name: Android validation
on:
  push:
  pull_request:
  workflow_dispatch:
permissions:
  contents: read
concurrency:
  group: android-${{ github.ref }}
  cancel-in-progress: true
jobs:
  build:
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        env:
          GIT_DEFAULT_HASH: sha256
        with:
          persist-credentials: false
      - run: bash scripts/check-ci-runner.sh android
      - uses: https://github.com/actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
        with:
          distribution: temurin
          java-version: '17'
      - uses: https://github.com/android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
        with:
          packages: 'platform-tools platforms;android-37.0 build-tools;36.0.0'
          log-accepted-android-sdk-licenses: false
      - name: Build, test and lint (release remains unsigned)
        run: bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease
      - name: Source formatting and repository invariants
        run: |
          bash scripts/check-format.sh
          python3 scripts/check-repository.py
          python3 -m py_compile scripts/*.py
          python3 scripts/test-verifier.py
          python3 scripts/test-ci-runner.py
          python3 scripts/test-integration-evidence.py
      - name: Check dependencies against OSV
        run: python3 scripts/check-dependencies.py
      - name: Upload installable native debug preview
        uses: https://gitea.com/actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de
        with:
          name: android-native-debug-apk
          path: android/app/build/outputs/apk/debug/app-debug.apk
          if-no-files-found: error
          retention-days: 14
      - uses: https://gitea.com/actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de # v3.2.2-node20 (Gitea artifact protocol)
        if: always()
        with:
          name: android-builds-and-reports
          path: |
            android/app/build/outputs/apk/debug/*.apk
            android/app/build/outputs/apk/release/*unsigned.apk
            android/app/build/outputs/bundle/release/*.aab
            android/app/build/reports/
          retention-days: 14
  emulator:
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        api: ['35', '37.0']
    timeout-minutes: 60
    steps:
      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        env:
          GIT_DEFAULT_HASH: sha256
        with:
          persist-credentials: false
      - run: bash scripts/check-ci-runner.sh emulator
      - uses: https://github.com/actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3
        with:
          distribution: temurin
          java-version: '17'
      - uses: https://github.com/android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407
        with:
          packages: 'platform-tools platforms;android-37.0 build-tools;36.0.0'
          log-accepted-android-sdk-licenses: false
      - uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '22.22.1'
      - name: Prepare pinned, unmodified upstream
        run: |
          upstream=$(mktemp -d "$RUNNER_TEMP/yuvomi-upstream.XXXXXX")
          echo "YUVOMI_UPSTREAM=$upstream" >> "$GITHUB_ENV"
          git clone --filter=blob:none https://github.com/ulsklyc/yuvomi.git "$upstream"
          git -C "$upstream" checkout 10bfef7686ed7303b4c74c7fcc55a5eb16356c9d
          npm ci --omit=dev --prefix "$upstream"
      - uses: https://github.com/reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2
        with:
          api-level: ${{ matrix.api }}
          arch: x86_64
          target: google_apis
          disable-animations: true
          script: |
            bash android/gradlew -p android connectedDebugAndroidTest
            python3 scripts/verify-test-results.py android/app/build/outputs/androidTest-results/connected/debug --minimum 9
            python3 scripts/test-integration.py "$YUVOMI_UPSTREAM" --android
            python3 scripts/test-integration.py "$YUVOMI_UPSTREAM" --android --cookie-without-secure
      - uses: https://gitea.com/actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de
        if: always()
        with:
          name: android-device-test-reports-${{ matrix.api }}
          path: |
            android/app/build/reports/androidTests/
            android/app/build/outputs/native-screenshots/
          retention-days: 14
      - name: Remove only this job's allocated upstream fixture
        if: always()
        run: |
          case "${YUVOMI_UPSTREAM:-}" in
            "$RUNNER_TEMP"/yuvomi-upstream.*) rm -rf -- "$YUVOMI_UPSTREAM" ;;
          esac