test(expo): add the Expo host of the e2e tests, their CI, and the verify-clerk-expo skill

[mikepitre]

Description

This is the third of four pull requests that replace the eleven of stack #10100. It sits on #10236, and #10238 sits on it. It holds the parts of #10087, #10090, and #10131 that are this repository's own, apart from the e2e tests in #10236, with the edits of #10219 to #10230 already in them.

With this pull request, integration/expo-native/bin/control-clerk-expo runs. It builds the expo-native fixture from #10235, takes a simulator or an emulator, creates a Clerk development application for the worktree, runs the e2e tests from #10236, and keeps a video, screenshots, and logs of each run. On a machine that cannot run the device, it borrows one on a GitHub Actions runner. CI runs every e2e test on both platforms for a pull request that is ready for review.

The first four commits are in reading order. The last two answer a review: a session builds natively when uncommitted changes touch the root pnpm-lock.yaml, and a test pins when a session fetches kept builds. Paths that begin src/, bin/, or test/ are inside integration/expo-native/.

Commit	Lines	What it adds
1. The Expo host	1,943	src/host.ts answers what the shared core asks of a platform. src/fixture.ts builds the fixture as a Debug dev client for a device on this machine, or as a Release app with its JS inside for a runner. src/native-build.ts keys a native build on what decides it, and puts new JS into a kept build. src/freshness.ts checks that the build of packages/expo is not older than its sources. src/platform/session-device.ts is the device recipe of a borrowed session. Also the package README.md.
2. The workflows	608	verify-e2e.yml runs every e2e test on iOS and Android. verify-remote.yml runs one borrowed-device session. bin/fetch-native-build.sh and bin/boot-ios-simulators.sh are steps that both use.
3. The unit tests	2,201	The tests of commits 1 and 2. Three of them read the workflow files. test/remote-contract.test.ts (315 lines) is a copy from clerk-ios.
4. The skill	964	.claude/skills/verify-clerk-expo/, its Cursor symlink, and the Verifying changes sections of AGENTS.md and packages/expo/AGENTS.md.

To review, read .claude/skills/verify-clerk-expo/SKILL.md first for what the CLI does, then src/host.ts, src/fixture.ts, and src/native-build.ts, then the two workflows. Apart from remote-contract.test.ts, nothing here is copied or generated. The five changesets are the empty ones that the old pull requests carried. No published package changes.

What needs attention:

• verify-e2e.yml starts on a pull request to main that changes the package, the fixture, or an Expo package, and by hand. A draft, a pull request from a fork, and a repository without the secret get a notice and no device job. The device job runs the pull request's code with contents: read, actions: read, and pull-requests: write, and gives MOBILE_VERIFICATION_PLATFORM_API_KEY only to the steps that call up, run, and down. It uploads evidence only when the CLI found no secret value in the run.
• verify-e2e.yml keeps the native app it built as an artifact for seven days, named by its native fingerprint. A later job, or a session, takes one only from a run of the same branch of this repository, never from a fork. Artifacts of this repository are public, so a session stores none of its own.
• verify-remote.yml starts only by workflow_dispatch, which needs write access. It uses no secret, and its jobs have contents: read, with actions: read added for the session job. A session builds the pushed commit, or that commit with the uncommitted changes to the app sources that the CLI sends as one patch. Every route of its tunnel needs a bearer token that the CLI made. The tunnel is a Cloudflare quick tunnel, so Cloudflare can read the traffic, which includes sign-in tickets for test users of an application that down deletes.
• src/native-build.ts exports the JS from the checkout, compiles it with the fixture's hermesc, and puts it in a copy of a kept app. The build fails unless the app then holds exactly that bundle.

npm test in integration/expo-native/ passes 837 of 837 on this branch, and npm run typecheck is clean. verify-e2e run 38611002410, started by hand on #10238 before those two commits, passed 17 of 17 tests on iOS and 15 of 15 on Android.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other: test tooling

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 26540ea

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 15, 2026 5:14am UTC
swingset	Ready	Preview	Oct 15, 2026 5:14am UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}