_TOKEN: ${{ inputs.github-token }}
+      shell: bash
+      run: ./github-tools/.github/scripts/get-release-timelines.sh
+
+    - name: Upload artifact release-timelines-${{ inputs.version }}.csv
+      uses: actions/upload-artifact@v4
+      with:
+        name: release-timelines-${{ inputs.version }}.csv
+        path: release-timelines-${{ inputs.version }}.csv