reusable-ui-workflow.yaml

on:
  workflow_call:
    inputs:
      is_pr:
        type: boolean
        default: false
    secrets:
      MSDK_ANDROID_REMOTE_ACCESS_CALLBACK_URL:
        required: true
      MSDK_ANDROID_REMOTE_ACCESS_CONSUMER_KEY:
        required: true
      UI_TEST_CONFIG:
        required: true
      GCLOUD_SERVICE_KEY:
        required: true
      CODECOV_TOKEN:
        required: true

permissions:
  contents: read
  pull-requests: write

jobs:
  test-android:
    runs-on: ubuntu-latest
    env:
      BUNDLE_GEMFILE: ${{ github.workspace }}/.github/DangerFiles/Gemfile
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
        if: ${{ inputs.is_pr }}
        with:
          persist-credentials: false
          # We need a sufficient depth or Danger will occasionally run into issues checking which files were modified.
          fetch-depth: 100
          ref: ${{ github.event.pull_request.head.sha }}
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
        if: ${{ ! inputs.is_pr }}
        with:
          persist-credentials: false
          ref: ${{ github.head_ref }}
      - name: Install Dependencies
        env:
          MSDK_ANDROID_REMOTE_ACCESS_CALLBACK_URL: ${{ secrets.MSDK_ANDROID_REMOTE_ACCESS_CALLBACK_URL }}
          MSDK_ANDROID_REMOTE_ACCESS_CONSUMER_KEY: ${{ secrets.MSDK_ANDROID_REMOTE_ACCESS_CONSUMER_KEY }}
          UI_TEST_CONFIG: ${{ secrets.UI_TEST_CONFIG }}
        run: |
          ./install.sh
          echo $UI_TEST_CONFIG > ./shared/test/ui_test_config.json
      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9  # v4.8.0
        with:
          distribution: 'zulu'
          java-version: '21'
      - name: Setup Android SDK
        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407  # v3.2.2
      - uses: gradle/actions/setup-gradle@748248ddd2a24f49513d8f472f81c3a07d4d50e1  # v4.4.4
        with:
          # This is the actual Gradle version (not AGP), which can be found in the gradle-wrapper.properties file.
          gradle-version: "8.14.3"
          add-job-summary: on-failure
          add-job-summary-as-pr-comment: on-failure
      - name: Build App for Testing
        id: build-app
        if: success() || failure()
        run: |
          mkdir -p build_logs
          set -o pipefail
          ./gradlew native:NativeSampleApps:AuthFlowTester:assembleDebug 2>&1 | tee "build_logs/assembleDebug-AuthFlowTester.log"
      - name: Build UI Tests
        id: build-ui-tests
        run: |
          mkdir -p build_logs
          set -o pipefail
          ./gradlew native:NativeSampleApps:AuthFlowTester:assembleAndroidTest 2>&1 | tee "build_logs/assembleAndroidTest-AuthFlowTester.log"
      - name: Archive build logs on failure
        if: failure() && (steps.build-app.outcome == 'failure' || steps.build-ui-tests.outcome == 'failure')
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
        with:
          name: build-logs-authflowtester-ui
          path: build_logs/
          if-no-files-found: ignore
          retention-days: 14
      - uses: 'google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed'  # v2.1.13
        if: success() || failure()
        with:
          credentials_json: '${{ secrets.GCLOUD_SERVICE_KEY }}'
      - uses: 'google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f'  # v2.2.1
        if: success() || failure()
      - name: Run PR Tests
        continue-on-error: true
        if: ${{ inputs.is_pr }}
        env:
          # Most used according to https://gs.statcounter.com/android-version-market-share/mobile-tablet/worldwide
          PR_API_VERSION: "36"
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          GCLOUD_RESULTS_DIR="authflowtester-pr-build-${RUN_NUMBER}"

