android.yml

name: Android CI

on:
  push:
    branches:
      - main
    tags:
      - "v*"
  pull_request:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: android-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}

jobs:
  build:
    name: Test and build APK
    runs-on: ubuntu-latest
    timeout-minutes: 45

    steps:
      - name: Check out source
        uses: actions/checkout@v7
        with:
          submodules: recursive

      - name: Set up JDK 17
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: "17"

      - name: Set up Android SDK
        uses: android-actions/setup-android@v4

      - name: Install pinned Android toolchain
        shell: bash
        run: |
          sdkmanager \
            "platforms;android-36" \
            "build-tools;36.0.0" \
            "ndk;28.2.13676358"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v6

      - name: Build and self-test XI2 Touchscope probe
        shell: bash
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends \
            desktop-file-utils \
            libx11-dev \
            libxi-dev
          make -C tools/touchscope
          tools/touchscope/touchscope --self-test
          desktop-file-validate tools/touchscope/touchscope.desktop
          make -C tools/touchscope clean

      - name: Prepare stable update signing
        if: startsWith(github.ref, 'refs/tags/v')
        shell: bash
        env:
          SIGNING_STORE_BASE64: ${{ secrets.UDROID_SIGNING_STORE_BASE64 }}
          SIGNING_STORE_PASSWORD: ${{ secrets.UDROID_SIGNING_STORE_PASSWORD }}
          SIGNING_KEY_ALIAS: ${{ secrets.UDROID_SIGNING_KEY_ALIAS }}
          SIGNING_KEY_PASSWORD: ${{ secrets.UDROID_SIGNING_KEY_PASSWORD }}
        run: |
          : "${SIGNING_STORE_BASE64:?UDROID_SIGNING_STORE_BASE64 is required}"
          : "${SIGNING_STORE_PASSWORD:?UDROID_SIGNING_STORE_PASSWORD is required}"
          : "${SIGNING_KEY_ALIAS:?UDROID_SIGNING_KEY_ALIAS is required}"
          : "${SIGNING_KEY_PASSWORD:?UDROID_SIGNING_KEY_PASSWORD is required}"
          printf '%s' "${SIGNING_STORE_BASE64}" \
            | base64 --decode > "${RUNNER_TEMP}/udroid-updates.p12"
          echo "UDROID_SIGNING_STORE_FILE=${RUNNER_TEMP}/udroid-updates.p12" >> "${GITHUB_ENV}"
          echo "UDROID_SIGNING_STORE_PASSWORD=${SIGNING_STORE_PASSWORD}" >> "${GITHUB_ENV}"
          echo "UDROID_SIGNING_KEY_ALIAS=${SIGNING_KEY_ALIAS}" >> "${GITHUB_ENV}"
          echo "UDROID_SIGNING_KEY_PASSWORD=${SIGNING_KEY_PASSWORD}" >> "${GITHUB_ENV}"

      - name: Verify release tag matches Android version
        if: startsWith(github.ref, 'refs/tags/v')
        shell: bash
        run: |
          VERSION_NAME="$(
            sed -n 's/^[[:space:]]*versionName = "\(.*\)"/\1/p' app/build.gradle.kts
          )"
          test -n "${VERSION_NAME}"
          test "v${VERSION_NAME}" = "${GITHUB_REF_NAME}"

      - name: Select APK variant and artifact identity
        id: apk
        shell: bash
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            VARIANT="release"
            LINT_TASK="lintRelease"
            ASSEMBLE_TASK="assembleRelease"
            APK_PATH="app/build/outputs/apk/release/app-release.apk"
            ARTIFACT_NAME="udroid-${GITHUB_REF_NAME}-prerelease"
          elif [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then
            test -n "${PR_NUMBER}"
            test -n "${PR_HEAD_SHA}"
            VARIANT="dev"
            LINT_TASK="lintDev"
            ASSEMBLE_TASK="assembleDev"
            APK_PATH="app/build/outputs/apk/dev/app-dev.apk"
            ARTIFACT_NAME="udroid-pr-${PR_NUMBER}-${PR_HEAD_SHA:0:7}-dev"
          else
            VARIANT="dev"
            LINT_TASK="lintDev"
            ASSEMBLE_TASK="assembleDev"
            APK_PATH="app/build/outputs/apk/dev/app-dev.apk"
            ARTIFACT_NAME="udroid-${GITHUB_REF_NAME//\//-}-${GITHUB_SHA:0:7}-dev"
          fi

          if [[ ! "${ARTIFACT_NAME}" =~ ^[A-Za-z0-9._-]+$ ]]; then
            echo "Unsafe artifact name: ${ARTIFACT_NAME}" >&2
            exit 1
          fi

          echo "variant=${VARIANT}" >> "${GITHUB_OUTPUT}"
          echo "lint_task=${LINT_TASK}" >> "${GITHUB_OUTPUT}"
          echo "assemble_task=${ASSEMBLE_TASK}" >> "${GITHUB_OUTPUT}"
          echo "apk_path=${APK_PATH}" >> "${GITHUB_OUTPUT}"
          echo "artifact_name=${ARTIFACT_NAME}" >> "${GITHUB_OUTPUT}"
          echo "asset_name=${ARTIFACT_NAME}.apk" >> "${GITHUB_OUTPUT}"

      - name: Test, lint, and assemble optimized APK
        run: >-
          ./gradlew --no-daemon
          testDebugUnitTest
          ${{ steps.apk.outputs.lint_task }}
          ${{ steps.apk.outputs.assemble_task }}

      - name: Verify embedded X11 release JNI contract
        run: tools/verify-release-jni-contract.sh "${{ steps.apk.outputs.apk_path }}"

      - name: Package release assets
        shell: bash
        env:
          APK_PATH: ${{ steps.apk.outputs.apk_path }}
          ASSET_NAME: ${{ steps.apk.outputs.asset_name }}
        run: |
          mkdir -p release-assets
          cp "${APK_PATH}" "release-assets/${ASSET_NAME}"
          (
            cd release-assets
            sha256sum "${ASSET_NAME}" > SHA256SUMS
          )

      - name: Upload APK artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ steps.apk.outputs.artifact_name }}
          path: release-assets/*
          if-no-files-found: error
          retention-days: 30

  release:
    name: Publish GitHub prerelease
    if: startsWith(github.ref, 'refs/tags/v')
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write

    steps:
      - name: Download verified build assets
        uses: actions/download-artifact@v8
        with:
          name: udroid-${{ github.ref_name }}-prerelease
          path: release-assets

      - name: Publish tagged prerelease
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "${GITHUB_REF_NAME}" \
            release-assets/* \
            --repo "${GITHUB_REPOSITORY}" \
            --verify-tag \
            --prerelease \
            --title "uDroid ${GITHUB_REF_NAME}" \
            --notes "Extremely early development build for testing and contributor feedback. Expect breaking changes and incomplete features. This universal optimized APK uses the project update-signing key and is not a production release."