chore(e2e): add e2e tests on browserstack via Maestro by achou11 · Pull Request #56 · digidem/comapeo-core-react-native

achou11 · 2026-05-05T12:56:15Z

Closes #61

Introduces e2e test automation using Maestro, configured to run as part of CI.

Current workflow diagram (will update as needed):

graph LR
  build-android["Build (Android)\n[skip if draft PR]"]
  build-ios["Build (iOS)\n[skip if draft PR]"]
  upload-test-suite["Upload test suite\n[skip if draft PR]"]
  test-android["Run tests (Android)"]
  test-ios["Run tests (iOS)"]

  build-android -->|app_url| test-android
  build-ios -->|app_url| test-ios
  upload-test-suite -->|test_suite_url| test-android
  upload-test-suite -->|test_suite_url| test-ios

Relevant links:

CI/CD integration for Browserstack + Maestro: https://www.browserstack.com/docs/app-automate/maestro/ci-cd-integration
API reference for Browserstack + Maestro: https://www.browserstack.com/docs/app-automate/api-reference/maestro/overview
Supported devices for App Automate: https://www.browserstack.com/list-of-browsers-and-platforms/app_automate

TODO:

Add another job to the workflow to listen for and report test results
Update repo with relevant actions environment variables

still need to wait and poll test run statuses

Browserstack's Maestro support does not seem to support this command (https://www.browserstack.com/docs/app-automate/maestro/references/supported-commands)

gmaclennan

Just some minor bugs and nits. I'll push changes for these to re-run CI and check it all works.

gmaclennan · 2026-05-19T09:09:39Z

+          key: nodejs-mobile-${{ env.NODEJS_MOBILE_VERSION }}-ios-${{ hashFiles('scripts/download-nodejs-mobile.sh') }}
+
+      - name: Download nodejs-mobile binaries
+        if: steps.cache-libnode.outputs.cache-hit != 'true'


Wrong step id for iOS

gmaclennan · 2026-05-19T09:52:02Z

+    # TODO: Enable when we know this job works
+    # needs: [build-android, build-ios]


I think we need to re-enable this now?

Should we create a follow-up to address this? Mostly hygenic to prevent uploading test suites to browserstack when the jobs for building + uploading the apps fail

- Set jasmine.DEFAULT_TIMEOUT_INTERVAL to 60s — the 5s default was tripping the CRUD tests that fan out 100 IPC create()/delete() calls on slower BrowserStack devices. - Track every opened project in project-crud and close them in afterEach so listeners don't accumulate across tests (was producing MaxListenersExceededWarning on SocketMessagePort / LocalPeers and slowing later tests). - Add an `all-tests-done` testID alongside `all-tests-passed` / `all-tests-failed` so Maestro can fail fast on a failing run instead of waiting for the full timeout. - Bump Maestro `extendedWaitUntil` to 5 min and assert pass after done. - Log spec start / pass / fail (with stacks) via console.log so they appear under the ReactNativeJS tag in logcat / device logs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The root package.json `prepare` script (`expo-module prepare`, plus `scripts/check-sentry-cocoa-pin.mjs`) needs to run before the e2e app prebuilds, otherwise the module's native scaffolding isn't regenerated and the iOS Pods build fails to resolve `SentrySDK.startTransaction` through the `Sentry/HybridSDK` module. The `iOS Tests` workflow that builds `apps/example` runs `npm install` (no `--ignore-scripts`) and passes — match that. `patch-package` is already wired up as `postinstall` in both package.jsons, so the explicit `npx patch-package` calls are redundant once scripts run. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Seems like the older sodium-native (libsodium) was crashing Android v8.1

socket-security · 2026-06-10T12:54:34Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@comapeo/default-categories@1.0.1
	@types/tar-stream@3.1.4
	@opentelemetry/sdk-trace-node@2.7.1
	@comapeo/map-server@1.1.3
	@comapeo/ipc@8.0.0
	framed-stream@1.0.1
	polywasm@0.2.0
	@opentelemetry/instrumentation@0.207.0
	@opentelemetry/sdk-trace-base@2.7.1
	tiny-typed-emitter@2.1.0
	rollup-plugin-esbuild@6.2.1
	@sentry/node-core@10.53.1
	@sentry/core@10.53.1
	ensure-error@5.0.0
	@rollup/plugin-esm-shim@0.1.8
	@rollup/plugin-json@6.1.0
	@rollup/plugin-alias@6.0.0
	@rollup/plugin-node-resolve@16.0.3
	@opentelemetry/api@1.9.1
	magic-string@0.30.21
	tar-stream@3.1.8
	typescript@5.9.3
	@rollup/plugin-commonjs@29.0.2
	@opentelemetry/semantic-conventions@1.40.0
	@opentelemetry/core@2.7.1
	@sentry/rollup-plugin@5.2.1
	@sentry/react-native@7.13.0
	@sentry/opentelemetry@10.53.1
	rollup@4.60.2