          PR_TESTS="class com.salesforce.samples.authflowtester.BootConfigLoginTests#testCAOpaque_DefaultScopes_WebServerFlow, \
            class com.salesforce.samples.authflowtester.ECALoginTests#testECAOpaque_DefaultScopes, \
            class com.salesforce.samples.authflowtester.ECALoginTests#testECAJwt_AllScopes, \
            class com.salesforce.samples.authflowtester.TokenMigrationTest#testMigrate_ECA_AddMoreScopes, \
            class com.salesforce.samples.authflowtester.MultiUserLoginTests#testSameApp_SameScopes_uniqueTokens, \
            class com.salesforce.samples.authflowtester.BeaconLoginTests#testBeaconOpaque_DefaultScopes, \
            class com.salesforce.samples.authflowtester.AdvancedAuthBeaconLoginTests#testBeaconOpaque_DefaultScopes"

          gcloud firebase test android run \
            --project mobile-apps-firebase-test \
            --type instrumentation \
            --use-orchestrator \
            --environment-variables clearPackageData=true \
            --app "native/NativeSampleApps/AuthFlowTester/build/outputs/apk/debug/AuthFlowTester-debug.apk" \
            --test "native/NativeSampleApps/AuthFlowTester/build/outputs/apk/androidTest/debug/AuthFlowTester-debug-androidTest.apk" \
            --device "model=MediumPhone.arm,version=${PR_API_VERSION},locale=en,orientation=portrait" \
            --directories-to-pull=/sdcard \
            --results-dir="${GCLOUD_RESULTS_DIR}" \
            --results-history-name=AuthFlowTester \
            --no-performance-metrics \
            --test-targets="${PR_TESTS}" \
            --timeout=10m \
            --num-flaky-test-attempts=1
      - name: Run All Single User Tests
        continue-on-error: true
        if: ${{ ! inputs.is_pr }}
        env:
          FULL_API_RANGE: "31 32 33 34 35 36"
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          GCLOUD_RESULTS_DIR="authflowtester-single-user-build-${RUN_NUMBER}"
          DEVICE_ARGS=()
          for LEVEL in $FULL_API_RANGE; do
            DEVICE_ARGS+=(--device "model=MediumPhone.arm,version=${LEVEL},locale=en,orientation=portrait")
          done

          gcloud firebase test android run \
            --project mobile-apps-firebase-test \
            --type instrumentation \
            --use-orchestrator \
            --environment-variables clearPackageData=true \
            --app "native/NativeSampleApps/AuthFlowTester/build/outputs/apk/debug/AuthFlowTester-debug.apk" \
            --test "native/NativeSampleApps/AuthFlowTester/build/outputs/apk/androidTest/debug/AuthFlowTester-debug-androidTest.apk" \
            --test-targets "notClass com.salesforce.samples.authflowtester.MultiUserLoginTests" \
            "${DEVICE_ARGS[@]}" \
            --directories-to-pull=/sdcard \
            --results-dir="${GCLOUD_RESULTS_DIR}" \
            --results-history-name=AuthFlowTester \
            --no-performance-metrics \
            --num-flaky-test-attempts=1 \
            --timeout=30m || true
      - name: Run All Multi User Tests
        continue-on-error: true
        if: ${{ ! inputs.is_pr }}
        env:
          FULL_API_RANGE: "31 32 33 34 35 36"
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          GCLOUD_RESULTS_DIR="authflowtester-multi-user-build-${RUN_NUMBER}"
          DEVICE_ARGS=()
          for LEVEL in $FULL_API_RANGE; do
            DEVICE_ARGS+=(--device "model=MediumPhone.arm,version=${LEVEL},locale=en,orientation=portrait")
          done

          gcloud firebase test android run \
            --project mobile-apps-firebase-test \
            --type instrumentation \
            --use-orchestrator \
            --environment-variables clearPackageData=true \
            --app "native/NativeSampleApps/AuthFlowTester/build/outputs/apk/debug/AuthFlowTester-debug.apk" \
            --test "native/NativeSampleApps/AuthFlowTester/build/outputs/apk/androidTest/debug/AuthFlowTester-debug-androidTest.apk" \
            --test-targets "class com.salesforce.samples.authflowtester.MultiUserLoginTests" \
            "${DEVICE_ARGS[@]}" \
            --directories-to-pull=/sdcard \
            --results-dir="${GCLOUD_RESULTS_DIR}" \
            --results-history-name=AuthFlowTester \
            --no-performance-metrics \
            --num-flaky-test-attempts=1 \
            --timeout=15m || true
      - name: Copy Test Results
        continue-on-error: true
        if: success() || failure()
        env:
          IS_PR: ${{ inputs.is_pr }}
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          mkdir -p firebase_results
          BUCKET="gs://test-lab-w87i9sz6q175u-kwp8ium6js0zw"

          copy_results_by_api_level() {
            local BUCKET_PATH=$1
            local OUTPUT_PREFIX=$2

