@@ -0,0 +1,117 @@
+name: E2E Android setup
+description: >-
+  Shared setup for the Android Detox jobs: toolchains, caches, KVM, the e2e
+  project's dependencies and the local react-native-update link. Runs after
+  the react-native-update checkout (this action lives in it).
+inputs:
+  project-dir:
+    description: E2E app directory, relative to the workspace.
+    default: Example/e2etest
+  checkout-cli:
+    description: Check out and build react-native-update-cli (needed to prepare update artifacts).
+    default: 'true'
+  bun-cache-scope:
+    description: Extra bun cache key segment for jobs whose dependency set differs.
+    default: ''
+  bun-cache-key-suffix:
+    description: Extra hash appended to the bun cache key.
+    default: ''
+  gradle-cache-dependency-path:
+    description: Files whose hash keys the Gradle cache; they must exist before the e2e project is created.
+    default: |
+      Example/e2etest/bun.lock
+      Example/e2etest/android/*.gradle
+      Example/e2etest/android/**/*.gradle
+      Example/e2etest/android/gradle/wrapper/gradle-wrapper.properties
+  create-project:
+    description: Command that generates the e2e project before its dependencies are installed.
+    default: ''
+  frozen-lockfile:
+    description: Install with --frozen-lockfile (false only for generated projects that have no lockfile).
+    default: 'true'
+runs:
+  using: composite
+  steps:
+    - name: Checkout react-native-update-cli
+      if: inputs.checkout-cli == 'true'
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        repository: reactnativecn/react-native-update-cli
+        path: react-native-update-cli
+
+    - name: Setup Node.js
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      with:
+        node-version: 24
+
+    - name: Setup Bun
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      with:
+        bun-version: 1.4.0
+
+    - name: Cache Bun dependencies
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ~/.bun/install/cache
+        key: ${{ runner.os }}-bun-e2e${{ inputs.bun-cache-scope }}-${{ hashFiles('Example/e2etest/bun.lock', 'react-native-update-cli/bun.lock') }}${{ inputs.bun-cache-key-suffix }}
+        restore-keys: |
+          ${{ runner.os }}-bun-e2e${{ inputs.bun-cache-scope }}-
+          ${{ runner.os }}-bun-e2e-
+
+    - name: Setup Java
+      uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+      with:
+        distribution: temurin
+        java-version: '17'
+        cache: gradle
+        cache-dependency-path: ${{ inputs.gradle-cache-dependency-path }}
+
+    - name: Enable KVM
+      shell: bash
+      run: |
+        echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+        sudo udevadm control --reload-rules
+        sudo udevadm trigger --name-match=kvm
+
+    - name: Create e2e project
+      if: inputs.create-project != ''
+      shell: bash
+      env:
+        CREATE_PROJECT: ${{ inputs.create-project }}
+      run: eval "$CREATE_PROJECT"
+
+    - name: Install e2e project dependencies
+      shell: bash
+      working-directory: ${{ inputs.project-dir }}
+      env:
+        FROZEN: ${{ inputs.frozen-lockfile }}
+      run: |
+        if [ "$FROZEN" = 'true' ]; then
+          bun install --frozen-lockfile
+        else
+          bun install
+        fi
+
+    - name: Link local react-native-update
+      # Mirrors what an npm install ships (package.json `files`), plus cpp/
+      # for the iOS/Android native builds; scripts/ is dev-only and unused
+      # by any build step.
+      shell: bash
+      env:
+        E2E_DIR: ${{ inputs.project-dir }}
+      run: |
+        set -euo pipefail
+        export LOCAL_RNU_VERSION="$(node -p "require('./${E2E_DIR}/node_modules/react-native-update/package.json').version")"
+        export LOCAL_RNU_DIR="$PWD/$E2E_DIR/.e2e-artifacts/local-react-native-update"
+        rm -rf "$LOCAL_RNU_DIR" "$E2E_DIR/node_modules/react-native-update"
+        mkdir -p "$LOCAL_RNU_DIR"
+        cp package.json react-native-update.podspec react-native.config.js expo-module.config.json "$LOCAL_RNU_DIR"/
+        rsync -a --exclude='.git' src ios android cpp "$LOCAL_RNU_DIR"/
+        node -e "const fs = require('fs'); const file = process.env.LOCAL_RNU_DIR + '/package.json'; const pkg = JSON.parse(fs.readFileSync(file, 'utf8')); pkg.version = process.env.LOCAL_RNU_VERSION; fs.writeFileSync(file, JSON.stringify(pkg, null, 2) + '\n');"
+        ln -s ../.e2e-artifacts/local-react-native-update "$E2E_DIR/node_modules/react-native-update"
+
+    - name: Install react-native-update-cli dependencies
+      if: inputs.checkout-cli == 'true'
+      shell: bash
+      working-directory: react-native-update-cli
+      run: bun install --frozen-lockfile && bun run build
@@ -1,5 +1,5 @@
 name: Bounded content-addressed E2E cache
-description: Restore shared content caches; only mainline core saves a daily snapshot.
+description: Restore shared content caches; only the mainline iOS build job saves a daily snapshot.
 inputs:
   path:
     description: Content-addressed cache directory, never a built app.
@@ -8,7 +8,7 @@ inputs:
     description: Cache schema/toolchain identity.
     required: true
   write:
-    description: The core matrix leg may write on a trusted master push.
+    description: The e2e-ios-build job may write on a trusted master push.
     default: 'false'
 runs:
   using: composite
@@ -17,16 +17,16 @@ runs:
       shell: bash
       run: echo "day=$(date -u +%Y%m%d)" >> "$GITHUB_OUTPUT"
     - name: Restore read-only snapshot
-      if: "!(inputs.write == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/master' && github.job == 'e2e-ios')"
-      uses: actions/cache/restore@v6
+      if: "!(inputs.write == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/master' && github.job == 'e2e-ios-build')"
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ inputs.path }}
         key: e2e-content-v2-${{ runner.os }}-${{ runner.arch }}-${{ inputs.scope }}-${{ steps.epoch.outputs.day }}
         restore-keys: |
           e2e-content-v2-${{ runner.os }}-${{ runner.arch }}-${{ inputs.scope }}-
     - name: Restore and save trusted daily snapshot
-      if: inputs.write == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/master' && github.job == 'e2e-ios'
-      uses: actions/cache@v6
+      if: inputs.write == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/master' && github.job == 'e2e-ios-build'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ inputs.path }}
         key: e2e-content-v2-${{ runner.os }}-${{ runner.arch }}-${{ inputs.scope }}-${{ steps.epoch.outputs.day }}
 
@@ -2,8 +2,11 @@ version: 2
 updates:
   # Actions are pinned to commit SHAs in the workflows; Dependabot keeps the
   # SHA + version comment pairs current instead of a human copying hashes.
+  # The local composite actions pin SHAs too and are not scanned from "/".
   - package-ecosystem: github-actions
-    directory: /
+    directories:
+      - /
+      - /.github/actions/*
     schedule:
       interval: weekly
     groups:
 
@@ -2,9 +2,12 @@ name: CI Failure Issue
 
 on:
   workflow_run:
+    # native-gate is left out on purpose: it only posts a commit status and
+    # its own run stays green whatever that status is.
     workflows:
       - e2e-android
       - e2e-ios
+      - harmony-build
       - lint
       - Publish Package to npmjs
       - test