ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build:
    name: Build and gates
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '21'

      - uses: gradle/actions/setup-gradle@v6

      # Pinned in app/build.gradle.kts. Runner images carry whatever NDKs they
      # happened to ship, so relying on one being present is relying on the
      # image; this makes the requirement explicit and the failure legible.
      - name: Install the pinned NDK and CMake
        run: |
          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" \
            "ndk;28.2.13676358" "cmake;3.22.1"

      - name: Style
        run: ./gradlew ktlintCheck

      - name: Unit tests
        run: ./gradlew testDebugUnitTest

      - name: Protocol coverage gate
        run: ./gradlew koverVerifyDebug

      - name: Android lint
        run: ./gradlew lintDebug

      # Runs before Assemble on purpose: a skew is a property of the resolved
      # graph, so it is cheaper to catch here than after a full build — and the
      # build succeeding is exactly what makes a skew invisible.
      - name: Classpath consistency
        run: ./gradlew checkClasspathConsistency

      - name: Assemble
        run: ./gradlew assembleDebug

      - name: Upload reports on failure
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: reports
          path: |
            app/build/reports/
            app/build/test-results/
          retention-days: 7

  conformance:
    name: Protocol vectors
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: '3.12'

      # Recomputes every vector from the specification prose. It references no
      # upstream code and needs no clone, so it is the cheapest possible check
      # that the protocol understanding here is still self-consistent.
      - name: Verify protocol vectors
        run: python3 conformance/scripts/verify-vectors.py

  on-device:
    name: Design rules and the native stack, on a device
    runs-on: ubuntu-latest
    # Two things that a JVM cannot check.
    #
    # The design rules from docs/design-system.md — the certificate statement,
    # the distinct rejections, the Morph switch, the absence of an upload
    # figure — because nothing crashes when they are violated.
    #
    # And the lwIP layer, because a JVM cannot load an .so built for Android:
    # until this job runs, the whole C layer is code that merely compiled.
    #
    # This is what the x86_64 ABI in app/build.gradle.kts is for: physical
    # devices and local emulators want arm64-v8a, CI runners want x86_64.
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '21'

      - uses: gradle/actions/setup-gradle@v6

      # Pinned in app/build.gradle.kts. Runner images carry whatever NDKs they
      # happened to ship, so relying on one being present is relying on the
      # image; this makes the requirement explicit and the failure legible.
      - name: Install the pinned NDK and CMake
        run: |
          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" \
            "ndk;28.2.13676358" "cmake;3.22.1"

      # KVM has to be enabled explicitly on ubuntu-latest, or the emulator
      # falls back to software rendering and takes long enough to time out.
      - name: Enable KVM
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
            | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Device tests
        uses: reactivecircus/android-emulator-runner@v2
        with:
          api-level: 31
          arch: x86_64
          target: google_apis
          profile: pixel_5
          disable-animations: true
          script: ./gradlew connectedDebugAndroidTest

      - name: Upload reports on failure
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: ui-rule-reports
          path: app/build/reports/androidTests/
          retention-days: 7