pr.yml

name: Pull Request

on: # yamllint disable-line rule:truthy
  workflow_dispatch:
  pull_request:

# This workflow should cancel previous builds since it means that a new commit has been made to the PR
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  validate_localize_setup:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Check for Lokalise setup changes
        id: changes
        shell: bash
        run: |
          if git diff --name-only "origin/main...HEAD" -- '.github/actions/download-translations/' | grep -q .; then
            echo "Lokalise setup changes detected"
            echo "skip=false" >> "$GITHUB_OUTPUT"
          else
            echo "No Lokalise setup changes detected, skipping validation"
            echo "skip=true" >> "$GITHUB_OUTPUT"
          fi

      - uses: ./.github/actions/download-translations
        if: steps.changes.outputs.skip != 'true'
        name: Download Translations
        with:
          lokalise-project: ${{ secrets.LOKALISE_PROJECT }}
          lokalise-token: ${{ secrets.LOKALISE_TOKEN }}

      - name: Validate French translation is not empty
        if: steps.changes.outputs.skip != 'true'
        shell: bash
        run: |
          FR_FILE="common/src/main/res/values-fr/strings.xml"
          if [ ! -f "$FR_FILE" ]; then
            echo "::error::French translation file not found at $FR_FILE"
            exit 1
          fi
          if ! grep -q '<string ' "$FR_FILE"; then
            echo "::error::French translation file exists but contains no string entries"
            exit 1
          fi

      - name: Archive Translations
        if: steps.changes.outputs.skip != 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: strings
          path: strings.zip

  yamllint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Register yamllint problem matcher
        run: |
          echo "::add-matcher::.github/workflows/matchers/yamllint.json"

      - name: Validate YAML
        run: yamllint --strict --format github .

  lockfiles:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-build-env
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
          mock-google-services: "true"

      - name: Update lockfiles
        run: ./gradlew alldependencies --write-locks

      - name: Check for missing lockfiles update
        run: |
          if [[ $(git status --porcelain) ]]; then
            echo $(git status --porcelain)
            echo -e "\n❌ Uncommitted changes detected in the repository."
            echo -e "🔍 It seems that the dependency lockfiles are outdated. Please update them by running:"
            echo -e "   ./gradlew alldependencies --write-locks"
            echo -e "   Then commit the updated lockfiles to your branch."
            error_message="Dependency changes detected, but lockfiles are not updated. Run \`./gradlew alldependencies --write-locks\` and commit the changes."
            echo "::error file=gradle/libs.versions.toml,line=1,title=⛔ Lockfile Update Required::${error_message}"
            exit 1;
          else
            echo -e "\n✔️ All dependency lockfiles are up to date. No uncommitted changes detected."
          fi

  license_check:
    needs: [lockfiles]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-build-env
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
          mock-google-services: "true"

      - name: Generate aboutlibraries JSON
        run: |
          ./gradlew :app:exportLibraryDefinitionsFullDebug \
            :app:exportLibraryDefinitionsMinimalDebug \
            :automotive:exportLibraryDefinitionsFullDebug \
            :automotive:exportLibraryDefinitionsMinimalDebug \
            :wear:exportLibraryDefinitionsDebug

      - name: Check licenses
        run: |
          python3 .github/scripts/check_licenses.py \
            app/build/generated/aboutLibraries/fullDebug/res/raw/aboutlibraries.json appFullDebug \
            app/build/generated/aboutLibraries/minimalDebug/res/raw/aboutlibraries.json appMinimalDebug \
            automotive/build/generated/aboutLibraries/fullDebug/res/raw/aboutlibraries.json automotiveFullDebug \
            automotive/build/generated/aboutLibraries/minimalDebug/res/raw/aboutlibraries.json automotiveMinimalDebug \
            wear/build/generated/aboutLibraries/debug/res/raw/aboutlibraries.json wearDebug

  ktlint:
    needs: [license_check, yamllint, validate_localize_setup]
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-build-env
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
          mock-google-services: "true"

      # Since `build-logic` is added with `includeBuild` we have to call ktlint explicitly on `:convention`.
      - name: Validate ktlint
        run: ./gradlew ktlintCheck :build-logic:convention:ktlintCheck --continue

      - uses: ./.github/actions/upload-sarif-results
        if: always()
        with:
          category: "KTlint"

  lint:
    needs: [lockfiles, ktlint]
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-build-env
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
          mock-google-services: "true"

      - name: Validate Lint
        run: ./gradlew lint --continue

      - name: Upload lint reports (HTML)
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: lint-reports
          path: "**/build/reports/lint-results-*.html"

