build.yml

name: Build
on:
  push:
  pull_request:
  workflow_dispatch:
    inputs:
      commit_hash:
        description: 'Specific commit SHA to build (leave empty for latest branch commit)'
        required: false
        type: string

# One run per branch (and event): a newer push cancels the older run, so on basic / v2 the
# "latest" release always gets the build of the newest commit, not of the run that finished
# last (#90). Every manual run has a group of its own: never cancelled, never replaced by
# another manual run waiting in the same group.
concurrency:
  group: ${{ github.event_name == 'workflow_dispatch' && format('manual-{0}', github.run_id) || format('build-{0}-{1}', github.event_name, github.ref) }}
  cancel-in-progress: ${{ github.event_name != 'workflow_dispatch' }}

jobs:
  # Unit tests and lint; also runs for pull requests from forks (no secrets needed)
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Switch to specified commit (keep latest workflow files)
        if: inputs.commit_hash != ''
        run: |
          git fetch --unshallow
          git checkout ${{ inputs.commit_hash }}
          git checkout ${{ github.ref_name }} -- .github/

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
          cache: gradle

      - name: Unit tests and lint
        working-directory: android
        run: |
          ./gradlew testDebugUnitTest
          # Commits from before the lint baseline would fail on known findings
          if [ -f app/lint-baseline.xml ]; then
            ./gradlew lintDebug
          else
            echo "No lint baseline in this commit, lint skipped"
          fi

      - name: Upload reports
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: test-and-lint-reports
          path: |
            android/app/build/reports/
            android/app/build/test-results/

  # Signed release build; needs secrets, so it does not run for pull requests
  build:
    needs: test
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Switch to specified commit (keep latest workflow files)
        if: inputs.commit_hash != ''
        run: |
          git fetch --unshallow
          git checkout ${{ inputs.commit_hash }}
          git checkout ${{ github.ref_name }} -- .github/

      - name: Set artifact name
        id: vars
        run: |
          case "${{ github.ref_name }}" in
            basic) echo "name=decoder" ;;
            v2)    echo "name=decoder-v2" ;;
            *)     echo "name=decoder-$(echo '${{ github.ref_name }}' | tr '/' '-')" ;;
          esac >> $GITHUB_OUTPUT

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
          cache: gradle

      - name: Build
        working-directory: android
        env:
          KEYSTORE_PASS: ${{ secrets.KEYSTORE_PASS }}
          KEY_ALIAS:     ${{ secrets.KEY_ALIAS }}
          KEY_PASS:      ${{ secrets.KEY_PASS }}
        run: |
          echo "${{ secrets.KEY }}" | base64 -d > key.jks
          # APK only while in development; the .aab (bundleRelease) is for store uploads
          ./gradlew assembleRelease
          mv app/build/outputs/apk/release/app-release.apk ../${{ steps.vars.outputs.name }}.apk
          # R8 mapping of this APK, to retrace obfuscated stack traces (#181). A build without
          # minify has none: warn instead of failing
          MAPPING=app/build/outputs/mapping/release/mapping.txt
          if [ -f "$MAPPING" ]; then
            cp "$MAPPING" ../${{ steps.vars.outputs.name }}-mapping.txt
          else
            echo "::warning::No R8 mapping.txt at $MAPPING"
          fi

      # Every build keeps its R8 mapping as a workflow artifact (#181)
      - name: Upload mapping
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.vars.outputs.name }}-mapping
          path: ${{ steps.vars.outputs.name }}-mapping.txt
          if-no-files-found: warn

      # Working branches: keep the build as a workflow artifact only
      - name: Upload artifact
        if: github.ref_name != 'basic' && github.ref_name != 'v2'
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.vars.outputs.name }}
          path: ${{ steps.vars.outputs.name }}.apk

      # Release branches: publish to the "latest" release and Telegram. No release per version:
      # development is continuous, Telegram keeps every build (#194)
      - name: Upload
        if: github.ref_name == 'basic' || github.ref_name == 'v2'
        uses: softprops/action-gh-release@v2
        with:
          tag_name: latest
          # The mapping goes next to the APK it belongs to (#181); a missing file is skipped
          files: |
            ${{ steps.vars.outputs.name }}.apk
            ${{ steps.vars.outputs.name }}-mapping.txt

      - name: Telegram
        if: github.ref_name == 'basic' || github.ref_name == 'v2'
        run: |
          # basic keeps its Gradle files at the top level; read only the one that exists
          # (a missing file would fail the step under pipefail, Qodo on #158)
          GRADLE=android/app/build.gradle
          [ -f "$GRADLE" ] || GRADLE=app/build.gradle
          VER=$(sed -n 's/.*versionName "\(.*\)".*/\1/p' "$GRADLE" | head -1)
          GIT_HASH=$(git rev-parse --short HEAD)
          GIT_BRANCH="${{ github.ref_name }}"
          TAG_NAME="${{ github.ref_type == 'tag' && github.ref_name || '' }}"
          TIME=$(date -u '+%Y-%m-%d %H:%M:%S UTC')
          TG_MSG="Version: ${VER}\nCommit: ${GIT_HASH}\nBranch: ${GIT_BRANCH}\nTag: ${TAG_NAME}\nTime: ${TIME}\n\n"
          TG_ICON="\xE2\x9C\x85 GitHub Actions"
          TG_HEADER=$(echo -e ${TG_MSG}${TG_ICON})
          TG_TOKEN=${{secrets.TELEGRAM_TOKEN_BOT_OPENIPC}}
          TG_CHANNEL=${{secrets.TELEGRAM_CHANNEL_OPENIPC_DEV}}
          HTTP=$(curl -s -o /dev/null -w %{http_code} https://api.telegram.org/bot${TG_TOKEN}/sendDocument -F chat_id=${TG_CHANNEL} -F caption="${TG_HEADER}" -F document=@${{ steps.vars.outputs.name }}.apk)
          echo Telegram response: ${HTTP}