ci.yaml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:

jobs:

  build-lib:
    runs-on: ubuntu-24.04
    permissions:
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up temurin-jdk-17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v3

      - name: Setup Android SDK + NDK r28
        uses: android-actions/setup-android@v3
        with:
          packages: ndk;28.0.13004108

      - name: Build
        run: ./gradlew :lib:assembleRelease

      - name: Verify 16 KB page alignment
        run: |
          failed=0
          for so in lib/build/intermediates/cxx/RelWithDebInfo/*/obj/*.so; do
            echo "Checking $(basename "$so")..."
            while read -r line; do
              align=$(echo "$line" | grep -oP 'Align: 0x\K[0-9a-fA-F]+')
              if [ "$align" != "4000" ]; then
                echo "FAIL: $(basename "$so") has alignment 0x$align (expected 0x4000)"
                failed=1
              fi
            done < <(readelf -lL "$so" | grep LOAD)
          done
          exit $failed

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: lib
          path: lib/build/outputs/aar/*-release.aar

      # Only publish snapshots on push to main or on PRs from the same repo (not forks)
      - name: Resolve snapshot version
        id: version
        if: >-
          (github.event_name == 'push' && github.ref_name == 'main') ||
          (github.event_name == 'pull_request' &&
           github.event.pull_request.head.repo.full_name == github.repository)
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            echo "VERSION=PR-${{ github.event.pull_request.number }}-SNAPSHOT" >> $GITHUB_OUTPUT
          else
            echo "VERSION=main-SNAPSHOT" >> $GITHUB_OUTPUT
          fi

      - name: Stage snapshot artifacts
        if: steps.version.outputs.VERSION != ''
        run: >
          ./gradlew :lib:publishReleasePublicationToStagingDeployRepository
          -Puvccamera.version=${{ steps.version.outputs.VERSION }}

      - name: Check secrets
        id: check-secrets
        if: steps.version.outputs.VERSION != ''
        run: |
          echo "has_maven=${{ secrets.MAVEN_CENTRAL_USERNAME != '' && secrets.MAVEN_CENTRAL_PASSWORD != '' }}" >> $GITHUB_OUTPUT
          echo "has_gpg=${{ secrets.GPG_PUBLIC_KEY != '' && secrets.GPG_PRIVATE_KEY != '' }}" >> $GITHUB_OUTPUT

      - name: Publish snapshot to Maven Central
        if: >-
          github.event_name == 'push' && github.ref_name == 'main'
          && steps.check-secrets.outputs.has_maven == 'true'
          && steps.check-secrets.outputs.has_gpg == 'true'
        env:
          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          JRELEASER_NEXUS2_SNAPSHOTS_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          JRELEASER_NEXUS2_SNAPSHOTS_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          JRELEASER_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
          JRELEASER_GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }}
          JRELEASER_GPG_SECRET_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        run: ./gradlew jreleaserDeploy --no-configuration-cache -Puvccamera.version=main-SNAPSHOT

      - name: Publish snapshot to GitHub Packages
        if: >-
          github.event_name == 'push' && github.ref_name == 'main'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: >
          ./gradlew :lib:publishReleasePublicationToGitHubPackagesRepository
          -Puvccamera.version=main-SNAPSHOT