      - uses: ./.github/actions/upload-sarif-results
        if: always()
        with:
          category: "Android Lint"

  screenshot_test:
    name: "Screenshot Tests"
    needs: [lint, lockfiles, ktlint]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-build-env
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
          mock-google-services: "true"

      - name: Validate Screenshot Previews - app
        run: ./gradlew :app:validateFullDebugScreenshotTest

      - name: Validate Screenshot Previews - wear
        run: ./gradlew :wear:validateDebugScreenshotTest

      - name: Validate Screenshot Previews - common
        run: ./gradlew :common:validateDebugScreenshotTest

      - uses: ./.github/actions/upload-test-results
        if: always()
        with:
          test-name: Screenshot test

  pr_build:
    needs: [lockfiles, ktlint]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Check for modified DB schemas on branch
        run: |
          if git diff --name-only --diff-filter=DMR origin/main... | grep "^common/schemas"; then
            echo -e "\n❌ Existing database schema modified, please increase the database version instead"
            exit 1
          else
            echo -e "\n✔️ No changed database schemas on branch"
          fi

      - uses: ./.github/actions/setup-build-env
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
          mock-google-services: "true"

      - name: Check version file creation
        run: ./gradlew versionFile

      - name: Build Debug APK
        run: |
          ./gradlew :common:assemble :app:assembleDebug :wear:assembleDebug :automotive:assembleDebug -PnoStrictMode

      - name: Check for missing/modified DB schemas after build
        run: |
          if [[ $(git status common/schemas --porcelain) ]]; then
            echo $(git status common/schemas --porcelain)
            echo -e "\n❌ Found uncommitted changes in database schema directory, please make sure to include all changes in your commit(s)"
            exit 1;
          else
            echo -e "\n✔️ No changes in database schema directory after build"
          fi

      - name: Archive Debug Build
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: APKs
          path: ./**/*.apk

  pr_build_release:
    needs: [lockfiles, ktlint]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: ./.github/actions/setup-build-env
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
          mock-google-services: "true"
      - name: Generate dummy keystore
        run: |
          keytool -genkeypair -v \
          -alias androiddebugkey \
          -keyalg RSA \
          -keysize 2048 \
          -validity 10000 \
          -keystore /home/runner/work/android/android/ci_dummy_keystore.keystore \
          -dname "CN=Android CI dummy, O=Android, C=FR" \
          -storepass android \
          -keypass android
      - name: Build Release
        env:
          KEYSTORE_PATH: /home/runner/work/android/android/ci_dummy_keystore.keystore
          KEYSTORE_ALIAS: androiddebugkey
          KEYSTORE_ALIAS_PASSWORD: android
          KEYSTORE_PASSWORD: android
        # Disable lint tasks since we have a dedicated job for this in the workflow
        run: |
          ./gradlew :common:assemble :app:assembleRelease :wear:assembleRelease :automotive:assembleRelease

  unit_tests:
    name: "Unit Tests"
    needs: [lint, lockfiles, ktlint]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-build-env
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
          mock-google-services: "true"

      - name: Run test
        # Run testFullDebugUnitTest at the app level since :automotive shares the same sourceSet than app. Minimal and Full are the same in unit tests for now
        run: ./gradlew testDebugUnitTest :app:testFullDebugUnitTest :lint:test

      - uses: ./.github/actions/upload-test-results
        if: always()
        with:
          test-name: Unit test

  instrumentation_test_app:
    name: "Instrumentation Test app"
    needs: [lint, lockfiles, ktlint]
    runs-on: ubuntu-latest
    environment: ui-test
    permissions:
      id-token: write # Needed for OIDC authentication
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-build-env
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
          mock-google-services: "true"

      - name: Build x86 APKs
        run: ./gradlew :app:assembleDebug :app:assembleAndroidTest -Pabis=x86,x86_64

      - name: Build device list
        id: devices
        run: |
          MIN=$(grep '^androidSdk-min' gradle/libs.versions.toml | cut -d'"' -f2)
          MAX=$(grep '^androidSdk-target' gradle/libs.versions.toml | cut -d'"' -f2)
          {
            echo 'list<<DEVICES_EOF'
            for v in $(seq "$MIN" "$MAX"); do
              echo "model=Pixel7,version=$v"
            done
            echo 'DEVICES_EOF'
          } >> "$GITHUB_OUTPUT"

      - uses: emulator-wtf/configure-credentials@d0d840f8d9e2920e284788fcfa32f0a1eed95bf0 # v1.0.0
        with:
          oidc-configuration-id: ${{ vars.EMULATOR_WTF_OIDC_CONFIGURATION_ID }} # This is retrieved from the emulator.wtf console

