.github/workflows/e2e_test.yml-108-111 (1)

108-111: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add timeout-minutes to the iOS e2e step.

The iOS test run lacks an explicit timeout, similar to the Android job.

🔧 Proposed fix

       - name: Run e2e (iOS simulator)
+        timeout-minutes: 60
         run: |
           cd sample_app/ios
           bundle exec fastlane run_e2e_test device:${{ env.device_id }} mock_server_branch:main

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e_test.yml around lines 108 - 111, The "Run e2e (iOS
simulator)" step in the iOS e2e workflow is missing an explicit timeout
configuration. Add a `timeout-minutes` property to this step to set a maximum
execution time for the iOS simulator test run, similar to what exists in the
Android job to prevent the workflow from running indefinitely in case of
failures or hangs.

.github/workflows/e2e_test_cron.yml-135-136 (1)

135-136: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add timeout-minutes to the iOS e2e step for consistency with Android.

The Android job has timeout-minutes: 90 on the emulator runner, but the iOS job lacks an explicit timeout.

🔧 Proposed fix

       - name: Run e2e (iOS simulator)
+        timeout-minutes: 90
         run: cd sample_app/ios && bundle exec fastlane run_e2e_test device:${{ env.device_id }} mock_server_branch:${{ env.mock_server_branch }}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e_test_cron.yml around lines 135 - 136, The iOS e2e test
step named "Run e2e (iOS simulator)" is missing the timeout-minutes
configuration that the Android job has. Add a timeout-minutes field set to 90 to
this step to maintain consistency with the Android emulator runner's timeout
configuration. This should be added as a step-level property at the same
indentation level as the name and run fields.

.github/workflows/e2e_test.yml-53-61 (1)

53-61: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add timeout-minutes to the Android emulator step.

Unlike the nightly workflow which specifies timeout-minutes: 90, this step lacks a timeout. If tests hang, the job will run until the workflow's default timeout (6 hours), wasting compute and blocking the concurrency group.

🔧 Proposed fix

       - name: Run e2e (Android emulator)
         uses: reactivecircus/android-emulator-runner@v2
+        timeout-minutes: 60
         with:
           api-level: 34

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e_test.yml around lines 53 - 61, The "Run e2e (Android
emulator)" step that uses reactivecircus/android-emulator-runner@v2 is missing a
timeout-minutes configuration. Add timeout-minutes: 90 as a property at the same
indentation level as the uses and with properties to prevent tests from hanging
indefinitely and consuming resources until the default 6-hour workflow timeout
is reached.

sample_app/integration_test/pages/message_list_page.dart-4-6 (1)

4-6: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add doc comments for MessageListPage public API.

MessageListPage (and exposed composer) is public and should be documented.

As per coding guidelines: “All public APIs must have doc comments (public_member_api_docs)”.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/pages/message_list_page.dart` around lines 4 - 6,
The MessageListPage class and its public static constant composer are missing
documentation comments required by the coding guidelines. Add doc comments
(starting with ///) to both the MessageListPage abstract final class and the
static const composer field to document their purpose and usage, ensuring all
public APIs are properly documented.

Source: Coding guidelines

sample_app/integration_test/mock_server/data_types.dart-1-25 (1)

1-25: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add doc comments for exported enums and constants.

AttachmentType, ReactionType, MessageDeliveryStatus, and forbiddenWord are public APIs and need Dart doc comments.

As per coding guidelines: “All public APIs must have doc comments (public_member_api_docs)”.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/mock_server/data_types.dart` around lines 1 - 25,
Add Dart doc comments to the public APIs in this file to comply with the
public_member_api_docs guideline. For the three enums AttachmentType,
ReactionType, and MessageDeliveryStatus, add doc comments above their enum
declarations that describe their purpose and usage. Similarly, add a doc comment
above the forbiddenWord constant that explains what it represents. Use the
standard Dart doc comment format (///) for all public members to ensure they are
properly documented.

Source: Coding guidelines

sample_app/integration_test/robots/backend_robot.dart-1-54 (1)

1-54: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Apply package imports and doc comments for public robot API.

This file uses a relative import and exposes public APIs without Dart doc comments.

As per coding guidelines: “Always use package imports instead of relative imports (always_use_package_imports)” and “All public APIs must have doc comments (public_member_api_docs)”.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/robots/backend_robot.dart` around lines 1 - 54,
Replace the relative import statement with a package import for the mock_server
module in the BackendRobot file. Additionally, add Dart doc comments (using ///)
to all public APIs including the BackendRobot class definition and all public
methods: generateChannels, failNewMessages, freezeNewMessages, revokeToken,
invalidateToken, invalidateTokenDate, invalidateTokenSignature, and
breakTokenGeneration. Each doc comment should clearly describe the purpose and
behavior of the method or class.

