@@ -1,8 +1,9 @@
 name: E2E Android setup
 description: >-
-  Shared setup for the Android Detox jobs: toolchains, caches, KVM, the e2e
-  project's dependencies and the local react-native-update link. Runs after
-  the react-native-update checkout (this action lives in it).
+  Shared setup for the Android Detox jobs: Java (+ Gradle cache) and KVM, then
+  the platform-neutral e2e setup (../e2e-common: toolchains, Bun cache, the
+  e2e project's dependencies and the local react-native-update link). Runs
+  after the react-native-update checkout (this action lives in it).
 inputs:
   project-dir:
     description: E2E app directory, relative to the workspace.
@@ -32,32 +33,6 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Checkout react-native-update-cli
-      if: inputs.checkout-cli == 'true'
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        repository: reactnativecn/react-native-update-cli
-        path: react-native-update-cli
-
-    - name: Setup Node.js
-      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-      with:
-        node-version: 24
-
-    - name: Setup Bun
-      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-      with:
-        bun-version: 1.4.0
-
-    - name: Cache Bun dependencies
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ~/.bun/install/cache
-        key: ${{ runner.os }}-bun-e2e${{ inputs.bun-cache-scope }}-${{ hashFiles('Example/e2etest/bun.lock', 'react-native-update-cli/bun.lock') }}${{ inputs.bun-cache-key-suffix }}
-        restore-keys: |
-          ${{ runner.os }}-bun-e2e${{ inputs.bun-cache-scope }}-
-          ${{ runner.os }}-bun-e2e-
-
     - name: Setup Java
       uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
       with:
@@ -73,45 +48,12 @@ runs:
         sudo udevadm control --reload-rules
         sudo udevadm trigger --name-match=kvm
 
-    - name: Create e2e project
-      if: inputs.create-project != ''
-      shell: bash
-      env:
-        CREATE_PROJECT: ${{ inputs.create-project }}
-      run: eval "$CREATE_PROJECT"
-
-    - name: Install e2e project dependencies
-      shell: bash
-      working-directory: ${{ inputs.project-dir }}
-      env:
-        FROZEN: ${{ inputs.frozen-lockfile }}
-      run: |
-        if [ "$FROZEN" = 'true' ]; then
-          bun install --frozen-lockfile
-        else
-          bun install
-        fi
-
-    - name: Link local react-native-update
-      # Mirrors what an npm install ships (package.json `files`), plus cpp/
-      # for the iOS/Android native builds; scripts/ is dev-only and unused
-      # by any build step.
-      shell: bash
-      env:
-        E2E_DIR: ${{ inputs.project-dir }}
-      run: |
-        set -euo pipefail
-        export LOCAL_RNU_VERSION="$(node -p "require('./${E2E_DIR}/node_modules/react-native-update/package.json').version")"
-        export LOCAL_RNU_DIR="$PWD/$E2E_DIR/.e2e-artifacts/local-react-native-update"
-        rm -rf "$LOCAL_RNU_DIR" "$E2E_DIR/node_modules/react-native-update"
-        mkdir -p "$LOCAL_RNU_DIR"
-        cp package.json react-native-update.podspec react-native.config.js expo-module.config.json "$LOCAL_RNU_DIR"/
-        rsync -a --exclude='.git' src ios android cpp "$LOCAL_RNU_DIR"/
-        node -e "const fs = require('fs'); const file = process.env.LOCAL_RNU_DIR + '/package.json'; const pkg = JSON.parse(fs.readFileSync(file, 'utf8')); pkg.version = process.env.LOCAL_RNU_VERSION; fs.writeFileSync(file, JSON.stringify(pkg, null, 2) + '\n');"
-        ln -s ../.e2e-artifacts/local-react-native-update "$E2E_DIR/node_modules/react-native-update"
-
-    - name: Install react-native-update-cli dependencies
-      if: inputs.checkout-cli == 'true'
-      shell: bash
-      working-directory: react-native-update-cli
-      run: bun install --frozen-lockfile && bun run build
+    - name: Common e2e setup
+      uses: ./.github/actions/e2e-common
+      with:
+        project-dir: ${{ inputs.project-dir }}
+        checkout-cli: ${{ inputs.checkout-cli }}
+        bun-cache-scope: ${{ inputs.bun-cache-scope }}
+        bun-cache-key-suffix: ${{ inputs.bun-cache-key-suffix }}
+        create-project: ${{ inputs.create-project }}
+        frozen-lockfile: ${{ inputs.frozen-lockfile }}
@@ -0,0 +1,98 @@
+name: E2E common setup
+description: >-
+  Platform-neutral part of the Detox e2e setup: Node/Bun toolchains, the Bun
+  cache, the e2e project's dependencies, the local react-native-update link
+  and (optionally) a built react-native-update-cli. Runs after the
+  react-native-update checkout (this action lives in it); platform toolchains
+  (Java/KVM, Xcode/Homebrew) are set up by the caller.