      - name: Run tests full
        uses: emulator-wtf/run-tests@01944281be70008e1b97d9f8458039c18cd3d779 # v0.9.11
        with:
          devices: ${{ steps.devices.outputs.list }}
          app: app/build/outputs/apk/full/debug/app-full-debug.apk
          test: app/build/outputs/apk/androidTest/full/debug/app-full-debug-androidTest.apk
          outputs-dir: build/test-results/full

      - name: Run tests minimal
        uses: emulator-wtf/run-tests@01944281be70008e1b97d9f8458039c18cd3d779 # v0.9.11
        with:
          devices: ${{ steps.devices.outputs.list }}
          app: app/build/outputs/apk/minimal/debug/app-minimal-debug.apk
          test: app/build/outputs/apk/androidTest/minimal/debug/app-minimal-debug-androidTest.apk
          outputs-dir: build/test-results/minimal

      - uses: ./.github/actions/upload-test-results
        if: always()
        with:
          test-name: Instrumentation Test app

  instrumentation_test:
    name: "Instrumentation Tests"
    needs: [lint, lockfiles, ktlint]
    runs-on: ubuntu-latest
    strategy:
      # We want the result of each device to be reported, so we can't fail-fast
      fail-fast: false
      matrix:
        configuration:
          - api-level: 33
            arch: x86_64
            profile: "automotive_1024p_landscape"
            target: "android-automotive"
            gradle_target: ":automotive:connectedFullDebugAndroidTest :automotive:connectedMinimalDebugAndroidTest :common:connectedDebugAndroidTest :microwakeword:connectedDebugAndroidTest"
          - api-level: "34"
            system-image-api-level: "34-ext9"
            arch: x86_64
            profile: "automotive_1024p_landscape"
            target: "android-automotive"
            gradle_target: ":automotive:connectedFullDebugAndroidTest :automotive:connectedMinimalDebugAndroidTest :common:connectedDebugAndroidTest :microwakeword:connectedDebugAndroidTest"
          - api-level: 26
            arch: x86
            profile: "wearos_square"
            target: "android-wear"
            gradle_target: ":wear:connectedDebugAndroidTest :common:connectedDebugAndroidTest"
          - api-level: 34
            arch: x86_64
            profile: "wearos_small_round"
            target: "android-wear"
            gradle_target: ":wear:connectedDebugAndroidTest :common:connectedDebugAndroidTest"
    steps:
      - name: Delete unnecessary tools 🔧
        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
        with:
          android: false # Don't remove Android tools
          tool-cache: true # Remove image tool cache - rm -rf "$AGENT_TOOLSDIRECTORY"
          docker-images: false # Takes 16s, enable if needed in the future
          large-packages: false # includes google-cloud-sdk and it's slow

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-build-env
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
          mock-google-services: "true"

      - name: Enable KVM group perms
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm
          ls /dev/kvm

      - name: Build projects and run instrumentation tests
        uses: reactivecircus/android-emulator-runner@e89f39f1abbbd05b1113a29cf4db69e7540cae5a # v2.37.0
        with:
          api-level: ${{ matrix.configuration.api-level }}
          arch: ${{ matrix.configuration.arch }}
          force-avd-creation: false
          disable-animations: true
          disk-size: 2G # We need to ensure that there is enough space for the emulator to run. If not we get 'Failed to commit install' errors.
          heap-size: 1G
          emulator-options: -no-snapshot-save -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
          profile: ${{ matrix.configuration.profile }}
          target: ${{ matrix.configuration.target }}
          system-image-api-level: ${{ matrix.configuration.system-image-api-level }}
          script: ./gradlew ${{ matrix.configuration.gradle_target }}

      - uses: ./.github/actions/upload-test-results
        if: always()
        with:
          test-name: Instrumentation test (API${{ matrix.configuration.api-level }}) ${{ matrix.configuration.target }}

  publish_test_results:
    name: "Publish Tests Results"
    needs: [instrumentation_test, unit_tests, screenshot_test, instrumentation_test_app]
    runs-on: ubuntu-latest
    permissions:
      checks: write
      pull-requests: write
    if: always()

    steps:
      - name: Download Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

      - name: Publish Test Results EnricoMi
        uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2.23.0
        if: always()
        with:
          comment_mode: "failures"
          # We want to fail the build to block the merge if any test fail it allows us simplify the setup of the protected branch.
          action_fail: true
          files: |
            **/androidTest-results/**/TEST-*.xml
            **/build/test-results/**/TEST-*.xml
            **/build/test-results/**/results.xml