Source: Coding guidelines

sample_app/integration_test/mock_server/mock_server.dart-7-87 (1)

7-87: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Document the public MockServer API.

MockServer and its public members are exported test infrastructure APIs and should have Dart doc comments for maintainability.

As per coding guidelines: “All public APIs must have doc comments (public_member_api_docs)”.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/mock_server/mock_server.dart` around lines 7 -
87, Add Dart doc comments to all public members of the MockServer class to
comply with the public_member_api_docs guideline. Document the MockServer class
itself, and all public methods and properties: the url and wsUrl fields, the
start() static factory method, and the instance methods stop(), post(), get(),
and waitUntilReady(). Each comment should explain the purpose and usage of the
respective public API member.

Source: Coding guidelines

sample_app/integration_test/robots/participant_robot.dart-1-176 (1)

1-176: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Switch to package imports and document the public robot surface.

This file uses relative imports and exports a large public API (ParticipantRobot methods) without doc comments.

As per coding guidelines: “Always use package imports instead of relative imports (always_use_package_imports)” and “All public APIs must have doc comments (public_member_api_docs)”.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/robots/participant_robot.dart` around lines 1 -
176, The ParticipantRobot class in participant_robot.dart has two issues: the
imports at the top use relative paths instead of package imports, and all public
methods lack documentation comments. Replace the relative imports (using ../
paths) with package imports using the package: prefix for the data_types and
mock_server modules. Then add doc comments to the ParticipantRobot class and all
its public methods including startTyping, stopTyping, sendMessage, editMessage,
deleteMessage, quoteMessage, uploadGiphy, pinMessage, unpinMessage,
uploadAttachment, addReaction, deleteReaction, and their related variants to
document their purpose and behavior.

Source: Coding guidelines

sample_app/integration_test/support/stream_test_env.dart-5-8 (1)

5-8: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Use package imports and add doc comments for public test env API.

This file uses relative imports and exposes public APIs (StreamTestEnv, setUp, tearDown) without doc comments.

As per coding guidelines: “Always use package imports instead of relative imports (always_use_package_imports)” and “All public APIs must have doc comments (public_member_api_docs)”.

Also applies to: 10-34

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/support/stream_test_env.dart` around lines 5 - 8,
Replace all relative imports in this file with package imports by converting
imports like '../mock_server/mock_server.dart', '../robots/backend_robot.dart',
'../robots/participant_robot.dart', and '../robots/user_robot.dart' to use the
package: prefix (e.g., 'package:sample_app/...'). Additionally, add
documentation comments to all public APIs exposed by this file, specifically the
StreamTestEnv class, setUp function, and tearDown function, ensuring each public
member has a clear doc comment explaining its purpose and usage.

Source: Coding guidelines

sample_app/integration_test/support/stream_test.dart-9-13 (1)

9-13: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Document the public streamTest wrapper.

streamTest is public and should have a doc comment describing intended usage and behavior.

As per coding guidelines: **/*.dart: All public APIs must have doc comments (public_member_api_docs).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/support/stream_test.dart` around lines 9 - 13,
The public streamTest function lacks a doc comment which is required by the
public_member_api_docs guideline. Add a documentation comment above the
streamTest function that clearly describes its purpose as a test wrapper,
documents the parameters (description, callback, and allureId), and explains its
intended usage and behavior for stream-based integration testing.

Source: Coding guidelines

sample_app/integration_test/PLAN.md-233-237 (1)

233-237: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Specify languages for fenced code blocks.

Two fenced blocks are missing language identifiers, triggering MD040. Add a language like text, dart, kotlin, or ruby as appropriate.

Also applies to: 275-321

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/PLAN.md` around lines 233 - 237, The fenced code
blocks in PLAN.md at lines 233-237 and 275-321 are missing language identifiers
after the opening triple backticks, which triggers the MD040 linting rule. Add
an appropriate language identifier (such as `text`, `ruby`, or `dart`)
immediately after the triple backticks for each fenced code block to specify the
content type and resolve the linting violation.

Source: Linters/SAST tools

sample_app/integration_test/allure/allure.dart-7-140 (1)

7-140: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add doc comments for the exported Allure API.

