pachli-android/.github/workflows/ci.yml

name: CI

on:
  push:
    tags:
      - '*'
    branches:
      - main
  pull_request:
  workflow_dispatch:

permissions: read-all

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}
  cancel-in-progress: true

jobs:
  # ktlintCheck does not have per-variant tasks, so runs once over everything
  ktlint:
    name: ktlintCheck
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - uses: ./.github/actions/setup-build-env
        with:
          gradle-cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

      - name: ktlintCheck
        run: ./gradlew ktlintCheck

  # Tools are not per-variant
  tools:
    name: Test tools
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - uses: ./.github/actions/setup-build-env
        with:
          gradle-cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

      - name: Test tools
        working-directory: tools
        run: ../gradlew test

  # Custom lint rules are not per-variant
  custom-lint:
    name: Custom lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - uses: ./.github/actions/setup-build-env
        with:
          gradle-cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

      - name: Test custom lint rules
        working-directory: checks
        run: ../gradlew test

  # Android lint is per-variant
  lint:
    permissions:
      # Required to upload SARIF files
      security-events: write
    strategy:
      matrix:
        color: ["orange"]
        store: [ "Fdroid", "Github", "Google" ]
        type: [ "Debug", "Release" ]
    name: Android Lint
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - uses: ./.github/actions/setup-build-env
        with:
          gradle-cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

      # Run lint. Ignore a failing exit code, but save it for later.
      - name: Regular lint ${{ matrix.color }}${{ matrix.store }}${{ matrix.type }}
        id: runlint
        run: |
          set +e
          ./gradlew lint${{ matrix.color }}${{ matrix.store }}${{ matrix.type }}
          echo "exitcode=$?" >> $GITHUB_OUTPUT

      - name: Merge SARIF files
        run: |
          jq -s '{ "$schema": "https://json.schemastore.org/sarif-2.1.0", "version": "2.1.0", "runs": map(.runs) | add }'  */*/build/reports/lint-results-${{ matrix.color }}${{ matrix.store }}${{ matrix.type }}.sarif */build/reports/lint-results-${{ matrix.color }}${{ matrix.store }}${{ matrix.type }}.sarif > merged-${{ matrix.color }}${{ matrix.store }}${{ matrix.type }}.sarif

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3
        with:
          sarif_file: merged-${{ matrix.color }}${{ matrix.store }}${{ matrix.type }}.sarif

      # Exit with whatever exit code the original lint run exited with, to
      # ensure this job fails if lint fails, *but* the lint reports are still
      # uploaded.
      - name: Fail if lint failed
        run: exit ${{ steps.runlint.outputs.exitcode }}

  # Android tests are per variant
  test:
    strategy:
      matrix:
        color: ["orange"]
        store: [ "Fdroid", "Github", "Google" ]
        type: [ "Debug", "Release" ]
    name: Android Test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - uses: ./.github/actions/setup-build-env
        with:
          gradle-cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

      - name: test ${{ matrix.color }}${{ matrix.store }}${{ matrix.type }}
        run: ./gradlew test${{ matrix.color }}${{ matrix.store }}${{ matrix.type }}

  # Android assemble is per variant
  assemble:
    strategy:
      matrix:
        color: ["orange"]
        store: [ "Fdroid", "Github", "Google" ]
        type: [ "Debug", "Release" ]
    name: Android Assemble
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - uses: ./.github/actions/setup-build-env
        with:
          gradle-cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

      - name: assemble ${{ matrix.color }}${{ matrix.store }}${{ matrix.type }}
        run: ./gradlew assemble${{ matrix.color }}${{ matrix.store }}${{ matrix.type }}

  # Connected tests are per-store-variant, debug builds only.
  connected:
    strategy:
      matrix:
        color: ["Orange"]
        store: ["Fdroid", "Github", "Google"]
        type: ["Debug"]
        api-level: [31]
        target: [default]
    name: Android Emulator Tests
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: Enable KVM
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - uses: ./.github/actions/setup-build-env
        with:
          gradle-cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

      - name: AVD cache
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
        id: avd-cache
        with:
          path: |
            ~/.android/avd/*
            ~/.android/adb*
          key: avd-${{ matrix.api-level }}

      - name: Create AVD and generate snapshot for caching
        if: steps.avd-cache.outputs.cache-hit != 'true'
        uses: reactivecircus/android-emulator-runner@62dbb605bba737720e10b196cb4220d374026a6d # v2
        with:
          arch: x86_64
          api-level: ${{ matrix.api-level }}
          force-avd-creation: false
          emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
          disable-animations: false
          script: echo "Generated AVD snapshot for caching."

      - name: Run tests
        uses: reactivecircus/android-emulator-runner@62dbb605bba737720e10b196cb4220d374026a6d # v2
        with:
          api-level: ${{ matrix.api-level }}
          target: ${{ matrix.target }}
          arch: x86_64
          script: ./gradlew connected${{ matrix.color }}${{ matrix.store }}${{ matrix.type }}AndroidTest