android.yml

name: android

on:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    name: Build, test, lint APK
    runs-on: ubuntu-latest
    timeout-minutes: 90

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      # Defensive: the exec bit can get lost when the file is re-added from
      # a Windows environment (core.filemode=false). This guarantees the
      # wrapper is runnable even if the stored file mode regresses.
      - name: Ensure gradlew is executable
        run: chmod +x gradlew

      - name: Set up JDK 17 (Temurin)
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Android SDK (pinned cmdline tools + packages)
        uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4
        with:
          packages: >-
            platforms;android-35
            build-tools;35.0.0
            platform-tools
            ndk;26.3.11579264
            cmake;3.22.1

      - name: Verify tool pins
        run: |
          echo "NDK installed versions:" "$ANDROID_HOME/ndk"
          echo "CMake installed versions:" "$ANDROID_HOME/cmake"

      - name: Gradle wrapper validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

      - name: Cache Gradle
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: gradle-${{ runner.os }}-

      - name: Unit tests
        run: |
          set -o pipefail
          ./gradlew --no-daemon test 2>&1 | tee gradle-test.log

      - name: Lint debug
        run: |
          set -o pipefail
          ./gradlew --no-daemon :app:lintDebug 2>&1 | tee gradle-lint.log

      - name: Build debug APK (includes native NDK/CMake build)
        run: |
          set -o pipefail
          ./gradlew --no-daemon assembleDebug 2>&1 | tee gradle-build.log

      # Logs require auth to download via API; the step summary is public.
      # This makes the failure reason visible in the run page itself.
      - name: Publish Gradle diagnostics to step summary (on failure)
        if: failure()
        run: |
          emit() { echo "::error title=Gradle::$1"; }
          {
            echo "## CI diagnostics"
            for name in test lint build; do
              f="gradle-${name}.log"
              [ -f "$f" ] || continue
              echo ""
              echo "### gradle-${name}.log: Kotlin/compile errors"
              echo ""
              echo '```'
              grep -E "^e: |^w: |error:|FAILURE|What went wrong" "$f" | head -n 80
              echo '```'
              echo ""
              echo "### gradle-${name}.log: tail (last 120 lines)"
              echo ""
              echo '```'
              tail -n 120 "$f"
              echo '```'
            done
          } >> "$GITHUB_STEP_SUMMARY"
          for name in test lint build; do
            f="gradle-${name}.log"
            [ -f "$f" ] || continue
            grep -E "^e: |error:|What went wrong|FAILURE:|  Gradle task" "$f" | head -n 40 | cut -c1-300 | while IFS= read -r line; do emit "$line"; done
            tail -n 25 "$f" | cut -c1-300 | while IFS= read -r line; do emit "tail: $line"; done
          done

      - name: Debug APK artifact, even when later steps fail
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: OpenEar-debug-apk
          path: app/build/outputs/apk/debug/*.apk
          if-no-files-found: error

      - name: Test reports artifact (on any test failure)
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: test-reports
          path: |
            gradle-*.log
            app/build/reports/tests/
            app/build/test-results/
            whisper/build/reports/tests/
          if-no-files-found: ignore

      - name: Gradle summary
        if: always()
        run: |
          echo "Exits success when unit tests, debug + release builds, and lint complete."

  release:
    name: Release APK (tags only)
    needs: build
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    timeout-minutes: 90
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Ensure gradlew is executable
        run: chmod +x gradlew

      - name: Set up JDK 17 (Temurin)
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Android SDK (pinned)
        uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4
        with:
          packages: >-
            platforms;android-35
            build-tools;35.0.0
            platform-tools
            ndk;26.3.11579264
            cmake;3.22.1

      - name: Cache Gradle
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: gradle-${{ runner.os }}-

      - name: Build debug APK (unsigned release is not sideload-ready)
        run: ./gradlew --no-daemon assembleDebug

      - name: Checksums
        run: |
          sha256sum app/build/outputs/apk/debug/*.apk | tee OpenEar-apk-sha256.txt

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
        with:
          files: |
            app/build/outputs/apk/debug/*.apk
            OpenEar-apk-sha256.txt