This file exposes public members (allureResultMarker, AllureStatus, Allure, and public methods) without API docs, which will trip public_member_api_docs in linted runs.

As per coding guidelines: **/*.dart: All public APIs must have doc comments (public_member_api_docs).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/allure/allure.dart` around lines 7 - 140, Add
documentation comments (/// style) to all public members in the file to satisfy
the public_member_api_docs lint rule. This includes the allureResultMarker
constant, the AllureStatus enum and its enum values, the Allure class, and its
public methods (startTest, step, and stopTest). Each doc comment should clearly
describe the purpose and usage of the member, ensuring that all exported APIs
have proper documentation.

Source: Coding guidelines

sample_app/integration_test/support/stream_test.dart-7-7 (1)

7-7: ⚠️ Potential issue | 🟡 Minor

Switch this relative import to a package import.

Use package:sample_app/integration_test/allure/allure.dart instead of the relative path. Relative imports make refactoring across directories more fragile and violate the always_use_package_imports guideline.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/support/stream_test.dart` at line 7, Replace the
relative import statement in stream_test.dart with a package import to improve
maintainability and follow the always_use_package_imports guideline. Change the
import from using the relative path '../allure/allure.dart' to use the full
package path format 'package:sample_app/integration_test/allure/allure.dart'
instead. This makes the codebase more resilient to directory refactoring and
improves code clarity.

Source: Coding guidelines

.github/workflows/e2e_test_cron.yml (1)

162-168: 🧹 Nitpick | 🔵 Trivial | ⚖️ Poor tradeoff

Consider replacing archived Slack action.

The 8398a7/action-slack@v3 repository is archived. While it still functions, consider migrating to an actively maintained alternative like slackapi/slack-github-action for long-term support.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e_test_cron.yml around lines 162 - 168, Replace the
archived `8398a7/action-slack@v3` action with the actively maintained
`slackapi/slack-github-action`. Update the uses statement to reference the new
action, and adjust the input parameters accordingly since the new action has a
different API - the text and fields parameters should be replaced with the
appropriate payload structure expected by slackapi/slack-github-action, and
ensure the SLACK_WEBHOOK_URL environment variable is properly passed to the new
action's configuration.

Source: Linters/SAST tools

sample_app/integration_test/support/step.dart (1)

1-4: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Use package import and document the public helper API.

This helper is fine functionally, but it violates the Dart style rules configured for this repo (relative import + missing doc comment on a public API).

Suggested patch

-import '../allure/allure.dart';
+import 'package:sample_app/integration_test/allure/allure.dart';
 
+/// Runs an Allure step with the provided [description].
 Future<T> step<T>(String description, Future<T> Function() body) =>
     Allure.instance.step(description, body);

As per coding guidelines, **/*.dart must use package imports and all public APIs must have doc comments.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/support/step.dart` around lines 1 - 4, The import
statement for the allure module uses a relative import path, but the repo
requires package imports for all Dart files. Additionally, the public step
function is missing a documentation comment as required by the Dart style
guidelines. Convert the relative import statement to use the package import
syntax, and add a doc comment above the step function definition that documents
its purpose, parameters, and return type to comply with the coding standards for
public APIs.

Source: Coding guidelines

sample_app/integration_test/pages/channel_list_page.dart (1)

3-5: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Document public page-object API members.

ChannelListPage and its public channelTile member should have doc comments to satisfy the repo Dart API documentation rule.

As per coding guidelines, all public APIs in **/*.dart must have doc comments.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/pages/channel_list_page.dart` around lines 3 - 5,
Add doc comments to the public API members in the ChannelListPage class to
comply with the Dart documentation requirement. The ChannelListPage class itself
needs a doc comment explaining its purpose, and the static channelTile constant
member needs a doc comment describing what it represents. Place the doc comments
immediately before each member declaration using the triple-slash (///) syntax
to ensure the repository's API documentation generation includes these
definitions.

Source: Coding guidelines

sample_app/integration_test/robots/user_robot.dart (1)

3-33: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Replace relative imports and add docs for the public robot API.

The robot implementation looks good, but this file currently violates Dart repo rules on package imports and public API docs.

