ci: add fast and full PR validation lanes

[Shahroz16]

Summary

• keep representative unsigned Android and iOS Release sample builds on routine PRs
• move FCM redundancy, signed distribution, and scene E2E to ci:full
• remove duplicate feature-branch push runs while preserving main and release callers
• isolate unrelated label events so they cannot cancel a requested full run

Validation

• TypeScript, 3 Jest suites / 17 tests, and npm pack --dry-run passed
• Android assembleRelease passed, including release bundling, R8, lint-vital, and packaging
• iOS unsigned Release simulator build passed across the 128-target CocoaPods graph
• changed workflow YAML passes differential Actionlint validation
• no release workflow changed

[github-actions]

Sample app builds 📱

Below you will find the list of the latest versions of the sample apps. It's recommended to always download the latest builds of the sample apps to accurately test the pull request.

---

Builds are in progress. This comment will be updated when they finish.

• iOS FCM: 649.15.0 (29804992)

[Shahroz16]

Revised CI decision after correctness review

Exact head: a6c1c2c

The review feedback was correct: semantic-release intent is not a correctness boundary. A chore:, ci:, or dependency PR can break native compilation, public API, CocoaPods, Gradle, or scene routing. This head keeps those checks automatic.

• Every code PR verifies Android APN and iOS APN sample consumers.
• iOS, native, package, script, and workflow integration paths automatically add the iOS FCM consumer.
• The deep-link acknowledgement state test moved into the automatic APN verification job, so it is not hidden behind end-to-end gating.
• ci:full gates the full Xcode scene-routing end-to-end suite. Scheduled and manual entry points remain.
• PR title and commit semantics control only signed sample distribution side effects.
• Stable SDK release behavior is unchanged.

This CI-changing PR intentionally exercised APN iOS, APN Android, and FCM iOS with no ci:full label. Final hosted result: 12 successful, 3 intentional skips, 1 neutral, 0 failures. The full scene E2E skipped as designed.

The FCM verification job consumed 27m49s of Mac runner time on this final run. A routine JavaScript-only PR keeps APN verification but avoids that FCM job; native and integration-sensitive changes still run it automatically.

Claude Code Opus rejected the earlier semantic lane split, then returned APPROVE after the path-based redesign. Local lint, the focused Swift state test, actionlint, and the final hosted head all passed.

[mrehan27]

Cross-repo review — the same change across five repos.

The lane gating looks right: omitting always() so a skipped prepare transitively blocks E2E, and moving the dependabot guard to github.event.pull_request.user.login (on a labeled event github.actor is the labeler, not the author).

Main ask: the release-policy script and reusable workflow are byte-identical in all five repos today (sha256 match), so extracting them to mobile-ci-tools is free now and a five-repo change after merge.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 78264a4. Configure here.}

[mahmoud-elmorabea]

• verify_build has never executed in CI. The commit scan keeps forcing the distribution lane, so the new unsigned step is still unproven — specifically -workspace ios/SampleApp.xcworkspace -scheme SampleApp and ./android/gradlew -p android :app:assembleRelease. SampleApp.xcodeproj is generated and has gone stale before. Please get one run of this path green before merge.
• setup-ios/v1 still runs unconditionally, ahead of a CODE_SIGNING_ALLOWED=NO build. It performs fastlane match and needs GOOGLE_CLOUD_MATCH_READONLY_SERVICE_ACCOUNT_B64. Gating it on should_distribute saves time on every routine PR and makes the lane fork-safe.
• Scene-E2E path list widened from a precise ~25-entry list to .maestro/**, src/**, ios/wrappers/**. That is a much larger trigger surface on the xcode-27 pool — confirm it is intended.
• build-sample-apps has no fork/dependabot guard (always() && needs.prepare.result == 'success'), unlike the sibling jobs. Pre-existing, but prepare is the natural place to add it.

[Shahroz16]

Addressed the actionable review feedback in d88be54.\n\n- Added an explicit manual unsigned verification lane, with unsigned as the safe default.\n- Isolated manual verification concurrency from signed branch distribution, so verification cannot cancel or delay a release-side run.\n- Derived the unsigned three-app matrix from the distribution matrix to prevent drift.\n- Kept fork and Dependabot builds intentionally active through the unsigned matrix. Only signing and distribution are restricted.\n- Kept setup-ios for unsigned iOS builds because the current action only selects Xcode; it does not run match or consume signing credentials.\n- The scene-routing selector at the current head uses the precise direct-path list, not broad src/** or ios/wrappers/** triggers.\n\nHosted proof: the manual unsigned run passed for iOS APN, iOS FCM, and Android APN. All Fastlane distribution and PR-comment side-effect steps were skipped.