WebTrit
diff --git a/‎.claude/hooks/dart_formatter.sh‎
Lines changed: 38 additions & 0 deletions b/‎.claude/hooks/dart_formatter.sh‎
Lines changed: 38 additions & 0 deletions
diff --git a/‎.claude/hooks/md_formatter.sh‎
Lines changed: 38 additions & 0 deletions b/‎.claude/hooks/md_formatter.sh‎
Lines changed: 38 additions & 0 deletions
diff --git a/‎.claude/hooks/newline_enforcer.sh‎
Lines changed: 28 additions & 0 deletions b/‎.claude/hooks/newline_enforcer.sh‎
Lines changed: 28 additions & 0 deletions
diff --git a/‎.claude/hooks/secrets_guard.sh‎
Lines changed: 23 additions & 0 deletions b/‎.claude/hooks/secrets_guard.sh‎
Lines changed: 23 additions & 0 deletions
diff --git a/‎.claude/settings.json‎
Lines changed: 66 additions & 0 deletions b/‎.claude/settings.json‎
Lines changed: 66 additions & 0 deletions
diff --git a/‎.github/workflows/integration-tests-firebase.yml‎
Lines changed: 106 additions & 23 deletions b/‎.github/workflows/integration-tests-firebase.yml‎
Lines changed: 106 additions & 23 deletions
diff --git a/‎.github/workflows/webtrit_callkeep.yaml‎
Lines changed: 6 additions & 4 deletions b/‎.github/workflows/webtrit_callkeep.yaml‎
Lines changed: 6 additions & 4 deletions
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# PostToolUse hook — auto-formats .dart files after Edit or Write.
+# Skips generated files (*.g.dart, *.pigeon.dart, *.freezed.dart).
+
+set -euo pipefail
+
+# Read tool input from stdin
+INPUT=$(cat)
+
+TOOL_NAME=$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('tool_name',''))" 2>/dev/null || true)
+
+if [[ "$TOOL_NAME" != "Edit" && "$TOOL_NAME" != "Write" ]]; then
+  exit 0
+fi
+
+FILE_PATH=$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('tool_input',{}).get('file_path',''))" 2>/dev/null || true)
+
+if [[ -z "$FILE_PATH" ]]; then
+  exit 0
+fi
+
+# Only process .dart files
+if [[ "$FILE_PATH" != *.dart ]]; then
+  exit 0
+fi
+
+# Skip generated files
+BASENAME=$(basename "$FILE_PATH")
+if [[ "$BASENAME" == *.g.dart || "$BASENAME" == *.pigeon.dart || "$BASENAME" == *.freezed.dart || "$BASENAME" == *.gr.dart ]]; then
+  exit 0
+fi
+
+# Skip if file doesn't exist
+if [[ ! -f "$FILE_PATH" ]]; then
+  exit 0
+fi
+
+dart format --line-length 120 "$FILE_PATH" 2>/dev/null || true
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# PostToolUse hook — auto-formats .md files after Edit or Write.
+# Requires: markdownlint-cli2 (npm install -g markdownlint-cli2)
+
+set -euo pipefail
+
+INPUT=$(cat)
+
+TOOL_NAME=$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('tool_name',''))" 2>/dev/null || true)
+
+if [[ "$TOOL_NAME" != "Edit" && "$TOOL_NAME" != "Write" ]]; then
+  exit 0
+fi
+
+FILE_PATH=$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('tool_input',{}).get('file_path',''))" 2>/dev/null || true)
+
+if [[ -z "$FILE_PATH" || ! -f "$FILE_PATH" ]]; then
+  exit 0
+fi
+
+if [[ "$FILE_PATH" != *.md ]]; then
+  exit 0
+fi
+
+# Resolve markdownlint-cli2: prefer PATH, fall back to known nvm location
+MDLINT=""
+if command -v markdownlint-cli2 &>/dev/null; then
+  MDLINT="markdownlint-cli2"
+elif [[ -x "$HOME/.nvm/versions/node/v24.1.0/bin/markdownlint-cli2" ]]; then