Suggested import direction

-import '../pages/channel_list_page.dart';
-import '../pages/message_list_page.dart';
-import '../support/predefined_users.dart';
+import 'package:sample_app/integration_test/pages/channel_list_page.dart';
+import 'package:sample_app/integration_test/pages/message_list_page.dart';
+import 'package:sample_app/integration_test/support/predefined_users.dart';

As per coding guidelines, **/*.dart must use package imports and all public APIs must have doc comments.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/robots/user_robot.dart` around lines 3 - 33,
Replace all relative imports in the UserRobot class file with absolute package
imports (convert imports like '../pages/channel_list_page.dart' to use the
package: syntax). Additionally, add documentation comments using the /// syntax
to the public UserRobot class and all its public methods including login,
openChannel, and sendMessage to document their purpose, parameters, and return
values according to Dart documentation guidelines.

Source: Coding guidelines

sample_app/integration_test/support/predefined_users.dart (1)

3-26: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Add public API docs and split the token literal to satisfy max line length.

This file exposes public APIs without doc comments, and the JWT line likely exceeds the 120-char limit. Please document UserCredentials/PredefinedUsers and break long literals across adjacent string segments.

As per coding guidelines, public APIs in **/*.dart require doc comments and lines in **/*.{dart,dart.bak} must not exceed 120 characters.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/support/predefined_users.dart` around lines 3 -
26, Add doc comments to the public classes UserCredentials and PredefinedUsers
to document their purpose and usage, and split the long JWT token literal in the
qaTest1 constant across multiple adjacent string segments to ensure no line
exceeds the 120 character limit as per coding guidelines.

Source: Coding guidelines

sample_app/integration_test/robots/user_robot_message_list_asserts.dart (1)

1-7: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Make the extension file lint-compliant (package import + API docs).

Please switch to package import and add doc comments for the public extension and assertion method.

As per coding guidelines, Dart files must use package imports and public APIs must have doc comments.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/robots/user_robot_message_list_asserts.dart`
around lines 1 - 7, The file uses a relative import statement instead of a
package import, and the public extension UserRobotMessageListAsserts and its
public method assertMessage lack doc comments. Replace the relative import with
a package import statement that includes the appropriate package path, and add
doc comments (using ///) to both the UserRobotMessageListAsserts extension and
the assertMessage method to document their purpose and usage.

Source: Coding guidelines

sample_app/integration_test/message_list_test.dart (1)

3-6: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Use package imports in the integration test file.

Please replace these relative imports with package:sample_app/... imports to satisfy the Dart import policy.

As per coding guidelines, **/*.dart should always use package imports instead of relative imports.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/message_list_test.dart` around lines 3 - 6,
Replace all four relative imports at the top of the message_list_test.dart file
with package imports. Convert the imports of
user_robot_message_list_asserts.dart, step.dart, stream_test.dart, and
stream_test_env.dart from relative paths (using ./) to package imports using the
format package:sample_app/path/to/file.dart. Ensure the paths after
package:sample_app/ reflect the correct location of these imported files within
the project structure.

Source: Coding guidelines

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

sample_app/integration_test/support/widget_test_extensions.dart (1)

14-18: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Prevent crashes on duplicate text matches.

If the provided text appears more than once on the screen (e.g., in a header and a button), find.text(text) will match multiple widgets, causing tap() to throw a StateError ("Too many elements").

Consider adding an optional index parameter (similar to how tapByType handles it) to make this helper resilient against duplicate text.

🛠 Proposed fix

-  Future<void> tapText(String text) async {
-    await waitUntilVisible(find.text(text));
-    await tap(find.text(text));
+  Future<void> tapText(String text, {int index = 0}) async {
+    final finder = find.text(text);
+    await waitUntilVisible(finder.at(index));
+    await tap(finder.at(index));
     await pumpAndSettle();
   }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/integration_test/support/widget_test_extensions.dart` around lines
14 - 18, Update tapText to accept an optional index parameter, resolve the text
finder to the indexed match when provided, and pass that single-widget finder to
tap so duplicate text matches do not cause a StateError; preserve the existing
behavior when no index is supplied.

.github/actions/setup-ios-runtime/action.yml (1)

34-39: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Prevent potential shell injection by mapping inputs to environment variables.

While the current inputs are controlled via matrix definitions, directly interpolating ${{ inputs.* }} into inline bash scripts can lead to syntax errors or shell injection if the inputs contain spaces, quotes, or special characters. It is safer to pass them as environment variables.