            # Pass 1: copy original (non-rerun) results
            for RESULT_FILE in $(gsutil ls "${BUCKET_PATH}/*/test_result_1.xml" 2>/dev/null | grep -v "rerun"); do
              DEVICE_DIR=$(echo "${RESULT_FILE}" | sed 's|.*/\([^/]*\)/test_result_1.xml|\1|')
              API_LEVEL=$(echo "${DEVICE_DIR}" | sed 's/.*-\([0-9]*\)-.*/\1/')
              gsutil cp "${RESULT_FILE}" "firebase_results/${OUTPUT_PREFIX}_api_${API_LEVEL}_test_result.xml"
            done
            # Pass 2: merge rerun testcases into originals so check_retries detects flaky tests
            for RESULT_FILE in $(gsutil ls "${BUCKET_PATH}/*/test_result_1.xml" 2>/dev/null | grep "rerun"); do
              DEVICE_DIR=$(echo "${RESULT_FILE}" | sed 's|.*/\([^/]*\)/test_result_1.xml|\1|')
              API_LEVEL=$(echo "${DEVICE_DIR}" | sed 's/.*-\([0-9]*\)-.*/\1/')
              RERUN_TMP="firebase_results/${OUTPUT_PREFIX}_api_${API_LEVEL}_rerun_tmp.xml"
              ORIG_FILE="firebase_results/${OUTPUT_PREFIX}_api_${API_LEVEL}_test_result.xml"
              gsutil cp "${RESULT_FILE}" "${RERUN_TMP}"
              python3 - "${ORIG_FILE}" "${RERUN_TMP}" "${ORIG_FILE}" << 'PYEOF'
          import sys, xml.etree.ElementTree as ET
          orig = ET.parse(sys.argv[1])
          rerun = ET.parse(sys.argv[2])
          def suite(t):
            r = t.getroot()
            return r if r.tag == 'testsuite' else r.find('testsuite')
          os_el, rs_el = suite(orig), suite(rerun)
          failed_keys = set()
          for tc in os_el.findall('testcase'):
            if tc.find('failure') is not None or tc.find('error') is not None:
              failed_keys.add(f"{tc.get('name','')}|{tc.get('classname','')}|{tc.get('file','')}")
          added = 0
          for tc in rs_el.findall('testcase'):
            if f"{tc.get('name','')}|{tc.get('classname','')}|{tc.get('file','')}" in failed_keys:
              os_el.append(tc)
              added += 1
          os_el.set('tests', str(int(os_el.get('tests','0')) + added))
          with open(sys.argv[3], 'w') as f:
            f.write(ET.tostring(orig.getroot(), encoding='unicode'))
          PYEOF
              rm "${RERUN_TMP}"
            done
          }

          if [ "$IS_PR" = "true" ] ; then
            BUCKET_PATH="${BUCKET}/authflowtester-pr-build-${RUN_NUMBER}"
            if gsutil ls "${BUCKET_PATH}" > /dev/null 2>&1; then
              copy_results_by_api_level "${BUCKET_PATH}" "pr"
            fi
          else
            SINGLE_PATH="${BUCKET}/authflowtester-single-user-build-${RUN_NUMBER}"
            if gsutil ls "${SINGLE_PATH}" > /dev/null 2>&1; then
              copy_results_by_api_level "${SINGLE_PATH}" "single-user"
            fi

            MULTI_PATH="${BUCKET}/authflowtester-multi-user-build-${RUN_NUMBER}"
            if gsutil ls "${MULTI_PATH}" > /dev/null 2>&1; then
              copy_results_by_api_level "${MULTI_PATH}" "multi-user"
            fi
          fi
      - name: Test Report
        uses: mikepenz/action-junit-report@3a81627bfac62268172037048872e8ebd4207e6d  # v6.4.1
        if: success() || failure()
        with:
          check_name: AuthFlowTester Test Results
          job_name: AuthFlowTester Test Results
          require_tests: true
          check_retries: true
          flaky_summary: true
          fail_on_failure: true
          group_reports: false
          include_passed: true
          include_empty_in_summary: false
          simplified_summary: true
          report_paths: 'firebase_results/**.xml'
      - name: Archive APK
        if: success() || failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
        with:
          name: AuthFlowTester-debug-${{ github.run_number }}
          path: native/NativeSampleApps/AuthFlowTester/build/outputs/apk/debug/AuthFlowTester-debug.apk
      - name: Archive Test Results
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
        if: success() || failure()
        with:
          name: ui-test-results
          path: 'firebase_results/**.xml'