Keep downloads out of backups and align privacy, notices and the release gate #341
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Android build and releases | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: android-ci-${{ github.event.pull_request.number || github.ref_name }} | |
| cancel-in-progress: true | |
| jobs: | |
| verify-build: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Java 17 | |
| uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4 | |
| with: | |
| distribution: temurin | |
| java-version: "17" | |
| - name: Set up Android SDK | |
| uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3 | |
| with: | |
| packages: platform-tools | |
| - name: Install Android build SDK | |
| run: sdkmanager "platforms;android-36" "build-tools;36.0.0" | |
| - name: Set up Gradle cache | |
| uses: gradle/actions/setup-gradle@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4 | |
| - name: Restore persistent preview signing key | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | |
| with: | |
| path: ~/.android/debug.keystore | |
| key: dual-sub-replay-preview-signing-v1 | |
| - name: Test release automation | |
| run: python3 -m unittest discover -s tools/tests -p 'test_*.py' -v | |
| - name: Verify Gradle wrapper | |
| run: bash ./gradlew --version | |
| - name: Test, lint, and build | |
| run: | | |
| set -euo pipefail | |
| preview_version_code=$(( $(date -u +%s) - 1700000000 )) | |
| bash ./gradlew formatCheck complexityCheck testDebugUnitTest lintDebug assembleDebug assembleDebugAndroidTest \ | |
| -PpreviewVersionCode="$preview_version_code" \ | |
| -PpreviewVersionNameSuffix="-pr${{ github.event.pull_request.number || 'manual' }}-build${GITHUB_RUN_NUMBER}" \ | |
| -PpreviewApplicationIdSuffix=".preview" \ | |
| --stacktrace | |
| - name: Verify preview package id | |
| run: | | |
| badging="$("$ANDROID_HOME/build-tools/36.0.0/aapt" dump badging app/build/outputs/apk/debug/app-debug.apk | head -n 1)" | |
| echo "$badging" | |
| if [[ "$badging" != *"name='com.kienhoang.dualsubreplay.preview'"* ]]; then | |
| echo "Preview APK does not use the isolated preview application id" >&2 | |
| exit 1 | |
| fi | |
| - name: Name preview APK | |
| run: cp app/build/outputs/apk/debug/app-debug.apk DualSub-Replay-preview.apk | |
| - name: Upload verified preview APK | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: DualSub-Replay-preview | |
| path: DualSub-Replay-preview.apk | |
| if-no-files-found: error | |
| retention-days: 7 | |
| - name: Build optimized release APK with test signing | |
| run: | | |
| set -euo pipefail | |
| bash ./gradlew assembleRelease \ | |
| -PtestReleaseSigning=true \ | |
| -PpreviewApplicationIdSuffix=".releasesmoke" \ | |
| --stacktrace | |
| - name: Verify release APK size, permissions, and forbidden components | |
| run: | | |
| python3 tools/report_apk.py app/build/outputs/apk/release/app-release.apk \ | |
| --max-bytes 80000000 \ | |
| --stretch-bytes 40000000 \ | |
| --output-json apk-size-report.json | |
| - name: Upload size report and R8 mapping | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: release-size-and-r8-mapping | |
| path: | | |
| apk-size-report.json | |
| app/build/outputs/mapping/release/mapping.txt | |
| if-no-files-found: warn | |
| retention-days: 14 | |
| fdroid-build: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - name: Check out source with engine submodules | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| - name: Set up Java 17 | |
| uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4 | |
| with: | |
| distribution: temurin | |
| java-version: "17" | |
| - name: Set up Android SDK | |
| uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3 | |
| with: | |
| packages: platform-tools | |
| - name: Install Android build SDK, NDK and CMake | |
| run: sdkmanager "platforms;android-36" "build-tools;36.0.0" "ndk;28.2.13676358" "cmake;3.22.1" | |
| - name: Set up Gradle cache | |
| uses: gradle/actions/setup-gradle@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4 | |
