android-release-artifacts.yml

name: Android Release Artifacts

on:
  workflow_dispatch:
    inputs:
      version:
        description: Version name to be uploaded for AAR release
        required: false
        type: string
      upload_to_maven:
        description: Upload the AAR to maven staging repository
        required: false
        type: boolean
      flavor:
        type: choice
        options:
          - "xnnpack"
          - "vulkan+xnnpack"
  schedule:
    - cron: 0 10 * * *

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check-if-aar-exists:
    name: check-if-aar-exists
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    steps:
      - name: Check if this RC version is already in S3
        shell: bash
        run: |
          VERSION="${{ inputs.version }}"
          if [ -z "$VERSION" ]; then
            echo "No version name specified. Will create a snapshot AAR"
            exit 0
          fi
          if curl -I "https://ossci-android.s3.amazonaws.com/executorch/release/${VERSION}/executorch.aar" | grep "200 OK"; then
            echo "AAR already exists at https://ossci-android.s3.amazonaws.com/executorch/release/${VERSION}/executorch.aar"
            echo "Will skip build/upload"
            exit 1
          fi

  build-aar:
    name: build-aar
    needs: check-if-aar-exists
    if: ${{ !github.event.pull_request.head.repo.fork }}
    uses: pytorch/test-infra/.github/workflows/linux_job_v2.yml@release/2.7
    secrets: inherit
    permissions:
      id-token: write
      contents: read
    with:
      secrets-env: EXECUTORCH_MAVEN_SIGNING_KEYID EXECUTORCH_MAVEN_SIGNING_PASSWORD EXECUTORCH_MAVEN_CENTRAL_PASSWORD EXECUTORCH_MAVEN_CENTRAL_USERNAME EXECUTORCH_MAVEN_SIGNING_GPG_KEY_CONTENTS
      # As this job has access to Maven credential, run this on a fresh ephemeral runner
      runner: ephemeral.linux.2xlarge
      docker-image: executorch-ubuntu-22.04-clang12-android
      submodules: 'recursive'
      ref: ${{ github.sha }}
      timeout: 90
      upload-artifact: android-apps
      upload-artifact-to-s3: true
      script: |
        set -eux

        # Use sccache for NDK compiler as well
        export CMAKE_CXX_COMPILER_LAUNCHER=sccache
        export CMAKE_C_COMPILER_LAUNCHER=sccache

        # The generic Linux job chooses to use base env, not the one setup by the image
        CONDA_ENV=$(conda env list --json | jq -r ".envs | .[-1]")
        conda activate "${CONDA_ENV}"
        PYTHON_EXECUTABLE=python bash .ci/scripts/setup-linux.sh --build-tool buck2
        export ARTIFACTS_DIR_NAME=artifacts-to-be-uploaded

        mkdir -p ~/.gradle
        touch ~/.gradle/gradle.properties
        echo "signing.keyId=${SECRET_EXECUTORCH_MAVEN_SIGNING_KEYID}" >> ~/.gradle/gradle.properties
        echo "signing.password=${SECRET_EXECUTORCH_MAVEN_SIGNING_PASSWORD}" >> ~/.gradle/gradle.properties
        echo "mavenCentralUsername=${SECRET_EXECUTORCH_MAVEN_CENTRAL_USERNAME}" >> ~/.gradle/gradle.properties
        echo "mavenCentralPassword=${SECRET_EXECUTORCH_MAVEN_CENTRAL_PASSWORD}" >> ~/.gradle/gradle.properties
        echo "signing.secretKeyRingFile=/tmp/secring.gpg" >> ~/.gradle/gradle.properties

        echo -n "$SECRET_EXECUTORCH_MAVEN_SIGNING_GPG_KEY_CONTENTS" | base64 -d > /tmp/secring.gpg

        # Update the version name in build.gradle in case of maven publish
        VERSION="${{ inputs.version }}"
        if [ ! -z "$VERSION" ]; then
          sed -i "s/\(coordinates(\"org.pytorch\", \"executorch-android\", \"\)\([0-9]\+.[0-9]\+.[0-9]\+\)\(\")\)/\1$VERSION\3/" extension/android/executorch_android/build.gradle
        fi

        FLAVOR="${{ inputs.flavor }}"
        if [[ "$FLAVOR" == "vulkan+xnnpack" ]]; then
          export EXECUTORCH_BUILD_VULKAN=ON
        fi

        # Build AAR Package
        mkdir aar-out
        export BUILD_AAR_DIR=aar-out
        bash scripts/build_android_library.sh
        mkdir -p "${ARTIFACTS_DIR_NAME}"
        cp aar-out/executorch.aar "${ARTIFACTS_DIR_NAME}/executorch.aar"

        shasum -a 256 "${ARTIFACTS_DIR_NAME}/executorch.aar"

        # Publish to maven staging
        UPLOAD_TO_MAVEN="${{ inputs.upload_to_maven }}"
        if [[ "$UPLOAD_TO_MAVEN" == "true" ]]; then
          (cd extension/android; ANDROID_HOME="${ANDROID_SDK:-/opt/android/sdk}" ./gradlew :executorch_android:publishToMavenCentral)
        fi

  upload-release-aar:
    name: upload-release-aar
    needs: build-aar
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    permissions:
      id-token: write
      contents: read
    steps:
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v1.7.0
        with:
          role-to-assume: arn:aws:iam::308535385114:role/gha_executorch_upload-frameworks-android
          aws-region: us-east-1
      - name: Upload AAR RC to AWS S3
        shell: bash
        run: |
          wget https://gha-artifacts.s3.amazonaws.com/${{ github.repository }}/${{ github.run_id }}/artifacts/executorch.aar
          shasum -a 256 executorch.aar > executorch.aar.sha256sums

          pip install awscli==1.32.18
          AWS_CMD="aws s3 cp"
          VERSION="${{ inputs.version }}"
          if [ -z "$VERSION" ]; then
            VERSION="snapshot-$(date +"%Y%m%d")"
          fi
          ${AWS_CMD} executorch.aar s3://ossci-android/executorch/release/${VERSION}/executorch.aar --acl public-read
          ${AWS_CMD} executorch.aar.sha256sums s3://ossci-android/executorch/release/${VERSION}/executorch.aar.sha256sums --acl public-read