View full report

socket-security · 2026-06-10T12:54:36Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@sentry-internal/feedback` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: apps/example/package-lock.json → `npm/@sentry/react-native@7.13.0` → `npm/@sentry-internal/feedback@10.38.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@sentry-internal/feedback@10.38.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@sentry/browser` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: apps/example/package-lock.json → `npm/@sentry/react-native@7.13.0` → `npm/@sentry/browser@10.38.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@sentry/browser@10.38.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@sentry/core` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: apps/example/package-lock.json → `npm/@sentry/react-native@7.13.0` → `npm/@sentry/core@10.38.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@sentry/core@10.38.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@sentry/core` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: backend/package-lock.json → `npm/@sentry/core@10.53.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@sentry/core@10.53.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `better-sqlite3` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: backend/package-lock.json → `npm/@comapeo/map-server@1.1.3` → `npm/better-sqlite3@12.9.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/better-sqlite3@12.9.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `caniuse-lite` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: backend/package-lock.json → `npm/@sentry/rollup-plugin@5.2.1` → `npm/caniuse-lite@1.0.30001792` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/caniuse-lite@1.0.30001792`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `caniuse-lite` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: backend/package-lock.json → `npm/@sentry/rollup-plugin@5.2.1` → `npm/caniuse-lite@1.0.30001792` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/caniuse-lite@1.0.30001792`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `caniuse-lite` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: backend/package-lock.json → `npm/@sentry/rollup-plugin@5.2.1` → `npm/caniuse-lite@1.0.30001792` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/caniuse-lite@1.0.30001792`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `caniuse-lite` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: backend/package-lock.json → `npm/@sentry/rollup-plugin@5.2.1` → `npm/caniuse-lite@1.0.30001792` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/caniuse-lite@1.0.30001792`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `caniuse-lite` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: backend/package-lock.json → `npm/@sentry/rollup-plugin@5.2.1` → `npm/caniuse-lite@1.0.30001792` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/caniuse-lite@1.0.30001792`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `typebox` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: backend/package-lock.json → `npm/@comapeo/map-server@1.1.3` → `npm/typebox@1.1.28` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typebox@1.1.28`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

… 26 compat

…or Xcode 26 compat" This reverts commit 8012789.

The Oppo Reno 6-11.0 is no longer supported by Browserstack

* origin/main: fix(sentry): make exit telemetry lossless and stop cross-process clobbering (#84) feat(sentry): land Phases 6 + 7a — Android exit reasons & iOS MetricKit app-exit telemetry (#72) chore(build): use npm list instead of custom traversal to get native module versions (#70)

…ules npm list --parseable --long appends flag fields (:OVERRIDDEN, :INVALID, ...) after name@version, so taking the last :-field read "OVERRIDDEN" for the override-pinned sodium-native@5.1.0. The module was silently dropped from prebuild download + jniLibs packaging while the bundled JS still referenced it, crashing every device with ERR_DLOPEN_FAILED: libsodium-native__5.1.0.so not found. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Xcode 26's Swift compiler hides SentrySDK.startTransaction (used by SentryNativeBridge) when sentry-cocoa builds from source without BUILD_LIBRARY_FOR_DISTRIBUTION (getsentry/sentry-cocoa#7950). Set it on Sentry pod targets from the library config plugin so every consumer's prebuild gets the workaround, injected inside the existing post_install block (CocoaPods allows only one post_install hook — the previous attempt added a second block, which fails pod install). Register the plugin in the e2e app, which didn't apply it before. Verified locally with Xcode 26.3: the exact CI archive command now succeeds, and the Release app boots on the iOS simulator. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The backend build reads the Node ABI from android/libnode headers on every platform. The iOS job only created them on a cache miss (the download script fetches both platforms); a cache hit restored just ios/NodeMobile.xcframework, so any rerun failed with ENOENT on node_version.h. Cache both paths and bump the key so ios-only caches can't hit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

gmaclennan

@achou11 this is now passing on CI - the failed tests on Browserstack revealed a bug / incompatibility with older Android version (<9) which is now fixed (needed to rebuild the native deps). I think this is good to merge, it's already proven its worth.

* main: chore(e2e): add e2e tests on browserstack via Maestro (#56) fix(sentry): make exit telemetry lossless and stop cross-process clobbering (#84)

achou11 added 13 commits May 7, 2026 10:01

introduce initial maestro flow

f9896f6

record test

4fa4528

update app id used in test

b4ea31b

rename maestro flow

b4ddadc

wip workflow

9ca36be

still need to wait and poll test run statuses

specify maestro version to use

bafab2b

remove stopRecording command

d38fb7a

Browserstack's Maestro support does not seem to support this command (https://www.browserstack.com/docs/app-automate/maestro/references/supported-commands)

simplify test jobs

ab12dde

allow test suite upload to happen immediately

2571dfa

minor cleanup

1135e42

fix test-android env

a8ffdcd

add polling for result step

afadca4

update secrets and vars names

eb5cf3c

achou11 force-pushed the e2e-maestro branch from c2a7589 to eb5cf3c Compare May 7, 2026 11:11

