ci.yml

name: CI

on:
  push:
    branches: [ develop ]
  pull_request:
    branches: [ develop ]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest

    permissions:
      contents: read
      security-events: write

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up JDK 21
        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v6.3.0

      # The WebView renderers execute these files. Nothing else notices if one is
      # hand-edited, replaced, or left behind by a repin -- the app just runs it.
      - name: Verify vendored web assets
        run: scripts/vendor-web-assets.py --check

      - name: Run lint
        run: ./gradlew detekt detektMetadataCommonMain :app:lint --continue

      - name: Upload detekt SARIF
        if: always() && hashFiles('build/reports/detekt/merged.sarif') != ''
        uses: github/codeql-action/upload-sarif@v4.37.9
        with:
          sarif_file: build/reports/detekt/merged.sarif
          category: detekt

      - name: Upload lint report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: lint-report
          path: app/build/reports/lint-results-debug.html
          if-no-files-found: ignore

  test:
    name: Test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up JDK 21
        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v6.3.0

      - name: Run tests
        run: ./gradlew test

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: test-results
          path: '**/build/test-results/test*/TEST-*.xml'
          if-no-files-found: ignore

  android:
    name: Build Android App
    runs-on: ubuntu-latest

    permissions:
      contents: read
      pull-requests: write

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up JDK 21
        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v6.3.0

      - name: Build debug APK
        run: ./gradlew :app:assembleDebug

      # Compile-only gate for :feature:chat's instrumented tests (they execute on a
      # local emulator via connectedDebugAndroidTest, never in CI). Scoped to the one
      # module on purpose: a repo-wide assembleDebugAndroidTest would also compile
      # :app's stale androidTest sources.
      - name: Compile chat instrumented tests
        run: ./gradlew :feature:chat:assembleDebugAndroidTest

      - name: Upload debug APK
        id: upload_apk
        if: always() && hashFiles('app/build/outputs/apk/debug/app-debug.apk') != ''
        uses: actions/upload-artifact@v7
        with:
          name: switchboard-android-debug-${{ github.event.pull_request.number || github.sha }}
          path: app/build/outputs/apk/debug/app-debug.apk
          retention-days: 90
          if-no-files-found: error

      - name: Write APK summary
        if: always() && steps.upload_apk.outputs.artifact-url != ''
        env:
          ARTIFACT_NAME: switchboard-android-debug-${{ github.event.pull_request.number || github.sha }}
          ARTIFACT_URL: ${{ steps.upload_apk.outputs.artifact-url }}
        run: |
          {
            echo "## Android debug APK"
            echo ""
            echo "- **Artifact:** \`$ARTIFACT_NAME\`"
            echo "- **Download:** [$ARTIFACT_NAME.zip]($ARTIFACT_URL)"
            echo "- **Retention:** 90 days"
            echo ""
            echo "> Download requires a GitHub login. Installs over previous debug builds without uninstalling (stable signing key)."
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Post APK link to PR
        if: always() && github.event_name == 'pull_request' && steps.upload_apk.outputs.artifact-url != ''
        continue-on-error: true
        uses: marocchino/sticky-pull-request-comment@v3
        with:
          header: android-debug-apk
          message: |
            ## Android debug APK

            **Artifact:** `switchboard-android-debug-${{ github.event.pull_request.number }}`
            **Download:** [switchboard-android-debug-${{ github.event.pull_request.number }}.zip](${{ steps.upload_apk.outputs.artifact-url }})
            **Retention:** 90 days
            **Commit:** `${{ github.event.pull_request.head.sha }}`

            > Download requires a GitHub login. Installs over previous debug builds without uninstalling (stable signing key).

  ios:
    name: Build iOS App
    runs-on: macos-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Select Xcode
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: latest-stable

      - name: Set up JDK 21
        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v6.3.0

      - name: Cache Kotlin/Native toolchain
        uses: actions/cache@v6
        with:
          path: ~/.konan
          key: ${{ runner.os }}-konan-${{ hashFiles('gradle/libs.versions.toml') }}
          restore-keys: ${{ runner.os }}-konan-

      # Exercises the real iOS Koin graph (iOS actuals) on the simulator arch — the
      # first automated check of iOS DI. The ubuntu `test` job can't run K/N tests.
      - name: iOS Koin graph test
        run: ./gradlew :shared:iosSimulatorArm64Test

      # The Kotlin framework is built by the Xcode "Compile Kotlin Framework" build
      # phase (./gradlew :shared:embedAndSignAppleFrameworkForXcode) — no separate
      # link step needed. Direct integration; see iosApp/README.md.
      - name: Build iOS app
        run: |
          xcodebuild -project iosApp/iosApp.xcodeproj \
            -scheme iosApp \
            -sdk iphonesimulator \
            -destination 'generic/platform=iOS Simulator' \
            -configuration Debug \
            build \
            CODE_SIGNING_ALLOWED=NO \
            ARCHS=arm64 \
            ONLY_ACTIVE_ARCH=YES

  ios-release-link:
    name: iOS Release Link (OOM canary)
    runs-on: macos-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Select Xcode
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: latest-stable

      - name: Set up JDK 21
        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v6.3.0

      - name: Cache Kotlin/Native toolchain
        uses: actions/cache@v6
        with:
          path: ~/.konan
          key: ${{ runner.os }}-konan-${{ hashFiles('gradle/libs.versions.toml') }}
          restore-keys: ${{ runner.os }}-konan-

      # The Release device link runs Kotlin/Native's whole-program optimization pass
      # (DevirtualizationAnalysis), whose memory use grows with total code size and
      # OOM'd the 7 GB runner on every release from Jul 2 to Jul 25, 2026 (KT-80367;
      # the #200 ktor pin was a stopgap that code growth overtook). The Debug/simulator
      # builds above skip that pass entirely, so without this job the first signal that
      # the IPA / App Store archive can't link is a failed release. Same task, same
      # heap cap (gradle.properties -Xmx6g) as release.yml and appstore.yml.
      - name: Link Release framework (device)
        run: ./gradlew :shared:linkReleaseFrameworkIosArm64