+  MDLINT="$HOME/.nvm/versions/node/v24.1.0/bin/markdownlint-cli2"
+else
+  # Try any nvm node version
+  MDLINT=$(find "$HOME/.nvm/versions/node" -name "markdownlint-cli2" -type f 2>/dev/null | head -1 || true)
+fi
+
+if [[ -n "$MDLINT" ]]; then
+  "$MDLINT" --fix "$FILE_PATH" 2>/dev/null || true
+fi
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# PostToolUse hook — ensures every written file ends with a newline.
+
+set -euo pipefail
+
+INPUT=$(cat)
+
+TOOL_NAME=$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('tool_name',''))" 2>/dev/null || true)
+
+if [[ "$TOOL_NAME" != "Edit" && "$TOOL_NAME" != "Write" ]]; then
+  exit 0
+fi
+
+FILE_PATH=$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('tool_input',{}).get('file_path',''))" 2>/dev/null || true)
+
+if [[ -z "$FILE_PATH" || ! -f "$FILE_PATH" ]]; then
+  exit 0
+fi
+
+# Skip binary files
+if ! file "$FILE_PATH" | grep -q "text"; then
+  exit 0
+fi
+
+# Add newline at EOF if missing
+if [[ -s "$FILE_PATH" ]] && [[ "$(tail -c1 "$FILE_PATH" | wc -l)" -eq 0 ]]; then
+  echo "" >> "$FILE_PATH"
+fi
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# PreToolUse hook — blocks access to secret/credential files.
+
+set -euo pipefail
+
+INPUT=$(cat)
+
+FILE_PATH=$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('tool_input',{}).get('file_path',''))" 2>/dev/null || true)
+
+if [[ -z "$FILE_PATH" ]]; then
+  exit 0
+fi
+
+BASENAME=$(basename "$FILE_PATH")
+
+BLOCKED_PATTERNS=(".env" ".jks" ".keystore" ".p12" ".pem" ".key" ".p8")
+
+for pattern in "${BLOCKED_PATTERNS[@]}"; do
+  if [[ "$BASENAME" == *"$pattern"* ]]; then
+    echo "ERROR: Access to secret/credential file blocked: $FILE_PATH" >&2
+    exit 1
+  fi
+done
@@ -0,0 +1,66 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(flutter *)",
+      "Bash(dart *)",
+      "Bash(git status)",
+      "Bash(git diff*)",
+      "Bash(git log*)",
+      "Bash(git add *)",
+      "Bash(git commit*)",
+      "Bash(git checkout *)",
+      "Bash(git pull*)",
+      "Bash(git push*)",
+      "Bash(git branch*)",
+      "Bash(very_good *)",
+      "Bash(lefthook *)",
+      "Bash(bash tool/scripts/*)"
+    ],
+    "deny": [
+      "Read(**/.env)",
+      "Read(**/.env.*)",
+      "Read(**/*.jks)",
+      "Read(**/*.keystore)",
+      "Read(**/*.p12)",
+      "Read(**/*.pem)",
+      "Read(**/*.key)",
+      "Read(**/*.p8)",
+      "Edit(**/.env)",
+      "Edit(**/.env.*)",
+      "Write(**/.env)",
+      "Write(**/.env.*)"
+    ]
+  },
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash .claude/hooks/dart_formatter.sh"
+          },
+          {
+            "type": "command",
+            "command": "bash .claude/hooks/md_formatter.sh"
+          },
+          {
+            "type": "command",
+            "command": "bash .claude/hooks/newline_enforcer.sh"
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Read|Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash .claude/hooks/secrets_guard.sh"
+          }
+        ]
+      }
+    ]
+  }
+}
@@ -13,13 +13,15 @@ on:
       - ".github/workflows/integration-tests-firebase.yml"
 
