android.yml

name: Android build and releases

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: android-ci-${{ github.event.pull_request.number || github.ref_name }}
  cancel-in-progress: true

jobs:
  verify-build:
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Check out source
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false

      - name: Set up Java 17
        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Set up Android SDK
        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
        with:
          packages: platform-tools

      - name: Install Android build SDK
        run: sdkmanager "platforms;android-36" "build-tools;36.0.0"

      - name: Set up Gradle cache
        uses: gradle/actions/setup-gradle@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4

      - name: Restore persistent preview signing key
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: ~/.android/debug.keystore
          key: dual-sub-replay-preview-signing-v1

      - name: Test release automation
        run: python3 -m unittest discover -s tools/tests -p 'test_*.py' -v

      - name: Verify Gradle wrapper
        run: bash ./gradlew --version

      - name: Test, lint, and build
        run: |
          set -euo pipefail
          preview_version_code=$(( $(date -u +%s) - 1700000000 ))
          bash ./gradlew formatCheck complexityCheck testDebugUnitTest lintDebug assembleDebug assembleDebugAndroidTest \
            -PpreviewVersionCode="$preview_version_code" \
            -PpreviewVersionNameSuffix="-pr${{ github.event.pull_request.number || 'manual' }}-build${GITHUB_RUN_NUMBER}" \
            -PpreviewApplicationIdSuffix=".preview" \
            --stacktrace

      - name: Verify preview package id
        run: |
          badging="$("$ANDROID_HOME/build-tools/36.0.0/aapt" dump badging app/build/outputs/apk/debug/app-debug.apk | head -n 1)"
          echo "$badging"
          if [[ "$badging" != *"name='com.kienhoang.dualsubreplay.preview'"* ]]; then
            echo "Preview APK does not use the isolated preview application id" >&2
            exit 1
          fi

      - name: Name preview APK
        run: cp app/build/outputs/apk/debug/app-debug.apk DualSub-Replay-preview.apk

      - name: Upload verified preview APK
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: DualSub-Replay-preview
          path: DualSub-Replay-preview.apk
          if-no-files-found: error
          retention-days: 7

      - name: Build optimized release APK with test signing
        run: |
          set -euo pipefail
          bash ./gradlew assembleRelease \
            -PtestReleaseSigning=true \
            -PpreviewApplicationIdSuffix=".releasesmoke" \
            --stacktrace

      - name: Verify release APK size, permissions, and forbidden components
        run: |
          python3 tools/report_apk.py app/build/outputs/apk/release/app-release.apk \
            --max-bytes 80000000 \
            --stretch-bytes 40000000 \
            --output-json apk-size-report.json

      - name: Upload size report and R8 mapping
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: release-size-and-r8-mapping
          path: |
            apk-size-report.json
            app/build/outputs/mapping/release/mapping.txt
          if-no-files-found: warn
          retention-days: 14

  fdroid-build:
    runs-on: ubuntu-latest
    timeout-minutes: 60

    steps:
      - name: Check out source with engine submodules
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
          submodules: recursive

      - name: Set up Java 17
        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Set up Android SDK
        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
        with:
          packages: platform-tools

      - name: Install Android build SDK, NDK and CMake
        run: sdkmanager "platforms;android-36" "build-tools;36.0.0" "ndk;28.2.13676358" "cmake;3.22.1"

      - name: Set up Gradle cache
        uses: gradle/actions/setup-gradle@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4

      - name: Build unsigned F-Droid release APK
        run: bash ./gradlew lintRelease assembleRelease -Pdistribution=fdroid --stacktrace

      - name: Verify F-Droid APK has the engine and no proprietary Google libraries
        run: |
          set -euo pipefail
          apk=app/build/outputs/apk/release/app-release-unsigned.apk
          test -f "$apk"
          for abi in arm64-v8a x86_64; do
            unzip -l "$apk" "lib/$abi/libdualsub_bergamot.so" > /dev/null
          done
          if unzip -p "$apk" 'classes*.dex' | grep -a -o -E 'Lcom/google/(mlkit|android/gms|firebase)/' | sort -u | grep .; then
            echo "The F-Droid APK contains proprietary Google classes" >&2
            exit 1
          fi
          echo "Bergamot libraries present; no ML Kit, Play Services, or Firebase classes found."

  fdroid-device-tests:
    runs-on: ubuntu-latest
    timeout-minutes: 60

    steps:
      - name: Check out source with engine submodules
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
          submodules: recursive

      - name: Set up Java 17
        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Enable KVM access
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
            | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Set up Android SDK
        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
        with:
          packages: platform-tools

      - name: Install API 36 managed-device image, NDK and CMake
        run: sdkmanager "platforms;android-36" "build-tools;36.0.0" "emulator" "system-images;android-36;default;x86_64" "ndk;28.2.13676358" "cmake;3.22.1"

      - name: Set up Gradle cache
        uses: gradle/actions/setup-gradle@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4

      - name: Download English and Vietnamese test models
        run: python3 tools/fetch_bergamot_test_models.py

      - name: Run the Bergamot engine test on API 36
        run: >-
          bash ./gradlew pixel2Api36DebugAndroidTest
          -Pdistribution=fdroid
          -Pandroid.testInstrumentationRunnerArguments.class=com.kienhoang.dualsubreplay.translation.BergamotEngineDeviceTest
          -Pandroid.testoptions.manageddevices.emulator.gpu=swiftshader_indirect
          --no-parallel --max-workers=2 --stacktrace

      - name: Upload F-Droid device test reports
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: fdroid-pixel2-api36-test-reports
          path: |
            app/build/reports/androidTests/managedDevice/
            app/build/outputs/androidTest-results/managedDevice/
          if-no-files-found: warn

  managed-device-tests:
    needs: verify-build
    runs-on: ubuntu-latest
    timeout-minutes: 45

    steps:
      - name: Check out source
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false

      - name: Set up Java 17
        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Enable KVM access
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
            | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Set up Android SDK
        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
        with:
          packages: platform-tools

      - name: Install API 36 managed-device image
        run: sdkmanager "platforms;android-36" "build-tools;36.0.0" "emulator" "system-images;android-36;default;x86_64"

      - name: Set up Gradle cache
        uses: gradle/actions/setup-gradle@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4

      - name: Run offline WebView fixture tests on API 36
        run: >-
          bash ./gradlew pixel2Api36DebugAndroidTest
          -Pandroid.testoptions.manageddevices.emulator.gpu=swiftshader_indirect
          --no-parallel --max-workers=2 --stacktrace

      - name: Upload managed-device reports
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: pixel2-api36-test-reports
          path: |
            app/build/reports/androidTests/managedDevice/
            app/build/outputs/androidTest-results/managedDevice/
          if-no-files-found: warn