ci.yaml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

jobs:
  pre-commit:
    name: Run pre-commit to check formatting and linting
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup
        with:
          java: true
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      # pre-commit/action@v3.0.1
      - run: python -m pip install pre-commit
      - uses: actions/cache@v4
        with:
          path: ~/.cache/pre-commit
          key: pre-commit|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}
      - name: Run pre-commit
        run: pre-commit run --show-diff-on-failure --color=always --all-files
  test-android:
    name: Test for Android
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup
        with:
          java: true
          kotlin-cache: true
          rsvg: true
      - run: ./gradlew spotlessCheck
      - name: shared checks & unit tests
        run: ./gradlew shared:check
        env:
          MAPBOX_SECRET_TOKEN: ${{ secrets.MAPBOX_SECRET_TOKEN }}
          MAPBOX_PUBLIC_TOKEN: ${{ secrets.MAPBOX_PUBLIC_TOKEN }}
      - uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: android-shared-reports
          path: shared/build/reports
      - name: android checks & unit tests
        run: ./gradlew androidApp:check
        env:
          MAPBOX_SECRET_TOKEN: ${{ secrets.MAPBOX_SECRET_TOKEN }}
          MAPBOX_PUBLIC_TOKEN: ${{ secrets.MAPBOX_PUBLIC_TOKEN }}
      - uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: android-android-reports
          path: androidApp/build/reports
  emulator-test-android:
    name: Run Android instrumented tests in emulator
    runs-on: mobile_app_runner
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - api-level: 28
            target: default
            arch: x86
          # - api-level: 33
          #   target: default
          #   arch: x86_64
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup
        with:
          java: true
          kotlin-cache: true
          rsvg: true
      # full setup including AVD snapshot caching from https://github.com/ReactiveCircus/android-emulator-runner/blob/a3dcdb348bb02349cd939d168a74e31a9094b7f0/README.md
      - name: Enable KVM
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm
      - name: run tests
        uses: reactivecircus/android-emulator-runner@v2
        timeout-minutes: 30
        with:
          api-level: ${{ matrix.api-level }}
          target: ${{ matrix.target }}
          arch: ${{ matrix.arch }}
          force-avd-creation: false
          disable-animations: true
          script: ./bin/android-instrumented-test-ci.sh
        env:
          MAPBOX_SECRET_TOKEN: ${{ secrets.MAPBOX_SECRET_TOKEN }}
          MAPBOX_PUBLIC_TOKEN: ${{ secrets.MAPBOX_PUBLIC_TOKEN }}
      - uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: android-connected-reports-${{ matrix.api-level }}-${{ matrix.target }}-${{ matrix.arch }}
          path: androidApp/build/reports
  build-android:
    name: Build for Android
    if: github.actor != 'dependabot[bot]'
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup
        with:
          java: true
          kotlin-cache: true
          rsvg: true
          ruby: true
          gcp-provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          gcp-service-account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1
      - name: Fetch AWS secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@v2
        with:
          secret-ids: |
            mobile-app-android-upload-key-passphrase
      - name: Load code signing key
        run: |
          cd androidApp
          aws secretsmanager get-secret-value --secret-id mobile-app-android-upload-key --output json | jq -r '.SecretBinary' | base64 --decode > upload-keystore.jks
      - name: Build Android app
        env:
          KEYSTORE_FILE: "${{ github.workspace }}/androidApp/upload-keystore.jks"
          KEYSTORE_PASSWORD: ${{ env.MOBILE_APP_ANDROID_UPLOAD_KEY_PASSPHRASE }}
          KEY_ALIAS: "upload"
          KEY_PASSWORD: ${{ env.MOBILE_APP_ANDROID_UPLOAD_KEY_PASSPHRASE }}
          MAPBOX_SECRET_TOKEN: ${{ secrets.MAPBOX_SECRET_TOKEN }}
          MAPBOX_PUBLIC_TOKEN: ${{ secrets.MAPBOX_PUBLIC_TOKEN }}
        run: |
          bundle exec fastlane android build
      - uses: actions/upload-artifact@v4
        with:
          name: android-apk
          path: androidApp/build/outputs/apk/release/androidApp-release.apk
      - uses: actions/upload-artifact@v4
        with:
          name: android-aab
          path: androidApp/build/outputs/bundle/release/androidApp-release.aab
  deploy-android:
    name: Upload to Google Play
    if: github.event_name != 'pull_request'
    concurrency:
      group: deploy-android
      cancel-in-progress: false
    needs:
      - build-android
      - test-android
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: android-aab
          path: androidApp/build/outputs/bundle/release
      - uses: ./.github/actions/setup
        with:
          gcp-provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          gcp-service-account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
          ruby: true
      - name: Upload to Google Play
        run: |
          bundle exec fastlane android internal