formulus-android.yml

name: Formulus Android & Formplayer Assets

on:
  push:
    branches:
      - main
      - dev
    paths:
      - 'formulus/**'
      - 'formulus-formplayer/**'
      - 'packages/tokens/**'
      - 'packages/components/**'
      - 'packages/observation-query/**'
      - '.github/workflows/formulus-android.yml'
  pull_request:
    paths:
      - 'formulus/**'
      - 'formulus-formplayer/**'
      - 'packages/tokens/**'
      - 'packages/components/**'
      - 'packages/observation-query/**'
  release:
    types: [published]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  NODE_VERSION: '24'
  # GitHub and Play target physical ARM devices; F-Droid requests all four ABIs in separate builds.
  FORMULUS_ABIS_RELEASE: armeabi-v7a,arm64-v8a
  FORMULUS_ABIS_SMOKE: arm64-v8a

jobs:
  build-formplayer-assets:
    name: Build Formplayer Assets
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Setup pnpm
        uses: pnpm/action-setup@7088e561eb65bb68695d245aa206f005ef30921d # v4.1
        with:
          version: 11.22.0

      - name: Set up Node.js for assets
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm
          cache-dependency-path: formulus-formplayer/pnpm-lock.yaml

      - name: Install and build @ode/tokens
        working-directory: packages/tokens
        run: |
          pnpm install --frozen-lockfile
          pnpm run build

      - name: Install formplayer dependencies
        working-directory: formulus-formplayer
        run: pnpm install --frozen-lockfile

      - name: Build and bundle formplayer
        working-directory: formulus-formplayer
        run: pnpm run build:copy

      - name: Upload formplayer assets artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: formplayer-assets
          path: formulus/android/app/src/main/assets/formplayer_dist
          retention-days: 7

  build-android:
    name: Build Formulus Android
    runs-on: ubuntu-latest
    needs: build-formplayer-assets
    permissions:
      contents: write
      pull-requests: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Download formplayer assets artifact
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          name: formplayer-assets
          path: formulus/android/app/src/main/assets/formplayer_dist

      - name: Setup pnpm
        uses: pnpm/action-setup@7088e561eb65bb68695d245aa206f005ef30921d # v4.1
        with:
          version: 11.22.0

      - name: Set up Node.js
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm
          cache-dependency-path: formulus/pnpm-lock.yaml

      - name: Install and build @ode/tokens
        working-directory: packages/tokens
        run: |
          pnpm install --frozen-lockfile
          pnpm run build

      - name: Install @ode/components dependencies
        working-directory: packages/components
        run: pnpm install --frozen-lockfile

      - name: Install dependencies (formulus)
        working-directory: formulus
        run: pnpm install --frozen-lockfile

      - name: Validate native versions and build numbers
        working-directory: formulus
        run: pnpm run validate:native-versions

      # vendor-notifee-core.mjs is a no-op when third_party/notifee is already at the pinned commit.
      - name: Cache vendored Notifee
        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: formulus/third_party/notifee
          key: notifee-${{ hashFiles('formulus/scripts/vendor-notifee-core.mjs') }}

      - name: Vendor Notifee Android core (source build; dir is gitignored)
        working-directory: formulus
        run: pnpm run vendor:notifee

      - name: Apply FOSS Android patches (match F-Droid init)
        if: github.event_name != 'pull_request'
        working-directory: formulus
        run: pnpm run patch:android-foss

      - name: Generate injection script (match F-Droid init)
        if: github.event_name != 'pull_request'
        working-directory: formulus
        run: pnpm run generate

      - name: Set up Java
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
        with:
          distribution: 'temurin'
          java-version: '17'
          # Gradle dependency/wrapper caching is handled by gradle/actions/setup-gradle below.

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
        with:
          # Persist the Gradle build cache across CI runs (wrapper + deps + task outputs).
          # Leave the daemon on so assembleRelease + bundleRelease share one JVM.
          cache-read-only: false

      - name: Make Gradle wrapper executable
        working-directory: formulus/android
        run: chmod +x ./gradlew

