release: 13.9.0

.github/scripts/benchmark-stats-commit.sh

@@ -9,13 +9,13 @@ if [[ -z "${EXTENSION_BENCHMARK_STATS_TOKEN:-}" ]]; then
     exit 1
 fi
 
-if [[ -z "${GITHUB_SHA:-}" ]]; then
-    printf '%s\n' 'GITHUB_SHA environment variable must be set'
+if [[ -z "${HEAD_COMMIT_HASH:-}" ]]; then
+    printf '%s\n' 'HEAD_COMMIT_HASH environment variable must be set'
     exit 1
 fi
 
-if [[ -z "${GITHUB_REPOSITORY_OWNER:-}" ]]; then
-    printf '%s\n' 'GITHUB_REPOSITORY_OWNER environment variable must be set'
+if [[ -z "${OWNER:-}" ]]; then
+    printf '%s\n' 'OWNER environment variable must be set'
     exit 1
 fi
 
@@ -33,7 +33,7 @@ git fetch origin main:main
 
 git checkout main
 
-BENCHMARK_FILE="../test-artifacts/benchmarks/benchmark-results.json"
+BENCHMARK_FILE="../test-artifacts/benchmarks/page-load-benchmark-results.json"
 STATS_FILE="stats/page_load_data.json"
 TEMP_FILE="stats/page_load_data.temp.json"
 
@@ -53,13 +53,13 @@ jq . "${BENCHMARK_FILE}" > /dev/null || {
 }
 
 # Check if the SHA already exists in the stats file
-if jq -e "has(\"${GITHUB_SHA}\")" "${STATS_FILE}" > /dev/null; then
-    echo "SHA ${GITHUB_SHA} already exists in stats file. No new commit needed."
+if jq -e "has(\"${HEAD_COMMIT_HASH}\")" "${STATS_FILE}" > /dev/null; then
+    echo "SHA ${HEAD_COMMIT_HASH} already exists in stats file. No new commit needed."
     exit 0
 fi
 
 # Append new benchmark data correctly using jq
-jq --arg sha "${GITHUB_SHA}" --argjson data "$(cat "${BENCHMARK_FILE}")" \
+jq --arg sha "${HEAD_COMMIT_HASH}" --argjson data "$(cat "${BENCHMARK_FILE}")" \
     '. + {($sha): $data}' "${STATS_FILE}" > "${TEMP_FILE}"
 
 # Overwrite the original JSON file with the corrected version
@@ -68,9 +68,9 @@ mv "${TEMP_FILE}" "${STATS_FILE}"
 # Only add the JSON file
 git add stats/page_load_data.json
 
-git commit --message "Adding page load benchmark data at commit: ${GITHUB_SHA}"
+git commit --message "Adding page load benchmark data at commit: ${HEAD_COMMIT_HASH}"
 
-repo_slug="${GITHUB_REPOSITORY_OWNER}/extension_benchmark_stats"
+repo_slug="${OWNER}/extension_benchmark_stats"
 
 git push "https://metamaskbot:${EXTENSION_BENCHMARK_STATS_TOKEN}@github.com/${repo_slug}" main
 

.github/workflows/create-release-pr.yml

@@ -76,14 +76,14 @@ jobs:
   create-release-pr:
     needs: [resolve-bases, resolve-previous-ref]
     name: Create Release Pull Request using Github Tools
-    uses: MetaMask/github-tools/.github/workflows/create-release-pr.yml@7fe185fdb0e60981c898e88d82e44ff33f604daa
+    uses: MetaMask/github-tools/.github/workflows/create-release-pr.yml@6a04e4d0c8c25680a7543cfcd2e2fb7125b6759c
     with:
       platform: extension
       checkout-base-branch: ${{ needs.resolve-bases.outputs.checkout_base }}
       release-pr-base-branch: ${{ needs.resolve-bases.outputs.release_base }}
       semver-version: ${{ inputs.semver-version }}
       previous-version-ref: ${{ needs.resolve-previous-ref.outputs.previous_ref }}
-      github-tools-version: 7fe185fdb0e60981c898e88d82e44ff33f604daa
+      github-tools-version: 6a04e4d0c8c25680a7543cfcd2e2fb7125b6759c
     secrets:
       # This token needs write permissions to metamask-extension & read permissions to metamask-planning
       # If called from auto-create-release-pr use the PR_TOKEN passed in as an input, if called manually use github secret token values

