ci.yaml

name: CI/CD

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  FLUTTER_VERSION_FILE: '.github/flutter-version.txt'
  # OSM tile server acknowledgment (proves we've read the usage policy)
  # See: https://operations.osmfoundation.org/policies/tiles/
  DART_DEFINES: '--dart-define=flutter.flutter_map.unblockOSM=Our tile servers are not.'

jobs:
  analyze:
    name: Analyze & Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Install dependencies
        run: flutter pub get

      - name: Run code generation
        run: dart run build_runner build --delete-conflicting-outputs

      - name: Analyze code
        run: flutter analyze --fatal-infos

      - name: Check formatting
        run: dart format --set-exit-if-changed .

  test:
    name: Test
    needs: analyze
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Install dependencies
        run: flutter pub get

      - name: Run code generation
        run: dart run build_runner build --delete-conflicting-outputs

      - name: Run tests
        run: flutter test --coverage --exclude-tags performance

      - name: Upload coverage
        uses: codecov/codecov-action@v6
        if: always()
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: coverage/lcov.info
          fail_ci_if_error: false  # Enable after configuring repo on codecov.io

  integration-test:
    name: Integration Test (macOS)
    needs: analyze
    runs-on: macos-14
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - name: Setup Xcode
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: 'latest-stable'

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Disable code signing for CI
        run: |
          echo 'CODE_SIGNING_ALLOWED = NO' >> macos/Runner/Configs/Debug.xcconfig
          echo 'CODE_SIGNING_REQUIRED = NO' >> macos/Runner/Configs/Debug.xcconfig
          echo 'CODE_SIGN_IDENTITY = ' >> macos/Runner/Configs/Debug.xcconfig

      - name: Install dependencies
        run: flutter pub get

      - name: Run code generation
        run: dart run build_runner build --delete-conflicting-outputs

      - name: Run integration tests
        run: |
          flutter test integration_test/ \
            -d macos \
            --dart-define=SCREENSHOT_MODE=false

  build-ios:
    name: Build iOS
    needs: test
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - name: Setup Xcode
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: 'latest-stable'

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Cache CocoaPods
        uses: actions/cache@v5
        with:
          path: |
            ios/Pods
            ~/.cocoapods
          key: pods-ios-${{ runner.os }}-${{ hashFiles('ios/Podfile.lock') }}
          restore-keys: |
            pods-ios-${{ runner.os }}-

      - name: Install dependencies
        run: flutter pub get

      - name: Run code generation
        run: dart run build_runner build --delete-conflicting-outputs

      - name: Update CocoaPods repo
        run: pod repo update

      - name: Clean native asset build state
        run: |
          rm -rf build/native_assets
          rm -rf .dart_tool/flutter_build

      - name: Build iOS
        run: flutter build ios --release --no-codesign "${{ env.DART_DEFINES }}" -v

      - name: Upload iOS artifact
        uses: actions/upload-artifact@v7
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        with:
          name: ios-build
          path: build/ios/iphoneos/Runner.app
          retention-days: 7

  build-macos:
    name: Build macOS
    needs: test
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - name: Setup Xcode
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: 'latest-stable'

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Cache CocoaPods
        uses: actions/cache@v5
        with:
          path: |
            macos/Pods
            ~/.cocoapods
          key: pods-macos-${{ runner.os }}-${{ hashFiles('macos/Podfile.lock') }}
          restore-keys: |
            pods-macos-${{ runner.os }}-

      - name: Cache Xcode DerivedData
        uses: actions/cache@v5
        with:
          path: |
            ~/Library/Developer/Xcode/DerivedData
          key: deriveddata-${{ runner.os }}-${{ hashFiles('macos/Podfile.lock') }}
          restore-keys: |
            deriveddata-${{ runner.os }}-

      - name: Install dependencies
        run: flutter pub get

      - name: Run code generation
        run: dart run build_runner build --delete-conflicting-outputs

      - name: Update CocoaPods repo
        run: pod repo update

      - name: Clean native asset build state
        run: |
          rm -rf build/native_assets
          rm -rf .dart_tool/flutter_build

      - name: Build macOS (no-sandbox for distribution)
        run: |
          # Configure ad-hoc signing for CI (no developer certificate available)
          # Must modify project.pbxproj directly - xcconfig can't override target-level settings
          sed -i '' \
            -e 's/CODE_SIGN_IDENTITY = ".*"/CODE_SIGN_IDENTITY = "-"/g' \
            -e 's/DEVELOPMENT_TEAM = .*;/DEVELOPMENT_TEAM = "";/g' \
            -e 's/PROVISIONING_PROFILE_SPECIFIER = ".*"/PROVISIONING_PROFILE_SPECIFIER = ""/g' \
            -e 's/"CODE_SIGN_IDENTITY\[sdk=macosx\*\]" = ".*"/"CODE_SIGN_IDENTITY[sdk=macosx*]" = "-"/g' \
            macos/Runner.xcodeproj/project.pbxproj

          # Build with Flutter
          flutter build macos --release "${{ env.DART_DEFINES }}"

          # Re-sign with ad-hoc signature and no-sandbox entitlements
          codesign --force --deep --sign - \
            --entitlements macos/Runner/ReleaseNoSandbox.entitlements \
            build/macos/Build/Products/Release/submersion.app

      - name: Upload macOS artifact
        uses: actions/upload-artifact@v7
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        with:
          name: macos-build
          path: build/macos/Build/Products/Release/submersion.app
          retention-days: 7

  build-android:
    name: Build Android
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '21'

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Cache Gradle
        uses: actions/cache@v5
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-${{ runner.os }}-

      - name: Install dependencies
        run: flutter pub get

      - name: Run code generation
        run: dart run build_runner build --delete-conflicting-outputs

      - name: Build Android APK
        run: flutter build apk --release "${{ env.DART_DEFINES }}" -v

      - name: Upload Android artifact
        uses: actions/upload-artifact@v7
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        with:
          name: android-apk
          path: build/app/outputs/flutter-apk/app-release.apk
          retention-days: 7

  build-linux:
    name: Build Linux
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            clang \
            cmake \
            ninja-build \
            pkg-config \
            libgtk-3-dev \
            liblzma-dev \
            libstdc++-12-dev \
            libsecret-1-dev

      - name: Install dependencies
        run: flutter pub get

      - name: Run code generation
        run: dart run build_runner build --delete-conflicting-outputs

      - name: Build Linux
        run: flutter build linux --release "${{ env.DART_DEFINES }}" -v

      - name: Upload Linux artifact
        uses: actions/upload-artifact@v7
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        with:
          name: linux-build
          path: build/linux/x64/release/bundle
          retention-days: 7

  build-windows:
    name: Build Windows
    needs: test
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        # Windows runners default to PowerShell, where the bash-style
        # $(...) command substitution and $GITHUB_OUTPUT do not work. Without
        # this the version output is empty and subosito installs the latest
        # stable Flutter instead of the pinned version. See flutter-version.txt.
        shell: bash
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~\.pub-cache
            ${{ github.workspace }}\.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Cache NuGet packages
        uses: actions/cache@v5
        with:
          path: |
            C:\Users\runneradmin\.nuget\packages
          key: nuget-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            nuget-${{ runner.os }}-

      - name: Install dependencies
        run: flutter pub get

      - name: Run code generation
        run: dart run build_runner build --delete-conflicting-outputs

      - name: Build Windows
        run: flutter build windows --release "${{ env.DART_DEFINES }}" -v

      - name: Upload Windows artifact
        uses: actions/upload-artifact@v7
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        with:
          name: windows-build
          path: build\windows\x64\runner\Release
          retention-days: 7