      - name: Prepare Android signing (non-PR)
        if: github.event_name != 'pull_request'
        env:
          FORMULUS_RELEASE_KEYSTORE_B64: ${{ secrets.FORMULUS_RELEASE_KEYSTORE_B64 }}
          FORMULUS_RELEASE_STORE_PASSWORD: ${{ secrets.FORMULUS_RELEASE_STORE_PASSWORD }}
          FORMULUS_RELEASE_KEY_ALIAS: ${{ secrets.FORMULUS_RELEASE_KEY_ALIAS }}
          FORMULUS_RELEASE_KEY_PASSWORD: ${{ secrets.FORMULUS_RELEASE_KEY_PASSWORD }}
        run: |
          set -e
          mkdir -p formulus/android/keystores

          if [ -z "$FORMULUS_RELEASE_KEYSTORE_B64" ]; then
            echo "FORMULUS_RELEASE_KEYSTORE_B64 is not set. Failing to avoid unsigned release builds."
            exit 1
          fi

          echo "$FORMULUS_RELEASE_KEYSTORE_B64" | base64 -d > formulus/android/keystores/formulus-signing.jks

          # Generate local.properties for release signing
          echo "FORMULUS_RELEASE_STORE_FILE=keystores/formulus-signing.jks" > formulus/android/local.properties
          echo "FORMULUS_RELEASE_STORE_PASSWORD=${FORMULUS_RELEASE_STORE_PASSWORD}" >> formulus/android/local.properties
          echo "FORMULUS_RELEASE_KEY_ALIAS=${FORMULUS_RELEASE_KEY_ALIAS}" >> formulus/android/local.properties
          echo "FORMULUS_RELEASE_KEY_PASSWORD=${FORMULUS_RELEASE_KEY_PASSWORD}" >> formulus/android/local.properties

      # ABI policy:
      # - PR: arm64-v8a only debug smoke build
      # - push to main/dev + release: ARM32/ARM64 universal APK + AAB for physical devices
      # - F-Droid: four per-ABI APKs, including x86/x86_64, via fdroiddata metadata/build props
      # Local gradle.properties keeps parallel/workers low for laptops; CI overrides those.
      # setup-gradle prefers leaving the daemon on (no --no-daemon).
      - name: Build debug APK (PR, arm64-v8a only)
        if: github.event_name == 'pull_request'
        working-directory: formulus/android
        env:
          ORG_GRADLE_PROJECT_reactNativeArchitectures: ${{ env.FORMULUS_ABIS_SMOKE }}
        run: >
          ./gradlew assembleDebug --stacktrace
          -Dorg.gradle.parallel=true
          -Dorg.gradle.workers.max=4
          -PreactNativeArchitectures=${{ env.FORMULUS_ABIS_SMOKE }}

      - name: Build release universal APK + AAB (push main/dev)
        if: github.event_name == 'push'
        working-directory: formulus/android
        env:
          ORG_GRADLE_PROJECT_reactNativeArchitectures: ${{ env.FORMULUS_ABIS_RELEASE }}
        run: >
          ./gradlew assembleRelease bundleRelease --stacktrace
          -Dorg.gradle.parallel=true
          -Dorg.gradle.workers.max=4
          -PreactNativeArchitectures=${{ env.FORMULUS_ABIS_RELEASE }}

      - name: Build release universal APK + AAB (GitHub Release)
        if: github.event_name == 'release'
        working-directory: formulus/android
        env:
          ORG_GRADLE_PROJECT_reactNativeArchitectures: ${{ env.FORMULUS_ABIS_RELEASE }}
        run: >
          ./gradlew assembleRelease bundleRelease --stacktrace
          -Dorg.gradle.parallel=true
          -Dorg.gradle.workers.max=4
          -PreactNativeArchitectures=${{ env.FORMULUS_ABIS_RELEASE }}

      - name: Upload APK artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: formulus-android-apk-${{ github.event_name }}-${{ github.run_id }}
          path: |
            formulus/android/app/build/outputs/apk/**/**/*.apk

      - name: Upload AAB artifact
        if: github.event_name != 'pull_request'
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: formulus-android-aab-${{ github.event_name }}-${{ github.run_id }}
          path: |
            formulus/android/app/build/outputs/bundle/release/*.aab

      - name: Upload universal APK + AAB to GitHub Release
        if: github.event_name == 'release'
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          files: |
            formulus/android/app/build/outputs/apk/**/**/*-universal-*.apk
            formulus/android/app/build/outputs/bundle/release/*.aab
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  prepare-next-native-build-code:
    name: Prepare next Formulus build code
    if: github.event_name == 'release' && needs.build-android.result == 'success'
    needs: build-android
    permissions:
      contents: write
      pull-requests: write
    uses: ./.github/workflows/prepare-next-formulus-build-code.yml
    with:
      target_branch: ${{ github.event.release.target_commitish }}
      dry_run: false
    secrets: inherit