ci.yml

name: CI
on:
  push:
    tags-ignore:
      - 'v*'
    branches:
      - '*'
  pull_request:
env:
  MIERU_VERSION: v3.34.0
  HYSTERIA_VERSION: v2.9.2
  MDVPN_REF: android-vpnservice-protect-hook
  MDVPN_COMMIT: d481d72d4b86783a87d536c214d2c68cc4e9320e
  NAIVE_VERSION: v149.0.7827.114-1
permissions:
  contents: read
jobs:
  libcore:
    name: Native Build (LibCore)
    runs-on: namespace-profile-nekoyay
    steps:
      - name: Checkout
        uses: actions/checkout@v5
      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '17'
      - name: Golang Status
        run: find buildScript libcore/*.sh | xargs cat | sha1sum > golang_status
      - name: Libcore Status
        run: git ls-files libcore | xargs cat | sha1sum > libcore_status
      - name: LibCore Cache
        id: cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            app/libs/libcore.aar
          key: ${{ hashFiles('.github/workflows/*', 'golang_status', 'libcore_status') }}-ci
      - name: Install Golang
        if: steps.cache.outputs.cache-hit != 'true'
        uses: actions/setup-go@v6
        with:
          go-version: '1.26.4'
      - name: Native Build
        if: steps.cache.outputs.cache-hit != 'true'
        run: ./run lib core
      - name: Upload LibCore
        uses: namespace-actions/upload-artifact@v1
        with:
          name: libcore-aar-ci
          path: app/libs/libcore.aar
          retention-days: 1
          if-no-files-found: error
  sidecars:
    name: Native Build (Sidecars)
    runs-on: namespace-profile-nekoyay
    steps:
      - name: Checkout
        uses: actions/checkout@v5
      - name: Sidecars Status
        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/lib/masterdnsvpn.sh buildScript/lib/naive.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
      - name: Sidecars Cache
        id: cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            app/executableSo
          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-${{ env.MDVPN_COMMIT }}-${{ env.NAIVE_VERSION }}-sidecars-ci
      - name: Install Golang
        if: steps.cache.outputs.cache-hit != 'true'
        uses: actions/setup-go@v6
        with:
          go-version: '1.26.4'
      - name: Mieru Build
        if: steps.cache.outputs.cache-hit != 'true'
        run: ./run lib mieru
      - name: Hysteria2 Download
        if: steps.cache.outputs.cache-hit != 'true'
        run: ./run lib hysteria2
      - name: MasterDnsVPN Build
        if: steps.cache.outputs.cache-hit != 'true'
        run: ./run lib masterdnsvpn
      - name: Naive Download
        if: steps.cache.outputs.cache-hit != 'true'
        run: ./run lib naive
      - name: Upload Sidecars
        uses: namespace-actions/upload-artifact@v1
        with:
          name: sidecars-so-ci
          path: app/executableSo
          retention-days: 1
          if-no-files-found: error
  build:
    name: Build OSS APK
    runs-on: namespace-profile-nekoyay
    needs:
      - libcore
      - sidecars
    steps:
      - name: Checkout
        uses: actions/checkout@v5
      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '17'
      - name: Download LibCore
        uses: namespace-actions/download-artifact@v1
        with:
          name: libcore-aar-ci
          path: app/libs
      - name: Download Sidecars
        uses: namespace-actions/download-artifact@v1
        with:
          name: sidecars-so-ci
          path: app/executableSo
      - name: Verify Sidecar Artifacts
        run: |
          for abi in arm64-v8a armeabi-v7a x86 x86_64; do
            for so in libmieru.so libhysteria2.so libmasterdnsvpn.so libnaive.so; do
              if [ ! -f "app/executableSo/$abi/$so" ]; then
                echo "Error: missing app/executableSo/$abi/$so (sidecar artifact missing)" >&2
                exit 1
              fi
            done
          done
      - name: Gradle cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ~/.gradle
          key: gradle-oss-${{ hashFiles('**/*.gradle.kts') }}-ci
      - name: Gradle Build
        env:
          BUILD_PLUGIN: none
        run: |
          echo "sdk.dir=${ANDROID_HOME}" > local.properties
          echo "ndk.dir=${ANDROID_HOME}/ndk/25.0.8775105" >> local.properties
          export LOCAL_PROPERTIES="${{ secrets.LOCAL_PROPERTIES }}"
          ./run init action gradle
          # Sign debug builds with the stable hawkff-release key so every CI APK
          # is signature-compatible and installs over a prior build without a
          # data wipe. Helpers.kt signs debug with the release key when the
          # keystore + KEYSTORE_PASS/ALIAS_NAME/ALIAS_PASS are present. If the
          # KEYSTORE_B64 secret is unset, fall back to the default debug key.
          if [ -n "${{ secrets.KEYSTORE_B64 }}" ]; then
            echo "${{ secrets.KEYSTORE_B64 }}" | base64 -d > release.keystore
          fi
          KEYSTORE_PASS="${{ secrets.KEYSTORE_PASS }}" ALIAS_NAME="${{ secrets.ALIAS_NAME }}" ALIAS_PASS="${{ secrets.ALIAS_PASS }}" ./gradlew app:assembleOssDebug
          APK=$(find app/build/outputs/renamed_apks -name '*arm64-v8a*.apk' | head -n 1)
          if [ -z "$APK" ]; then
            echo "Error: no arm64-v8a APK found under app/build/outputs/renamed_apks" >&2
            exit 1
          fi
          APK=$(dirname "$APK")
          echo "APK=$APK" >> $GITHUB_ENV
      - name: Upload Artifacts
        uses: namespace-actions/upload-artifact@v1
        with:
          name: NekoBox-debug-apks
          path: ${{ env.APK }}
      - name: Publish APK to Namespace workspace store
        # Also push the arm64-v8a APK into the Namespace *workspace* artifact
        # store so it can be fetched locally with `nsc artifact download`
        # (the GitHub-Actions artifact above is only reachable from a runner or
        # the dashboard). Path: nekobox/<branch>/<run>/<file>.apk. See AGENTS.md.
        run: |
          set -euo pipefail
          APK_FILE=$(find "${{ env.APK }}" -name '*arm64-v8a*.apk' | head -n 1)
          BRANCH="${GITHUB_REF_NAME//\//-}"
          DEST="nekobox/${BRANCH}/${GITHUB_RUN_ID}/$(basename "$APK_FILE")"
          nsc artifact upload "$APK_FILE" "$DEST"
          echo "Uploaded to Namespace workspace store: $DEST"