build.yml

name: build

on:
  push:
    branches:
      - main
      - develop
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'
  pull_request:
    types:
      - opened
      - synchronize
      - labeled
      - unlabeled

permissions: read-all

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Set up our JDK environment
        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
        with:
          distribution: 'zulu'
          java-version: '21'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
        with:
          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/develop' }}

      - name: Set up signing configuration
        uses: ./.github/actions/setup-signing
        with:
          keystore: ${{ secrets.SIGNING_KEYSTORE }}
          store-password: ${{ secrets.SIGNING_STORE_PASSWORD }}
          key-alias: ${{ secrets.SIGNING_KEY_ALIAS }}
          key-password: ${{ secrets.SIGNING_KEY_PASSWORD }}

      - name: Build
        run: |
          # Git SHA is equal to github.event.pull_request.head.sha for pull requests
          # This value is unset if workflow has not been triggered by a pull request, use GITHUB_SHA instead
          BRANCH_SHA=${{ github.event.pull_request.head.sha }}
          COMMIT_SHA=${BRANCH_SHA:-$GITHUB_SHA}
          ./gradlew assembleProd -PversionNameSuffix="-${COMMIT_SHA::7}" -PversionCode=$GITHUB_RUN_NUMBER --stacktrace

      - name: Upload app artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: app
          path: app/build/outputs/apk/*/*/*.apk

  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Set up our JDK environment
        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
        with:
          distribution: 'zulu'
          java-version: '21'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
        with:
          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/develop' }}

      - name: Run Android Linter
        run: ./gradlew lintProdDebug lintProdRelease

      - name: Upload lint reports
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: lint-reports
          path: '**/build/reports/lint-*.html'

  unit-tests:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Set up our JDK environment
        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
        with:
          distribution: 'zulu'
          java-version: '21'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
        with:
          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/develop' }}

      - name: Run unit tests
        run: ./gradlew verifyPaparazziDebug

      - name: Upload unit test artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: unit-tests
          path: |
            */build/paparazzi
            */build/reports/paparazzi
            */build/reports/tests
            */build/test-results

  instrumented-tests:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Set up our JDK environment
        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
        with:
          distribution: 'zulu'
          java-version: '21'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
        with:
          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/develop' }}

      - name: Enable KVM group perms
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Run Gitleaks
        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

      - name: Run instrumented tests
        uses: reactivecircus/android-emulator-runner@e89f39f1abbbd05b1113a29cf4db69e7540cae5a # v2.37.0
        with:
          api-level: 35
          arch: x86_64
          script: ./gradlew :core:connectedCheck

      - name: Upload instrumented test artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: instrumented-tests
          path: core/build/reports/androidTests

  maven-central-release:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
    needs: [ build, lint, unit-tests, instrumented-tests ]
    environment:
      name: maven-central-release
      url: https://mvnrepository.com/artifact/com.orange.ouds.android
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Set up our JDK environment
        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
        with:
          distribution: 'zulu'
          java-version: '21'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
        with:
          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/develop' }}

      - name: Set up signing configuration
        uses: ./.github/actions/setup-signing
        with:
          keystore: ${{ secrets.SIGNING_KEYSTORE }}
          store-password: ${{ secrets.SIGNING_STORE_PASSWORD }}
          key-alias: ${{ secrets.SIGNING_KEY_ALIAS }}
          key-password: ${{ secrets.SIGNING_KEY_PASSWORD }}

      - name: Publish release to Maven Central
        env:
          GNUPG_SIGNING_KEY_ID: ${{ secrets.GNUPG_SIGNING_KEY_ID }}
          GNUPG_SIGNING_PASSWORD: ${{ secrets.GNUPG_SIGNING_PASSWORD }}
          GNUPG_SIGNING_SECRET_KEY: ${{ secrets.GNUPG_SIGNING_SECRET_KEY }}
          CENTRAL_PUBLISHER_PORTAL_TOKEN: ${{ secrets.CENTRAL_PUBLISHER_PORTAL_TOKEN }}
          CENTRAL_PUBLISHER_PORTAL_USERNAME: ${{ secrets.CENTRAL_PUBLISHER_PORTAL_USERNAME }}
          CENTRAL_PUBLISHER_PORTAL_PASSWORD: ${{ secrets.CENTRAL_PUBLISHER_PORTAL_PASSWORD }}
        run: ./gradlew publishToCentralPublisherPortal

  github-release:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
    needs: [ build, lint, unit-tests, instrumented-tests ]
    environment:
      name: github-release
      url: https://github.com/Orange-OpenSource/ouds-android/releases
    permissions:
      contents: write # Required to create release on repository
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Set up our JDK environment
        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
        with:
          distribution: 'zulu'
          java-version: '21'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
        with:
          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/develop' }}

      - name: Set up signing configuration
        uses: ./.github/actions/setup-signing
        with:
          keystore: ${{ secrets.SIGNING_KEYSTORE }}
          store-password: ${{ secrets.SIGNING_STORE_PASSWORD }}
          key-alias: ${{ secrets.SIGNING_KEY_ALIAS }}
          key-password: ${{ secrets.SIGNING_KEY_PASSWORD }}

      - name: Publish release to GitHub
        run: ./gradlew publishToGitHub
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  google-play-store-release:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
    needs: [ build, lint, unit-tests, instrumented-tests ]
    environment:
      name: google-play-store-release
      url: https://play.google.com/store/apps
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Set up our JDK environment
        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
        with:
          distribution: 'zulu'
          java-version: '21'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
        with:
          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/develop' }}

      - name: Publish release to Google Play Store
        run: |
          ./gradlew assembleProdRelease bundleProdRelease
          curl -F 'file=@app/build/outputs/bundle/prodRelease/app-prod-release.aab' https://oma-portal.orange.fr/oma/api/v1/external/applications/${{ secrets.OMA_APP_ID }}/artifacts -H "apiKey:${{ secrets.OMA_APP_TOKEN }}"

      - name: Store Google Play Store artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: google-play-store
          path: |
            app/build/outputs/apk/*/*/*.apk
            app/build/outputs/bundle/*/*.aab