android.yml

name: Android

on:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: write

# One run per branch at a time, so a newer default-branch build never ends up behind an older Latest.
# On other branches and pull requests a new push cancels the run it replaces instead of waiting behind it.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != format('refs/heads/{0}', github.event.repository.default_branch) }}

jobs:
  # The screen previews (tools/ui-preview): every scene in dark and light, for the reviewer to look at.
  # One after the other they take over half an hour, so four runners take a quarter of the scenes each.
  render:
    name: render (${{ matrix.shard }}/4)
    runs-on: ubuntu-latest
    # A shard renders in about 10 minutes; a scene that hangs fails the run itself after 2 minutes.
    timeout-minutes: 25
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4]
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17

      - uses: gradle/actions/setup-gradle@v4

      - name: Render screens
        run: ./gradlew -p tools/ui-preview render -Pshard=${{ matrix.shard }}/4

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: herdr-screens-${{ github.run_number }}-${{ matrix.shard }}
          path: tools/ui-preview/build/shots/
          if-no-files-found: ignore

  # The four shards' shots as one herdr-screens-<run> artifact, and one check that passes when they all did.
  screens:
    needs: render
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/upload-artifact/merge@v4
        with:
          name: herdr-screens-${{ github.run_number }}
          pattern: herdr-screens-${{ github.run_number }}-*
          delete-merged: true

      - name: Every shard rendered
        if: always() && needs.render.result != 'success'
        run: |
          echo "::error::Rendering the screens ${{ needs.render.result }}; see the render jobs' logs (a stuck scene prints HANG and every thread's stack)."
          exit 1

  build:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      # Only the default branch publishes a release; everything else is a run artifact.
      PUBLISH: ${{ github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17

      - uses: gradle/actions/setup-gradle@v4

      - name: Core tests
        run: ./gradlew -p core test

      # What failed, with every message and the tests' own output, when the log isn't enough.
      - name: Core test reports
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: core-test-reports-${{ github.run_number }}
          path: |
            core/build/reports/tests/test/
            core/build/test-results/test/

      # The fixed signing key, so every APK installs over the last one and keeps the app's data.
      # Missing secrets (forks, pull requests from forks) fall back to the debug key.
      - name: Signing key
        env:
          HERDR_KEYSTORE_BASE64: ${{ secrets.HERDR_KEYSTORE_BASE64 }}
        run: |
          if [ -n "$HERDR_KEYSTORE_BASE64" ]; then
            echo "$HERDR_KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/herdr.jks"
            echo "HERDR_KEYSTORE_FILE=$RUNNER_TEMP/herdr.jks" >> "$GITHUB_ENV"
          else
            echo "::warning::HERDR_KEYSTORE_BASE64 is not set; this APK is signed with a throwaway debug key and won't update an installed app."
          fi

      - name: Build APK
        env:
          HERDR_KEYSTORE_PASSWORD: ${{ secrets.HERDR_KEYSTORE_PASSWORD }}
          HERDR_KEY_ALIAS: ${{ secrets.HERDR_KEY_ALIAS }}
          HERDR_KEY_PASSWORD: ${{ secrets.HERDR_KEY_PASSWORD }}
        run: ./gradlew :app:assembleRelease

      - name: Rename APK
        run: |
          mkdir -p out
          cp app/build/outputs/apk/release/app-release.apk out/herdr-android.apk

      - uses: actions/upload-artifact@v4
        with:
          name: herdr-android-${{ github.run_number }}
          path: out/herdr-android.apk

      # A normal release marked Latest, so releases/latest always has the newest APK under the same name.
      - name: Publish release
        if: env.PUBLISH == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if [ -z "$HERDR_KEYSTORE_FILE" ]; then
            echo "::warning::No release published: set the HERDR_KEYSTORE_* secrets (see README). A debug-signed APK can't update the installed app."
            exit 0
          fi
          version="0.1.${GITHUB_RUN_NUMBER}"
          if gh release view "v${version}" >/dev/null 2>&1; then
            # A re-run of the same build: replace its APK.
            gh release upload "v${version}" out/herdr-android.apk --clobber
          else
            gh release create "v${version}" out/herdr-android.apk --latest --target "$GITHUB_SHA" \
              --title "Herdr for Android ${version}" \
              --notes "Build ${GITHUB_RUN_NUMBER} of ${GITHUB_SHA}. On your phone, open herdr-android.apk below to install or update the app; it keeps its data and SSH key."
          fi

      # Branch builds used to publish rolling apk-<branch> pre-releases; clear them out, but only
      # once a real release has replaced them, so Releases always has an APK to install.
      - name: Remove old branch pre-releases
        if: env.PUBLISH == 'true' && env.HERDR_KEYSTORE_FILE != ''
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release list --limit 200 --json tagName --jq '.[].tagName | select(startswith("apk-"))' |
            while read -r tag; do gh release delete "$tag" --yes --cleanup-tag; done