.github/workflows/main.yml

@@ -22,7 +22,7 @@ on:
     - cron: '0 2-6 * * *'
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.sha || github.ref }}
   cancel-in-progress: ${{ !(contains(github.ref, 'refs/heads/main') || contains(github.ref, 'refs/heads/stable')) }}
 
 env:
@@ -241,22 +241,15 @@ jobs:
           s3-bucket: ${{ vars.AWS_S3_BUCKET }}/${{ github.event.repository.name }}/${{ github.run_id }}/bundle-size
           path: test-artifacts/chrome
 
-  page-load-benchmark-pr:
+  page-load-benchmark:
     needs:
       - build-test-browserify
-    if: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref_name == 'main') }}
-    uses: ./.github/workflows/page-load-benchmark-pr.yml
-    with:
-      browser-loads: '10'
-      page-loads: '10'
-
-  page-load-benchmark-upload:
-    needs:
-      - page-load-benchmark-pr
-    if: github.ref == 'refs/heads/main'
-    uses: ./.github/workflows/page-load-benchmark-upload.yml
+    uses: ./.github/workflows/page-load-benchmark.yml
     secrets:
       EXTENSION_BENCHMARK_STATS_TOKEN: ${{ secrets.EXTENSION_BENCHMARK_STATS_TOKEN }}
+    with:
+      browser-loads: 10
+      page-loads: 10
 
   needs-e2e:
     needs:
@@ -419,6 +412,7 @@ jobs:
       - build-test-flask-browserify
       - build-test-flask-mv2-browserify
       - run-benchmarks
+      - page-load-benchmark
       - bundle-size
       - build-storybook
       - build-ts-migration-dashboard

.github/workflows/page-load-benchmark-pr.yml → .github/workflows/page-load-benchmark.yml

@@ -6,13 +6,16 @@ on:
       browser-loads:
         description: 'Number of browser loads to perform'
         required: false
-        type: string
-        default: '10'
+        type: number
+        default: 10
       page-loads:
         description: 'Number of page loads per browser'
         required: false
-        type: string
-        default: '10'
+        type: number
+        default: 10
+    secrets:
+      EXTENSION_BENCHMARK_STATS_TOKEN:
+        required: true
 
 jobs:
   page-load-benchmark-pr:
@@ -23,28 +26,42 @@ jobs:
       OWNER: ${{ github.repository_owner }}
       REPOSITORY: ${{ github.event.repository.name }}
       PR_NUMBER: ${{ github.event.pull_request.number }}
-      GITHUB_SHA: ${{ github.event.pull_request.head.sha }}
+      HEAD_COMMIT_HASH: ${{ github.event.pull_request.head.sha || github.sha }}
+      BENCHMARK_BROWSER_LOADS: ${{ inputs.browser-loads }}
+      BENCHMARK_PAGE_LOADS: ${{ inputs.page-loads }}
+      IS_PR_OR_MAIN: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref_name == 'main') }}
     steps:
       - name: Checkout and setup environment
+        if: ${{ env.IS_PR_OR_MAIN }}
         uses: MetaMask/action-checkout-and-setup@v1
         with:
           is-high-risk-environment: false
           skip-allow-scripts: true
           use-yarn-hydrate: true
 
       - name: Download artifact 'build-test-browserify'
+        if: ${{ env.IS_PR_OR_MAIN }}
         uses: actions/download-artifact@v4
         with:
           name: build-test-browserify
 
       - name: Install Playwright browsers
+        if: ${{ env.IS_PR_OR_MAIN }}
         run: yarn playwright install chromium
 
       - name: Run page load benchmarks
+        if: ${{ env.IS_PR_OR_MAIN }}
         run: yarn test:e2e:benchmark
 
       - name: Upload benchmark results (github artifacts)
+        if: ${{ env.IS_PR_OR_MAIN }}
         uses: actions/upload-artifact@v4
         with:
-          name: benchmark-results
-          path: test-artifacts/benchmarks/benchmark-results.json
+          name: page-load-benchmark-results
+          path: test-artifacts/benchmarks/page-load-benchmark-results.json
+
+      - name: Upload benchmark results (historical data)
+        if: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
+        run: .github/scripts/benchmark-stats-commit.sh
+        env:
+          EXTENSION_BENCHMARK_STATS_TOKEN: ${{ secrets.EXTENSION_BENCHMARK_STATS_TOKEN }}

.github/workflows/publish-prerelease.yml

@@ -67,12 +67,12 @@ jobs:
           echo "MERGE_BASE_COMMIT_HASH=${merge_base_commit_hash}" >> "${GITHUB_ENV}"
           echo "The merge base commit hash is '${merge_base_commit_hash}'"
 