♻️ Proposed refactor

     - name: Create custom iOS simulator
       shell: bash
+      env:
+        IOS_VERSION: ${{ inputs.version }}
+        DEVICE_TYPE: ${{ inputs.device }}
       run: |
-        ios_version_dash=$(echo "${{ inputs.version }}" | tr '.' '-')
-        xcrun simctl create custom-test-device "${{ inputs.device }}" "com.apple.CoreSimulator.SimRuntime.iOS-${ios_version_dash}"
-        xcrun simctl list devices "${{ inputs.version }}"
+        ios_version_dash=$(echo "$IOS_VERSION" | tr '.' '-')
+        xcrun simctl create custom-test-device "$DEVICE_TYPE" "com.apple.CoreSimulator.SimRuntime.iOS-${ios_version_dash}"
+        xcrun simctl list devices "$IOS_VERSION"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/actions/setup-ios-runtime/action.yml around lines 34 - 39, Update
the “Create custom iOS simulator” step to pass inputs.version and inputs.device
through the step’s environment, then reference those environment variables
within the bash script instead of directly interpolating GitHub expressions.
Preserve the existing version transformation and xcrun simctl commands.

sample_app/fastlane/Fastfile (2)

39-43: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

No readiness check after starting the mock server in the background.

bundle exec ruby driver.rb ... & returns as soon as the shell backgrounds the process; there's no polling/health-check before run_e2e_test proceeds to boot the app and run tests. This can cause flaky failures on the very first test if the mock server hasn't finished initializing yet (partially masked by sh_with_retries, but that adds latency/flakiness rather than fixing the race).

Consider polling the driver's HTTP endpoint (similar to stop_mock_server's /stop call) until it responds before returning from start_mock_server.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/fastlane/Fastfile` around lines 39 - 43, Update start_mock_server
to poll the mock server’s HTTP endpoint after launching driver.rb in the
background, reusing the endpoint pattern from stop_mock_server’s /stop call.
Wait until the endpoint responds successfully before returning, while preserving
the existing startup command and log setup.

---

12-14: 📐 Maintainability & Code Quality | 🔵 Trivial

Fragile regex-chain path derivation.

root_path strips fastlane/android/ios/// via sequential greedy regex .subs based on string content rather than actual directory structure. It appears to work for the known call sites (sample_app/android, sample_app/ios, sample_app), but is brittle to unrelated path segments containing these substrings.

Consider deriving this from a known relative offset (e.g. File.expand_path('../..', __dir__) from the Fastfile's own location) instead of string substitution.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sample_app/fastlane/Fastfile` around lines 12 - 14, Update root_path in the
Fastfile to derive the project root from the Fastfile’s directory using
filesystem-aware path resolution and the known relative directory depth, rather
than chaining content-based regex substitutions. Preserve the existing root path
returned for the sample_app Android, iOS, and base call sites.

.github/workflows/e2e_test.yml (1)

28-28: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Checkout steps across both E2E workflows persist Git credentials unnecessarily. None of these jobs push back to the repo, so disabling credential persistence reduces the impact if a later step in the job is compromised (flagged by zizmor as artipacked at all four sites).

• .github/workflows/e2e_test.yml#L28-L28: add persist-credentials: false to the android job's actions/checkout@v6 step.
• .github/workflows/e2e_test.yml#L80-L80: add persist-credentials: false to the ios job's actions/checkout@v6 step.
• .github/workflows/e2e_test_cron.yml#L34-L34: add persist-credentials: false to the android job's actions/checkout@v6 step.
• .github/workflows/e2e_test_cron.yml#L98-L98: add persist-credentials: false to the ios job's actions/checkout@v6 step.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e_test.yml at line 28, Disable Git credential
persistence on every checkout step: add persist-credentials: false to the
android and ios checkout steps in .github/workflows/e2e_test.yml (lines 28 and
80) and .github/workflows/e2e_test_cron.yml (lines 34 and 98), alongside each
actions/checkout@v6 usage.

Source: Linters/SAST tools

.github/workflows/e2e_test_cron.yml (1)

27-163: 🩺 Stability & Availability | 🔵 Trivial

No job-level timeout-minutes for android/ios jobs.

Individual steps have timeouts (timeout-minutes: 90 / 60), but other steps (Bootstrap, Allure launch/upload) are unbounded, so a hang there would tie up a runner up to GitHub's default 6-hour job cap across the whole matrix.

Consider adding a job-level timeout-minutes as a backstop for the nightly matrix.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e_test_cron.yml around lines 27 - 163, add job-level
timeout-minutes limits to both the android and ios jobs as a backstop for
unbounded steps such as Bootstrap and Allure operations. Choose durations that
accommodate the existing emulator and runtime setup time while preventing a hung
matrix job from reaching GitHub’s default six-hour cap; keep the existing
step-level timeouts unchanged.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes