android.yml

name: Android

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
      - dev
  workflow_dispatch:
    inputs:
      publish_release:
        description: Publish a GitHub release
        required: true
        type: boolean
        default: false
      tag_name:
        description: Release tag, leave empty to use the Gradle version
        required: false
        default: ""

permissions:
  contents: read

concurrency:
  group: >-
    android-${{ github.workflow }}-${{
      github.event_name == 'push' && 'push' ||
      github.event_name == 'workflow_dispatch' && inputs.publish_release &&
      github.ref == 'refs/heads/main' && 'release' ||
      github.ref
    }}
  cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' || !inputs.publish_release || github.ref != 'refs/heads/main' }}

env:
  CI: true
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
  JAVA_TOOL_OPTIONS: -Djava.awt.headless=true

jobs:
  verify:
    if: ${{ github.event_name != 'workflow_dispatch' || !inputs.publish_release || github.ref != 'refs/heads/main' }}
    runs-on: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && fromJSON('["self-hosted","stack-android"]') || 'ubuntu-latest' }}
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Check file length
        run: |
          set -euo pipefail
          status=0
          while IFS= read -r file; do
            limit=330
            case "$file" in */src/test/*|*/src/androidTest/*) limit=350 ;; esac
            lines="$(wc -l < "$file")"
            if [ "$lines" -gt "$limit" ]; then
              echo "::error file=$file::$lines lines, the limit is $limit"
              status=1
            fi
          done < <(git ls-files '*.kt')
          exit "$status"

      - name: Set up Java
        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
        with:
          distribution: temurin
          java-version: 21

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
        with:
          cache-disabled: ${{ runner.environment == 'self-hosted' }}

      - name: Install Android SDK platform
        if: ${{ runner.environment == 'github-hosted' }}
        run: |
          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --install \
            "platforms;android-37.0" "build-tools;36.0.0" > /dev/null

      - name: Verify Android project
        timeout-minutes: 40
        run: |
          set -euo pipefail
          tasks=(
            :baseline-profile:assemble
            testDebugUnitTest
            lintDebug
            :app:assembleDebug
            :app:assembleRelease
          )
          ./gradlew --stacktrace "${tasks[@]}"

      - name: Upload debug APK
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: typetype-debug-apk
          path: |
            app/build/outputs/apk/debug/*.apk
          if-no-files-found: error
          compression-level: 0
          retention-days: 14

      - name: Upload lint report
        if: ${{ always() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: lint-report
          path: |
            **/build/reports/lint-results-debug.html
          if-no-files-found: ignore
          retention-days: 14

  release:
    if: ${{ github.ref == 'refs/heads/main' && github.event_name == 'workflow_dispatch' && inputs.publish_release }}
    runs-on: ubuntu-latest
    timeout-minutes: 50
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Java
        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
        with:
          distribution: temurin
          java-version: 21

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0

      - name: Install Android SDK platform
        run: |
          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --install \
            "platforms;android-37.0" "build-tools;36.0.0" > /dev/null

      - name: Prepare release metadata
        env:
          INPUT_TAG_NAME: ${{ inputs.tag_name }}
        run: |
          version="$(sed -nE 's/^[[:space:]]*versionName = "([^"]+)"/\1/p' app/build.gradle.kts)"
          version_code="$(sed -nE 's/^[[:space:]]*versionCode = ([0-9]+)/\1/p' app/build.gradle.kts)"
          test -n "$version"
          [[ "$version_code" =~ ^[1-9][0-9]*$ ]]
          expected_tag="v$version"
          release_tag="${INPUT_TAG_NAME:-$expected_tag}"
          test "$release_tag" = "$expected_tag"
          echo "RELEASE_VERSION=$version" >> "$GITHUB_ENV"
          echo "RELEASE_CODE=$version_code" >> "$GITHUB_ENV"
          echo "RELEASE_TAG=$release_tag" >> "$GITHUB_ENV"

      - name: Prepare signing
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          test -n "$ANDROID_KEYSTORE_BASE64"
          test -n "$ANDROID_KEYSTORE_PASSWORD"
          test -n "$ANDROID_KEY_ALIAS"
          test -n "$ANDROID_KEY_PASSWORD"
          printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 --decode > release.keystore
          {
            printf 'storeFile=%s\n' "$PWD/release.keystore"
            printf 'storePassword=%s\n' "$ANDROID_KEYSTORE_PASSWORD"
            printf 'keyAlias=%s\n' "$ANDROID_KEY_ALIAS"
            printf 'keyPassword=%s\n' "$ANDROID_KEY_PASSWORD"
          } > keystore.properties

      - name: Verify Android project and build release
        timeout-minutes: 40
        run: |
          set -euo pipefail
          tasks=(
            :baseline-profile:assemble
            testDebugUnitTest
            lintDebug
            :app:assembleDebug
            :app:assembleRelease
          )
          ./gradlew --stacktrace "${tasks[@]}"

      - name: Upload lint report
        if: ${{ always() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: lint-report
          path: |
            **/build/reports/lint-results-debug.html
          if-no-files-found: ignore
          retention-days: 14

      - name: Prepare APK artifact
        run: |
          export PATH="$JAVA_HOME/bin:$PATH"
          mkdir -p artifacts
          apk="$(find app/build/outputs/apk/release -name '*.apk' | head -n 1)"
          test -n "$apk"
          build_tools="$(find "$ANDROID_HOME/build-tools" -mindepth 1 -maxdepth 1 -type d | sort -V | tail -n 1)"
          test -n "$build_tools"
          "$build_tools/zipalign" -c -P 16 -v 4 "$apk"
          "$build_tools/apksigner" verify --verbose --print-certs "$apk"
          apk_application_id="$("$ANDROID_HOME/cmdline-tools/latest/bin/apkanalyzer" manifest application-id "$apk")"
          apk_version="$("$ANDROID_HOME/cmdline-tools/latest/bin/apkanalyzer" manifest version-name "$apk")"
          apk_code="$("$ANDROID_HOME/cmdline-tools/latest/bin/apkanalyzer" manifest version-code "$apk")"
          test "$apk_application_id" = "dev.typetype.android"
          test "$apk_version" = "$RELEASE_VERSION"
          test "$apk_code" = "$RELEASE_CODE"
          cp "$apk" "artifacts/TypeType-$RELEASE_TAG.apk"
          (
            cd artifacts
            sha256sum "TypeType-$RELEASE_TAG.apk" \
              > "TypeType-$RELEASE_TAG.apk.sha256"
            apk_sha256="$(cut -d ' ' -f1 "TypeType-$RELEASE_TAG.apk.sha256")"
            jq -n \
              --arg channel stable \
              --arg packageName dev.typetype.android \
              --arg versionName "$RELEASE_VERSION" \
              --argjson versionCode "$RELEASE_CODE" \
              --arg apkAsset "TypeType-$RELEASE_TAG.apk" \
              --arg sha256 "$apk_sha256" \
              '{schemaVersion:1,channel:$channel,packageName:$packageName,versionName:$versionName,versionCode:$versionCode,apkAsset:$apkAsset,sha256:$sha256}' \
              > typetype-update.json
          )

      - name: Upload release APK
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: typetype-release-apk
          path: |
            artifacts/*.apk
            artifacts/*.sha256
            artifacts/typetype-update.json
          if-no-files-found: error
          compression-level: 0
          retention-days: 30

      - name: Publish GitHub release
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          name: ${{ env.RELEASE_TAG }}
          body_path: release-notes/${{ env.RELEASE_TAG }}.md
          files: |
            artifacts/*.apk
            artifacts/*.sha256
            artifacts/typetype-update.json
          fail_on_unmatched_files: true