-      - name: Page load benchmark comment
+      - name: Download page load benchmark results
         if: ${{ github.event_name == 'pull_request' }}
-        uses: ./.github/actions/page-load-benchmark-comment
+        uses: actions/download-artifact@v4
         with:
-          head-commit-hash: ${{ env.HEAD_COMMIT_HASH }}
-          pr-comment-token: ${{ secrets.PR_COMMENT_TOKEN }}
+          name: page-load-benchmark-results
+          path: test-artifacts/benchmarks
 
       - name: Publish prerelease
         if: ${{ env.MERGE_BASE_COMMIT_HASH && env.PR_NUMBER && env.PR_COMMENT_TOKEN && vars.AWS_CLOUDFRONT_URL }}

.github/workflows/run-e2e.yml

@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     container:
-      image: ghcr.io/metamask/metamask-extension-e2e-image:v1.0.0
+      image: ghcr.io/metamask/metamask-extension-e2e-image:v24.11.0
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/stable-branch-sync.yml

@@ -36,11 +36,11 @@ jobs:
   run-stable-sync:
     name: Run Stable branch sync
     needs: get-next-version
-    uses: metamask/github-tools/.github/workflows/stable-sync.yml@486f5d113c5524eaab9a058abe76097f83a4c33e
+    uses: metamask/github-tools/.github/workflows/stable-sync.yml@79ce6e3ab56c7f3d0ee0c2cf5900a2522d20be0b
     secrets:
       github-token: ${{ secrets.STABLE_SYNC_TOKEN }}
     with:
       semver-version: ${{ needs.get-next-version.outputs.next-version }}
       repo-type: 'extension' # Accepts 'mobile' or 'extension'
-      github-tools-version: '486f5d113c5524eaab9a058abe76097f83a4c33e'
+      github-tools-version: '79ce6e3ab56c7f3d0ee0c2cf5900a2522d20be0b'
       stable-branch-name: 'stable' # Defaults to `stable`

.github/workflows/update-release-changelog.yml

@@ -1,5 +1,7 @@
-# On every push to a release branch (Version-v* or release/*), this workflow rebuilds the matching
+# On every push to a release branch (release/x.y.z format), this workflow rebuilds the matching
 # changelog branch, re-runs the auto-changelog script, and either updates or recreates the changelog PR.
+# Note: This workflow validates the branch name to ensure it matches the semantic versioning pattern
+# (release/x.y.z) and skips execution for other branch names like release/x.y.z-Changelog.
 name: Update Release Changelog PR
 
 on:
@@ -12,7 +14,34 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  validate-branch:
+    name: Validate release branch format
+    runs-on: ubuntu-latest
+    outputs:
+      is-valid-release: ${{ steps.check.outputs.is-valid }}
+      version: ${{ steps.check.outputs.version }}
+    steps:
+      - name: Check if branch matches release/x.y.z pattern
+        id: check
+        run: |
+          BRANCH_NAME="${{ github.ref_name }}"
+          echo "Checking branch: $BRANCH_NAME"
+
+          # Validate branch matches release/x.y.z format (semantic versioning)
+          if [[ "$BRANCH_NAME" =~ ^release/[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            VERSION="${BRANCH_NAME#release/}"
+            echo "Valid release branch detected: $BRANCH_NAME (version: $VERSION)"
+            echo "is-valid=true" >> "$GITHUB_OUTPUT"
+            echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          else
+            echo "Branch '$BRANCH_NAME' does not match release/x.y.z pattern. Skipping changelog update."
+            echo "is-valid=false" >> "$GITHUB_OUTPUT"
+          fi
+
   refresh-changelog:
+    name: Update changelog
+    needs: validate-branch
+    if: needs.validate-branch.outputs.is-valid-release == 'true'
     permissions:
       contents: write
       pull-requests: write

.gitignore

@@ -76,6 +76,7 @@ development/generate-attributions/.yarn/*
 
 # MetaMask
 .metamask/*
+github-tools/
 
 # Playwright
 public/playwright

.nvmrc

@@ -1 +1 @@
-v22.15
+v24.11

.prettierignore

@@ -13,6 +13,7 @@ node_modules/**/*
 /development/ts-migration-dashboard/build/**
 /dist/**/*
 /lavamoat/**/policy.json
+/lavamoat/**/policy-override.json
 /storybook-build/**/*
 /test-artifacts/**/*
 /test/test-results/**/*