ci.yml

name: CI

# Two tiers.
#
# PR tier (pull_request, merge_group, push to code/cash): "Unit tests" and "Lint". These are the
# checks proposed as required. Their names must stay identical on every event: a required check
# that does not report on `merge_group` stalls the queue.
#
# Queue tier (merge_group, workflow_dispatch): "Vector instrumented tests", which needs an
# emulator and so is too slow for every PR push.
#
# The push trigger exists to warm the Gradle build cache. Only runs on code/cash write the cache;
# A manual workflow_dispatch also writes, to warm a branch. PR and merge-queue runs read it, so a PR re-executes only the tasks its diff invalidates.
on:
  pull_request:
  merge_group:
  workflow_dispatch:
  push:
    branches:
      - code/cash

concurrency:
  # Cancel superseded pushes to a PR branch. Queue entries are distinct refs and must never
  # cancel each other. Everything else gets a unique group.
  group: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.head_ref) || github.event_name == 'merge_group' && github.ref || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CI: true

jobs:
  unit-tests:
    name: Unit tests
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      # Cheap supply-chain guard: fails the run if gradle/wrapper/gradle-wrapper.jar
      # is not a byte-for-byte match for a jar published by Gradle.
      - name: Validate Gradle wrapper
        uses: gradle/actions/wrapper-validation@v4

      - name: Setup Java env
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'corretto'

      # Restores ~/.gradle including the local build cache. Writes only from code/cash.
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4
        with:
          cache-read-only: ${{ github.event_name != 'push' && github.event_name != 'workflow_dispatch' }}

      - name: Provision config
        uses: ./.github/actions/provision-config
        with:
          google-services: ${{ secrets.FLIPCASH2_GOOGLE_SERVICES }}
          bugsnag-api-key: ${{ secrets.FLIPCASH_BUGSNAG_API_KEY }}
          google-cloud-project-number: ${{ secrets.GOOGLE_CLOUD_PROJECT_NUMBER }}
          mixpanel-api-key: ${{ secrets.FLIPCASH_MIXPANEL_API_KEY }}
          coinbase-onramp-api-key: ${{ secrets.COINBASE_ONRAMP_API_KEY }}

      # Same tasks as the `flipcash_tests` fastlane lane minus lint, without the Ruby setup.
      - name: Run unit tests
        run: ./gradlew generateEmojiList flipcashTestDebug

  lint:
    name: Lint
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Validate Gradle wrapper
        uses: gradle/actions/wrapper-validation@v4

      - name: Setup Java env
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'corretto'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4
        with:
          cache-read-only: ${{ github.event_name != 'push' && github.event_name != 'workflow_dispatch' }}

      - name: Provision config
        uses: ./.github/actions/provision-config
        with:
          google-services: ${{ secrets.FLIPCASH2_GOOGLE_SERVICES }}
          bugsnag-api-key: ${{ secrets.FLIPCASH_BUGSNAG_API_KEY }}
          google-cloud-project-number: ${{ secrets.GOOGLE_CLOUD_PROJECT_NUMBER }}
          mixpanel-api-key: ${{ secrets.FLIPCASH_MIXPANEL_API_KEY }}
          coinbase-onramp-api-key: ${{ secrets.COINBASE_ONRAMP_API_KEY }}

      - name: Run lint
        run: ./gradlew generateEmojiList :apps:flipcash:app:lintDebug

  # Queue tier. Three androidTest suites need a device (JNI or Android-framework deps):
  #   - :libs:encryption:ed25519  (JNI + android.util.Base64)
  #   - :libs:encryption:mnemonic (wordlist in res/raw + JNI ed25519)
  #   - :libs:currency-math       (loads .bin tables from assets)
  # The host-JVM vector suites already run in "Unit tests" via flipcashTestDebug.
  vector-instrumented-tests:
    name: Vector instrumented tests
    if: github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    # Not blocking yet: :libs:encryption:mnemonic:connectedAndroidDeviceTest currently fails with
    # FileNotFoundException: slip10.json (Slip10DerivationVectorTest cannot find its vector file in
    # the device test assets). The emulator boots and :libs:currency-math passes. Remove this line
    # once the mnemonic asset packaging is fixed.
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Setup Java env
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'corretto'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4
        with:
          cache-read-only: true

      - name: Provision config
        uses: ./.github/actions/provision-config
        with:
          google-services: ${{ secrets.FLIPCASH2_GOOGLE_SERVICES }}
          bugsnag-api-key: ${{ secrets.FLIPCASH_BUGSNAG_API_KEY }}
          google-cloud-project-number: ${{ secrets.GOOGLE_CLOUD_PROJECT_NUMBER }}
          mixpanel-api-key: ${{ secrets.FLIPCASH_MIXPANEL_API_KEY }}
          coinbase-onramp-api-key: ${{ secrets.COINBASE_ONRAMP_API_KEY }}

      # Hosted Linux runners expose /dev/kvm only to the runner user after this rule is applied.
      - name: Enable KVM
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Run vector instrumented tests
        uses: reactivecircus/android-emulator-runner@v2
        with:
          api-level: 35
          arch: x86_64
          target: google_apis
          disable-animations: true
          script: >
            ./gradlew
            :libs:encryption:mnemonic:connectedAndroidDeviceTest
            :libs:currency-math:connectedAndroidTest
            --continue

      - name: Upload device test reports
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: vector-device-test-reports
          path: |
            libs/encryption/mnemonic/build/reports/androidTests
            libs/encryption/mnemonic/build/outputs/androidTest-results
            libs/currency-math/build/reports/androidTests
            libs/currency-math/build/outputs/androidTest-results
          if-no-files-found: ignore