achou11 marked this pull request as ready for review May 7, 2026 11:26

achou11 changed the title ~~WIP: implement e2e testing with Maestro and Browserstack~~ implement e2e testing with Maestro and Browserstack May 7, 2026

achou11 added 14 commits May 7, 2026 12:31

fix missing npm install step for build-ios

ea4303c

fix e2e app setup step for build-ios

2ff9c2a

rename flow file

e8ab704

maybe fix -F curl usage

1762251

fix build-android

4c6bcd1

improve curl calls

e5fe3ff

fix upload step in build-ios

101e0ce

add commented out needs spec to upload-test-suite

6254152

rename zip file used for upload

3dbcd6c

curl fixes

93c6f61

fix caching of nodejs-mobile for ios

b01826b

minor fixup

0d72bc1

limit devices used due to browserstack plan limitations

44335e7

browserstack project adjustements

f9cebcf

achou11 and others added 6 commits May 7, 2026 15:44

update devices

fd2ee69

increase timeout for flow in CI

557529e

fix timeout interpolation

f9a6b47

stick with (larger) hardcoded timeout for now

4b7fe32

remove startRecording command

132f414

Merge branch 'main' into e2e-maestro

d8c6387

gmaclennan reviewed May 19, 2026

View reviewed changes

gmaclennan and others added 4 commits May 19, 2026 10:58

stop browserstack build/tests on workflow cancel

f4d47e8

fix cache step ID

8545120

Copilot started work on behalf of gmaclennan June 10, 2026 12:43 View session

fix: fix Android 8.1 crash by overriding sodium-native v5

d532088

Seems like the older sodium-native (libsodium) was crashing Android v8.1

fix(e2e): add BUILD_LIBRARY_FOR_DISTRIBUTION to Sentry pods for Xcode…

8012789

… 26 compat

Copilot AI changed the title ~~implement e2e testing with Maestro and Browserstack~~ fix(e2e/ios): add BUILD_LIBRARY_FOR_DISTRIBUTION to Sentry pods for Xcode 26 compatibility Jun 10, 2026

Copilot finished work on behalf of gmaclennan June 10, 2026 13:13

Copilot AI requested a review from gmaclennan June 10, 2026 13:13

gmaclennan and others added 5 commits June 10, 2026 16:10

Revert "fix(e2e): add BUILD_LIBRARY_FOR_DISTRIBUTION to Sentry pods f…

8155aa2

…or Xcode 26 compat" This reverts commit 8012789.

fix: remove Oppo device from e2e tests

92618bf

The Oppo Reno 6-11.0 is no longer supported by Browserstack

gmaclennan changed the title ~~fix(e2e/ios): add BUILD_LIBRARY_FOR_DISTRIBUTION to Sentry pods for Xcode 26 compatibility~~ chore(e2e): add e2e tests on browserstack via Maestro Jun 10, 2026

gmaclennan approved these changes Jun 11, 2026

View reviewed changes

gmaclennan merged commit a5b6c09 into main Jun 11, 2026
12 checks passed

gmaclennan deleted the e2e-maestro branch June 11, 2026 11:29

gmaclennan added a commit that referenced this pull request Jun 11, 2026

Merge branch 'main' into sentry-sdk-v8-metrics

c551678

* main: chore(e2e): add e2e tests on browserstack via Maestro (#56) fix(sentry): make exit telemetry lossless and stop cross-process clobbering (#84)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(e2e): add e2e tests on browserstack via Maestro#56

chore(e2e): add e2e tests on browserstack via Maestro#56
gmaclennan merged 47 commits into
mainfrom
e2e-maestro

achou11 commented May 5, 2026 •

edited by gmaclennan

Loading

Uh oh!

gmaclennan left a comment

Uh oh!

gmaclennan May 19, 2026

Uh oh!

Uh oh!

gmaclennan May 19, 2026

Uh oh!

achou11 Jun 11, 2026

Uh oh!

gmaclennan Jun 11, 2026

Uh oh!

socket-security Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

gmaclennan left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		# TODO: Enable when we know this job works
		# needs: [build-android, build-ios]

Conversation

achou11 commented May 5, 2026 • edited by gmaclennan Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gmaclennan left a comment

Choose a reason for hiding this comment

Uh oh!

gmaclennan May 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gmaclennan May 19, 2026

Choose a reason for hiding this comment

Uh oh!

achou11 Jun 11, 2026

Choose a reason for hiding this comment

Uh oh!

gmaclennan Jun 11, 2026

Choose a reason for hiding this comment

Uh oh!

socket-security Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gmaclennan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

achou11 commented May 5, 2026 •

edited by gmaclennan

Loading

socket-security Bot commented Jun 10, 2026 •

edited

Loading

socket-security Bot commented Jun 10, 2026 •

edited

Loading