BuildOnPushMain.yml

name: CI on push to main

on:
  pull_request:
    paths-ignore:
      - '**/*.md'
    branches:
      - main
  push:
    paths-ignore:
      - '**/*.md'
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

env:
  CI: true
  TERM: dumb
  GRADLE_OPTS: >-
    -Dorg.gradle.jvmargs="-Xmx4G -XX:MaxMetaspaceSize=1g -XX:SoftRefLRUPolicyMSPerMB=10 -XX:+UseParallelGC"
    -Dorg.gradle.dependency.verification.console=verbose
  KOTLIN_DAEMON_JVMARGS: >-
    -Xmx1G -XX:MaxMetaspaceSize=320M -XX:SoftRefLRUPolicyMSPerMB=10 -XX:+UseParallelGC -XX:NewRatio=1

jobs:
  assemble:
    name: Assemble release
    runs-on: ubuntu-latest
    timeout-minutes: 60
    if: ${{ !contains(github.event.head_commit.message, '[ci skip]') }}

    steps:
      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          clean: true
          fetch-depth: 0
          lfs: true
          submodules: true

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '21'

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v3
        with:
          dependency-graph: generate

      - name: Unpack sign keys and secrets
        env:
          SIGN_KEYS_AND_SECRETS: ${{ secrets.SIGN_KEYS_AND_SECRETS }}
        run: echo "$SIGN_KEYS_AND_SECRETS" | base64 -d | zstd -d | tar -xf -

      - name: Assemble release build, run static-analysis, build release
        run: >
          ./gradlew -Pkotlin.daemon.jvmargs="${{ env.KOTLIN_DAEMON_JVMARGS }}"
          app:lintRelease assembleRelease --scan --stacktrace

      - name: Cleanup secrets
        if: ${{ always() }}
        run: |
          rm -f config/signing/release.jks
          rm -f config/release_keystore.properties
          rm -f config/pixnews.properties

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-outputs
          path: app/build/outputs

      - name: Bundle the build report and lint outputs
        if: ${{ !cancelled() }}
        run: >
          find . \(
          -name .idea -o -path '*build/intermediates' -o -path '*build/.transforms' -o -path '*build/generated'
          \) -prune -o
          -type d \( -name 'reports' -o -name 'compose-metrics' -o -name 'compose-reports' -o -name 'out' \) -print0
          | xargs -0 tar -c -I 'zstd -19 -T0' -f test-reports.tar.zst

      - name: Upload test results
        uses: actions/upload-artifact@v4
        if: ${{ !cancelled() }}
        with:
          name: test-reports
          path: test-reports.tar.zst

      - name: Uploads lint .sarif files to GitHub
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: app/build/reports/
          category: android-lint

  instrumented-tests:
    name: Instrumented tests
    runs-on: ubuntu-latest
    timeout-minutes: 60
    if: ${{ !contains(github.event.head_commit.message, '[ci skip]') }}

    steps:
      - name: Enable KVM group perms
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm
          ls /dev/kvm

      - name: Checkout sources
        uses: actions/checkout@v4
        with:
          clean: true
          fetch-depth: 0
          lfs: true
          submodules: true

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '21'

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v3
        with:
          dependency-graph: generate

      - name: Accept licenses
        run: |
          yes | ${ANDROID_HOME}/cmdline-tools/latest/bin/sdkmanager --licenses

      - name: Unpack pixnews.properties
        env:
          PIXNEWS_CONFIG: ${{ secrets.PIXNEWS_CONFIG }}
        run: echo "$PIXNEWS_CONFIG" | base64 -d | zstd -d  -o config/pixnews.properties

      - name: Run instrumented tests
        run: >
          ./gradlew
          -Pkotlin.daemon.jvmargs="${{ env.KOTLIN_DAEMON_JVMARGS }}"
          -Dorg.gradle.workers.max=1
          -Pandroid.testInstrumentationRunnerArguments.androidx.benchmark.enabledRules=""
          pixel2api30DebugAndroidTest
          --scan --continue

      - name: Cleanup secrets
        if: ${{ always() }}
        run: rm -f config/pixnews.properties

      - name: Publish instrumented test results
        uses: EnricoMi/publish-unit-test-result-action/linux@v2
        if: ${{ !cancelled() }}
        with:
          comment_mode: off
          junit_files: '**/build/outputs/androidTest-results/**/*.xml'
          check_name: "Instrumented test results"

      - name: Bundle the instrumented tests report
        if: ${{ failure() }}
        run: >-
          find . -type d \( -path '*/build/compose-*'
          -o -path '*/build/outputs/androidTest-results'
          -o -path '*/build/outputs/managed_*'
          -o -path '*/build/reports/androidTests' \) -print0
          | xargs -0 tar -c -I 'zstd -19 -T0' -f instrumented-tests.tar.zst

      - name: Upload test reports
        if: ${{ failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: instrumented-test-reports
          path: instrumented-tests.tar.zst