inventory-android/.github/workflows/ci.yml at main · spdotdev/inventory-android · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
name: CI

# Supersede an in-flight run when a newer commit lands on the same ref, so
# rapid pushes/PR updates don't stack redundant (and, for the emulator/MySQL
# jobs, expensive) runs.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Compile + style + lint + unit tests for the Android client.
#
# Style gating (ktlint + detekt) runs against committed baselines in app/ —
# it fails only on NEW violations. Android lint stays reported but non-fatal
# (see app/build.gradle.kts).

on:
  push:
    branches: [ main ]
    paths:
      - 'app/**'
      - '**/*.kt'
      - '**/*.kts'
      - '**/build.gradle*'
      - 'settings.gradle*'
      - 'gradle/**'
      - 'gradlew'
      - 'gradle.properties'
      # Run the suite when the workflow itself changes, so CI edits are validated.
      - '.github/workflows/ci.yml'
  pull_request:
    paths:
      - 'app/**'
      - '**/*.kt'
      - '**/*.kts'
      - '**/build.gradle*'
      - 'settings.gradle*'
      - 'gradle/**'
      - 'gradlew'
      - 'gradle.properties'
      # Run the suite when the workflow itself changes, so CI edits are validated.
      - '.github/workflows/ci.yml'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      # Verify the committed gradle-wrapper.jar matches a known-good Gradle
      # release checksum (it was fetched from Gradle's official release tag).
      - name: Validate Gradle wrapper
        uses: gradle/actions/wrapper-validation@v6

      - name: Setup JDK
        uses: actions/setup-java@v6.1.0
        with:
          distribution: temurin
          java-version: '17'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v6

      - name: Style gate (ktlint + detekt, baseline-aware)
        run: ./gradlew ktlintCheck detekt

      - name: Unit tests
        run: ./gradlew testDebugUnitTest

      - name: Android lint
        run: ./gradlew lint

      # The debug build signs with a keystore restored from a secret. Fork PRs run
      # without secrets, so the APK steps below are gated on the secret being present
      # — a fork PR still gets unit tests + lint (the real gates) and goes green,
      # instead of red-failing on missing signing infra it can never have.
      - name: Check for signing secret
        id: signing
        env:
          DEBUG_KEYSTORE_B64: ${{ secrets.DEBUG_KEYSTORE_B64 }}
        run: |
          if [ -n "$DEBUG_KEYSTORE_B64" ]; then
            echo "available=true" >> "$GITHUB_OUTPUT"
          else
            echo "available=false — skipping APK build (fork PR / no secret)"
            echo "available=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Restore debug keystore
        if: steps.signing.outputs.available == 'true'
        env:
          DEBUG_KEYSTORE_B64: ${{ secrets.DEBUG_KEYSTORE_B64 }}
        run: |
          mkdir -p ~/.android
          echo "$DEBUG_KEYSTORE_B64" | base64 -d > ~/.android/inventory-debug.jks

      - name: Build debug APK
        if: steps.signing.outputs.available == 'true'
        run: ./gradlew assembleDebug
        env:
          DEBUG_KEYSTORE_PASSWORD: ${{ secrets.DEBUG_KEYSTORE_PASSWORD }}
          DEBUG_KEY_ALIAS: ${{ secrets.DEBUG_KEY_ALIAS }}
          DEBUG_KEY_PASSWORD: ${{ secrets.DEBUG_KEY_PASSWORD }}

      - name: Upload debug APK (preview)
        if: steps.signing.outputs.available == 'true'
        uses: actions/upload-artifact@v7
        with:
          name: app-debug-preview
          path: app/build/outputs/apk/debug/app-debug.apk
          retention-days: 7