+inputs:
+  project-dir:
+    description: E2E app directory, relative to the workspace.
+    default: Example/e2etest
+  checkout-cli:
+    description: Check out and build react-native-update-cli (needed to prepare update artifacts).
+    default: 'true'
+  bun-cache-scope:
+    description: Extra bun cache key segment for jobs whose dependency set differs.
+    default: ''
+  bun-cache-key-suffix:
+    description: Extra hash appended to the bun cache key.
+    default: ''
+  create-project:
+    description: Command that generates the e2e project before its dependencies are installed.
+    default: ''
+  frozen-lockfile:
+    description: Install with --frozen-lockfile (false only for generated projects that have no lockfile).
+    default: 'true'
+runs:
+  using: composite
+  steps:
+    - name: Checkout react-native-update-cli
+      if: inputs.checkout-cli == 'true'
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        repository: reactnativecn/react-native-update-cli
+        path: react-native-update-cli
+
+    - name: Setup Node.js
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      with:
+        node-version: 24
+
+    - name: Setup Bun
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      with:
+        bun-version: 1.4.0
+
+    - name: Cache Bun dependencies
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ~/.bun/install/cache
+        key: ${{ runner.os }}-bun-e2e${{ inputs.bun-cache-scope }}-${{ hashFiles('Example/e2etest/bun.lock', 'react-native-update-cli/bun.lock') }}${{ inputs.bun-cache-key-suffix }}
+        restore-keys: |
+          ${{ runner.os }}-bun-e2e${{ inputs.bun-cache-scope }}-
+          ${{ runner.os }}-bun-e2e-
+
+    - name: Create e2e project
+      if: inputs.create-project != ''
+      shell: bash
+      env:
+        CREATE_PROJECT: ${{ inputs.create-project }}
+      run: eval "$CREATE_PROJECT"
+
+    - name: Install e2e project dependencies
+      shell: bash
+      working-directory: ${{ inputs.project-dir }}
+      env:
+        FROZEN: ${{ inputs.frozen-lockfile }}
+      run: |
+        if [ "$FROZEN" = 'true' ]; then
+          bun install --frozen-lockfile
+        else
+          bun install
+        fi
+
+    - name: Link local react-native-update
+      # Mirrors what an npm install ships (package.json `files`), plus cpp/
+      # for the iOS/Android native builds; scripts/ is dev-only and unused
+      # by any build step.
+      shell: bash
+      env:
+        E2E_DIR: ${{ inputs.project-dir }}
+      run: |
+        set -euo pipefail
+        LOCAL_RNU_VERSION="$(node -p "require('./${E2E_DIR}/node_modules/react-native-update/package.json').version")"
+        LOCAL_RNU_DIR="$PWD/$E2E_DIR/.e2e-artifacts/local-react-native-update"
+        export LOCAL_RNU_VERSION LOCAL_RNU_DIR
+        rm -rf "$LOCAL_RNU_DIR" "$E2E_DIR/node_modules/react-native-update"
+        mkdir -p "$LOCAL_RNU_DIR"
+        cp package.json react-native-update.podspec react-native.config.js expo-module.config.json "$LOCAL_RNU_DIR"/
+        rsync -a --exclude='.git' src ios android cpp "$LOCAL_RNU_DIR"/
+        node -e "const fs = require('fs'); const file = process.env.LOCAL_RNU_DIR + '/package.json'; const pkg = JSON.parse(fs.readFileSync(file, 'utf8')); pkg.version = process.env.LOCAL_RNU_VERSION; fs.writeFileSync(file, JSON.stringify(pkg, null, 2) + '\n');"
+        ln -s ../.e2e-artifacts/local-react-native-update "$E2E_DIR/node_modules/react-native-update"
+
+    - name: Install react-native-update-cli dependencies
+      if: inputs.checkout-cli == 'true'
+      shell: bash
+      working-directory: react-native-update-cli
+      run: bun install --frozen-lockfile && bun run build
@@ -0,0 +1,118 @@
+name: Publish to npm
+description: >-
+  Shared body of the two publish jobs in publish.yml: toolchains, the CI-built
+  Android native libraries, the Harmony HAR (rebuilt, or reused from the
+  previous published release), the pre-publish checks and npm publish. Runs
+  after the react-native-update checkout (this action lives in it).