 jobs:
-  integration-tests:
-    name: Integration Tests (Firebase Test Lab)
+  # ── Job 1: discover test files + build all APKs in one runner ────────────────
+  setup:
+    name: Build all APKs
     runs-on: ubuntu-latest
-    # Skip fork PRs: secrets are not available for forks, so auth steps would fail.
-    # workflow_dispatch always runs (no fork context).
     if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
 
+    outputs:
+      tests: ${{ steps.discover.outputs.tests }}
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -40,6 +42,86 @@ jobs:
         run: flutter pub get
         working-directory: webtrit_callkeep/example
 
+      # Read test order from run_integration_tests.sh — single source of truth.
+      # When a test is added/reordered in the script it is automatically
+      # reflected in CI without touching this workflow.
+      - name: Discover integration test files
+        id: discover
+        run: |
+          ORDERED=$(grep -E '^\s+integration_test/.*_test\.dart' run_integration_tests.sh \
+            | sed 's|.*integration_test/||; s|\.dart.*||; s|[[:space:]]||g' \
+            | grep -v '^#' \
+            | jq -R . | jq -sc .)
+          echo "tests=$ORDERED" >> "$GITHUB_OUTPUT"
+        working-directory: webtrit_callkeep/example
+
+      # Build one app APK per test file. All builds run on the same runner so
+      # every app APK and the test APK share the same debug signing key.
+      - name: Build app APKs (one per test file)
+        run: |
+          TESTS=$(grep -E '^\s+integration_test/.*_test\.dart' run_integration_tests.sh \
+            | sed 's|.*integration_test/||; s|\.dart.*||; s|[[:space:]]||g' \
+            | grep -v '^#')
+          for TEST in $TESTS; do
+            flutter build apk --debug --target "integration_test/${TEST}.dart"
+            mkdir -p "$GITHUB_WORKSPACE/ci-artifacts/${TEST}"
+            cp build/app/outputs/apk/debug/app-debug.apk \
+               "$GITHUB_WORKSPACE/ci-artifacts/${TEST}/app-debug.apk"
+          done
+        working-directory: webtrit_callkeep/example
+
+      # Flutter build must run before assembleAndroidTest so the
+      # integration_test plugin is registered in the test APK.
+      - name: Build instrumented test APK
+        run: |
+          chmod +x gradlew
+          ./gradlew :app:assembleAndroidTest
+        working-directory: webtrit_callkeep/example/android
+
+      - name: Collect test APK
+        run: |
+          cp webtrit_callkeep/example/build/app/outputs/apk/androidTest/debug/app-debug-androidTest.apk \
+             ci-artifacts/app-debug-androidTest.apk
+
+      - name: Upload APKs
+        uses: actions/upload-artifact@v4
+        with:
+          name: apks
+          path: ci-artifacts/
+          retention-days: 1
+
+  # ── Job 2: run each test file sequentially on Firebase Test Lab ─────────────
+  run-test:
+    name: "${{ matrix.test }}"
+    needs: setup
+    runs-on: ubuntu-latest
+
+    permissions:
+      checks: write
+      contents: read
+
+    strategy:
+      max-parallel: 1        # sequential — Telecom state must drain between files
+      fail-fast: false       # run all files even if one fails
+      matrix:
+        test: ${{ fromJson(needs.setup.outputs.tests) }}
+
+    env:
+      APP_APK: apks/${{ matrix.test }}/app-debug.apk
+      TEST_APK: apks/app-debug-androidTest.apk
+      DEVICE: model=redfin,version=30,locale=en,orientation=portrait
+      RESULTS_BUCKET: webtrit-app-ci-test-results
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Download APKs
+        uses: actions/download-artifact@v4
+        with:
+          name: apks
+          path: apks
+
       - name: Authenticate with Google Cloud
         uses: google-github-actions/auth@v2
         with:
@@ -48,30 +130,31 @@ jobs:
       - name: Set up Google Cloud SDK
         uses: google-github-actions/setup-gcloud@v2
 
-      - name: Build debug APK
-        run: flutter build apk --debug
-        working-directory: webtrit_callkeep/example
-
-      - name: Build instrumented test APK
-        run: ./gradlew :app:assembleAndroidTest
-        working-directory: webtrit_callkeep/example/android
-
-      - name: Run tests on Firebase Test Lab
+      - name: Run on Firebase Test Lab
         run: |
           gcloud firebase test android run \
             --type instrumentation \
-            --app webtrit_callkeep/example/build/app/outputs/apk/debug/app-debug.apk \
-            --test webtrit_callkeep/example/build/app/outputs/apk/androidTest/debug/app-debug-androidTest.apk \
-            --device model=Pixel6,version=33,locale=en,orientation=portrait \
+            --app ${{ env.APP_APK }} \
+            --test ${{ env.TEST_APK }} \
+            --device ${{ env.DEVICE }} \
             --timeout 10m \
+            --results-bucket ${{ env.RESULTS_BUCKET }} \
+            --results-dir ${{ github.run_id }}/${{ matrix.test }} \
             --project ${{ secrets.FIREBASE_PROJECT_ID }}
 
-      - name: Upload build artifacts and test APKs
+      - name: Download JUnit results from GCS
         if: always()
-        uses: actions/upload-artifact@v4
+        run: |
+          mkdir -p test-results
+          gsutil -m cp -r \
+            "gs://${{ env.RESULTS_BUCKET }}/${{ github.run_id }}/${{ matrix.test }}/**/test_result_1.xml" \
+            test-results/ || true
+
+      - name: Report test results
+        if: always()
+        uses: dorny/test-reporter@v1
         with:
-          name: firebase-test-apks-${{ github.run_number }}
-          path: |
-            webtrit_callkeep/example/build/app/outputs/apk/debug/app-debug.apk
-            webtrit_callkeep/example/build/app/outputs/apk/androidTest/debug/app-debug-androidTest.apk
-          retention-days: 14
+          name: "${{ matrix.test }}"
+          path: "test-results/*.xml"
+          reporter: java-junit
+          fail-on-error: false
@@ -122,7 +122,8 @@ jobs:
         run: xvfb-run fluttium test flows/test_platform_name.yaml -d linux
 
   macos:
-    runs-on: macos-13
+    runs-on: macos-latest
+    if: false # macOS E2E tests disabled until platform is actively supported
 
     defaults:
       run:
@@ -137,7 +138,6 @@ jobs:
         run: flutter pub global activate fluttium_cli
 
       # TODO: Restore macOS E2E tests when they are enabled again.
-      # The following steps were temporarily removed because tests are currently disabled.
       # - name: E2E Tests
       #   run: fluttium test flows/test_platform_name.yaml -d macos
 
@@ -163,6 +163,7 @@ jobs:
 
   windows:
     runs-on: windows-2019
+    if: false # Windows E2E tests disabled until platform is actively supported
 
     defaults:
       run:
@@ -176,5 +177,6 @@ jobs:
       - name: Install Fluttium
         run: flutter pub global activate fluttium_cli
 
-      - name: E2E Tests
-        run: fluttium test flows/test_platform_name.yaml -d windows
+      # TODO: Restore Windows E2E tests when they are enabled again.
+      # - name: E2E Tests
+      #   run: fluttium test flows/test_platform_name.yaml -d windows