| - name: Build unsigned F-Droid release APK | |
| run: bash ./gradlew lintRelease assembleRelease -Pdistribution=fdroid --stacktrace | |
| - name: Verify F-Droid APK has the engine and no proprietary Google libraries | |
| run: | | |
| set -euo pipefail | |
| apk=app/build/outputs/apk/release/app-release-unsigned.apk | |
| test -f "$apk" | |
| for abi in arm64-v8a x86_64; do | |
| unzip -l "$apk" "lib/$abi/libdualsub_bergamot.so" > /dev/null | |
| done | |
| if unzip -p "$apk" 'classes*.dex' | grep -a -o -E 'Lcom/google/(mlkit|android/gms|firebase)/' | sort -u | grep .; then | |
| echo "The F-Droid APK contains proprietary Google classes" >&2 | |
| exit 1 | |
| fi | |
| echo "Bergamot libraries present; no ML Kit, Play Services, or Firebase classes found." | |
| fdroid-device-tests: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - name: Check out source with engine submodules | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| - name: Set up Java 17 | |
| uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4 | |
| with: | |
| distribution: temurin | |
| java-version: "17" | |
| - name: Enable KVM access | |
| run: | | |
| echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \ | |
| | sudo tee /etc/udev/rules.d/99-kvm4all.rules | |
| sudo udevadm control --reload-rules | |
| sudo udevadm trigger --name-match=kvm | |
| - name: Set up Android SDK | |
| uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3 | |
| with: | |
| packages: platform-tools | |
| - name: Install API 36 managed-device image, NDK and CMake | |
| run: sdkmanager "platforms;android-36" "build-tools;36.0.0" "emulator" "system-images;android-36;default;x86_64" "ndk;28.2.13676358" "cmake;3.22.1" | |
| - name: Set up Gradle cache | |
| uses: gradle/actions/setup-gradle@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4 | |
| - name: Download English and Vietnamese test models | |
| run: python3 tools/fetch_bergamot_test_models.py | |
| - name: Run the Bergamot engine test on API 36 | |
| run: >- | |
| bash ./gradlew pixel2Api36DebugAndroidTest | |
| -Pdistribution=fdroid | |
| -Pandroid.testInstrumentationRunnerArguments.class=com.kienhoang.dualsubreplay.translation.BergamotEngineDeviceTest | |
| -Pandroid.testoptions.manageddevices.emulator.gpu=swiftshader_indirect | |
| --no-parallel --max-workers=2 --stacktrace | |
| - name: Upload F-Droid device test reports | |
| if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: fdroid-pixel2-api36-test-reports | |
| path: | | |
| app/build/reports/androidTests/managedDevice/ | |
| app/build/outputs/androidTest-results/managedDevice/ | |
| if-no-files-found: warn | |
| managed-device-tests: | |
| needs: verify-build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Java 17 | |
| uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4 | |
| with: | |
| distribution: temurin | |
| java-version: "17" | |
| - name: Enable KVM access | |
| run: | | |
| echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \ | |
| | sudo tee /etc/udev/rules.d/99-kvm4all.rules | |
| sudo udevadm control --reload-rules | |
| sudo udevadm trigger --name-match=kvm | |
| - name: Set up Android SDK | |
| uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3 | |
| with: | |
| packages: platform-tools | |
| - name: Install API 36 managed-device image | |
| run: sdkmanager "platforms;android-36" "build-tools;36.0.0" "emulator" "system-images;android-36;default;x86_64" | |
| - name: Set up Gradle cache | |
| uses: gradle/actions/setup-gradle@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4 | |
| - name: Run offline WebView fixture tests on API 36 | |
| run: >- | |
| bash ./gradlew pixel2Api36DebugAndroidTest | |
| -Pandroid.testoptions.manageddevices.emulator.gpu=swiftshader_indirect | |
| --no-parallel --max-workers=2 --stacktrace | |
| - name: Upload managed-device reports | |
| if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: pixel2-api36-test-reports | |
| path: | | |
| app/build/reports/androidTests/managedDevice/ | |
| app/build/outputs/androidTest-results/managedDevice/ | |
| if-no-files-found: warn |