+inputs:
+  harmony-har:
+    description: "'build' rebuilds harmony/pushy.har from source; 'previous' reuses the one in the previous-tag release on npm."
+    required: true
+  previous-tag:
+    description: Last release tag published to npm (with harmony-har 'previous').
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Check inputs
+      shell: bash
+      env:
+        HARMONY_HAR: ${{ inputs.harmony-har }}
+        PREVIOUS_TAG: ${{ inputs.previous-tag }}
+      run: |
+        case "$HARMONY_HAR" in
+          build) ;;
+          previous)
+            if [ -z "$PREVIOUS_TAG" ]; then
+              echo "::error::harmony-har 'previous' needs previous-tag"
+              exit 1
+            fi
+            ;;
+          *) echo "::error::unknown harmony-har '$HARMONY_HAR'"; exit 1 ;;
+        esac
+
+    - name: Configure git safe.directory
+      shell: bash
+      run: |
+        git config --global --add safe.directory "$GITHUB_WORKSPACE"
+        # $toplevel/$sm_path are expanded by git submodule foreach, not here.
+        # shellcheck disable=SC2016
+        git submodule foreach --recursive 'git config --global --add safe.directory "$toplevel/$sm_path"'
+
+    - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      with:
+        bun-version: 1.4.0
+
+    # Setup .npmrc file to publish to npm
+    - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      with:
+        node-version: 24
+        registry-url: 'https://registry.npmjs.org'
+
+    - name: Install dependencies
+      shell: bash
+      run: bun install --frozen-lockfile
+
+    # Drop the committed binaries first: the artifact must fully replace
+    # android/lib, so any layout regression makes the verify step fail loudly
+    # instead of silently passing against stale committed .so files.
+    - name: Remove committed Android native libraries
+      shell: bash
+      run: rm -rf android/lib
+
+    - name: Use CI-built Android native libraries
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      with:
+        name: android-so
+        path: android/lib
+
+    - name: Verify Android native libraries
+      shell: bash
+      run: node scripts/verify-android-so.js
+
+    - name: Build Harmony HAR
+      if: inputs.harmony-har == 'build'
+      shell: bash
+      run: npm run build:harmony-har -- --build-mode release
+
+    # Fail closed: the package must always ship harmony/pushy.har
+    # (package.json `files` lists it and check-packlist.js --release
+    # requires it). If the previous release can't be fetched, fix the cause
+    # or re-run — never publish a HAR-less package.
+    - name: Fetch previous Harmony HAR
+      if: inputs.harmony-har == 'previous'
+      shell: bash
+      env:
+        PREVIOUS_TAG: ${{ inputs.previous-tag }}
+      run: |
+        PREV_VERSION="${PREVIOUS_TAG#v}"
+        echo "Fetching harmony/pushy.har from react-native-update@$PREV_VERSION"
+        npm pack "react-native-update@$PREV_VERSION"
+        tar -xzf "react-native-update-${PREV_VERSION}.tgz" package/harmony/pushy.har
+        mkdir -p harmony
+        cp package/harmony/pushy.har harmony/pushy.har
+        # Clean up temporary pack and extraction files to prevent publishing them
+        rm -rf "react-native-update-${PREV_VERSION}.tgz" package
+
+    - name: Verify Harmony HAR artifact
+      shell: bash
+      run: test -f harmony/pushy.har
+
+    - name: Verify release tag matches package version
+      shell: bash
+      run: node scripts/check-release-version.js
+
+    - name: Verify publish file list
+      shell: bash
+      run: node scripts/check-packlist.js --release
+
+    - name: Publish to npm
+      shell: bash
+      env:
+        RELEASE_TAG: ${{ github.event.release.tag_name }}
+      run: |
+        if [[ "$RELEASE_TAG" == *"beta"* ]]; then
+          npm publish --provenance --access public --tag beta
+        else
+          npm publish --provenance --access public
+        fi