From 48f83d8247837b12556a3394fab37c741ac9112d Mon Sep 17 00:00:00 2001
From: John Cater <jcater@engflow.com>
Date: Mon, 13 Jul 2026 10:48:42 -0400
Subject: [PATCH] Enable ios tests in CI.

Part of BZL-78.
---
 .github/workflows/main.yml | 28 ++++++++++++++++++++++------
 README.md                  | 19 ++++++++++++++-----
 ios/BUILD                  |  3 ---
 platform/macos_arm64/BUILD |  1 +
 4 files changed, 37 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 8027618..67b11e7 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -39,7 +39,7 @@ jobs:
           - docker
           - genrules
           - go
-          #- ios # TODO: fix ios builds
+          - ios
           - java
           - kotlin
           - perl
@@ -47,6 +47,9 @@ jobs:
           - swift
           - typescript
         execution_type: [remote, local]
+        include:
+          - arch: arm64
+          - os: macos
 
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"
@@ -61,8 +64,8 @@ jobs:
 
       - name: Build and test
         env:
-          ARCH: arm64
-          OS: macos
+          ARCH: ${{ matrix.arch }}
+          OS: ${{ matrix.os }}
           EXECUTION_TYPE: ${{ matrix.execution_type }}
           APPLE_SDK_VERSION_OVERRIDE: 26.5
         run: python3 infra/test-all.py --package=${{ matrix.test_package }}
@@ -89,7 +92,7 @@ jobs:
           - docker
           - genrules
           - go
-          #- ios # TODO: fix ios builds
+          - ios
           - java
           - kotlin
           - perl
@@ -97,6 +100,19 @@ jobs:
           - swift
           - typescript
         execution_type: [remote, local]
+        include:
+          - arch: x64
+          - os: linux
+
+          # Override remote ios tests to use macos/arm64 in the remote executor.
+          - test_package: ios
+            execution_type: remote
+            arch: arm64
+            os: macos
+        exclude:
+          # Local ios tests are not supported on linux
+          - test_package: ios
+            execution_type: local
 
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"
@@ -111,8 +127,8 @@ jobs:
 
       - name: Build and test
         env:
-          ARCH: x64
-          OS: linux
+          ARCH: ${{ matrix.arch }}
+          OS: ${{ matrix.os }}
           EXECUTION_TYPE: ${{ matrix.execution_type }}
         run: python3 infra/test-all.py --package=${{ matrix.test_package }}
 
diff --git a/README.md b/README.md
index 6c5ef21..cb5b7c6 100644
--- a/README.md
+++ b/README.md
@@ -62,6 +62,9 @@ locally before attempting remote execution.
 
 - `ios`:
 
+  This will only work on a macOS device with XCode (and the necessary iPhone
+  simulators) installed.
+
   ```
   # --config=ios is needed to properly set up the device simulators for testing
   bazel build --config=ios //ios:all
@@ -90,9 +93,11 @@ locally before attempting remote execution.
 
 - `ios`:
 
-  This will only work on a macOS device with XCode (and the necessary iPhone simulators) installed.
+  This will only work on a macOS device with XCode (and the necessary iPhone
+  simulators) installed.
 
   ```sh
+  # --config=ios is needed to properly set up the device simulators for testing
   bazel test --config=ios //ios:all
   ```
 
@@ -158,9 +163,12 @@ isn't enabled in your `.bazelrc.user` file.
 
 - `ios`:
 
-  These can only be built remotely on a macOS worker with the matching XCode installed.
+  These can only be tested remotely on a macOS worker with the matching XCode
+  installed. However, this means that the local bazel can be executed from linux
+  or macOS, since all work is done on the remote macOS worker.
 
   ```sh
+  # --config=ios is needed to properly set up the device simulators for testing
   bazel build --config=ios --config=remote_macos_arm64 --config=opal //ios:all
   ```
 
@@ -186,11 +194,12 @@ isn't enabled in your `.bazelrc.user` file.
 
 - `ios`:
 
-  These can only be tested remotely on a macOS worker with the matching XCode installed.
-
-  **NOTE:** Currently, `ios_ui_test` on a remote cluster is not working due to a permissions mismatch).
+  These can only be tested remotely on a macOS worker with the matching XCode
+  installed. However, this means that the local bazel can be executed from linux
+  or macOS, since all work is done on the remote macOS worker.
 
   ```sh
+  # --config=ios is needed to properly set up the device simulators for testing
   bazel test --config=ios --config=remote_macos_arm64 //ios:all
   ```
 
diff --git a/ios/BUILD b/ios/BUILD
index 87e2289..b097253 100644
--- a/ios/BUILD
+++ b/ios/BUILD
@@ -50,9 +50,6 @@ ios_ui_test(
     name = "HelloAppUITest",
     minimum_os_version = "26.0",
     runner = "@rules_apple//apple/testing/default_runner:ios_xctestrun_ordered_runner",
-    tags = [
-        "no-remote-ci",  # Investigating permissions error.
-    ],
     test_host = ":HelloApp",
     deps = [":HelloAppUITestLib"],
 )
diff --git a/platform/macos_arm64/BUILD b/platform/macos_arm64/BUILD
index c4265e4..10e1237 100644
--- a/platform/macos_arm64/BUILD
+++ b/platform/macos_arm64/BUILD
@@ -13,6 +13,7 @@ platform(
     ],
     exec_properties = {
         "Pool": "macos_arm_m2",
+        "test.sandboxAllowed": "False",  # ios tests need to escape the sandbox in order to correctly reach the simulator service.
     },
 )