android.yml

name: Android

on:
  pull_request:
    branches:
      - main
    paths-ignore:
      - '**/*.md'
      - 'ios/**'
  push:
    branches:
      - main
    tags:
      - android-[0-9]+.[0-9]+.[0-9]+
    paths-ignore:
      - '**/*.md'
      - 'ios/**'

env:
  GRADLE_OPTS: -Dorg.gradle.jvmargs="-Xms4g -Xmx4g -XX:MetaspaceSize=1g -XX:SoftRefLRUPolicyMSPerMB=1 -XX:+UseParallelGC -XX:+HeapDumpOnOutOfMemoryError -XX:+UnlockExperimentalVMOptions"
  TERM: dumb

jobs:
  assemble:
    name: Assemble
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
      KSTREAMLINED_KEY_ALIAS: ${{ secrets.KSTREAMLINED_KEY_ALIAS }}
      KSTREAMLINED_KEY_PASSWORD: ${{ secrets.KSTREAMLINED_KEY_PASSWORD }}
      KSTREAMLINED_STORE_PASSWORD: ${{ secrets.KSTREAMLINED_STORE_PASSWORD }}

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '23'

      - name: Decrypt secrets
        run: |
          mkdir android/app/src/dev && mkdir android/app/src/prod
          openssl enc -d -aes-256-cbc -pbkdf2 -iter 10000 -salt -in android/secrets/kstreamlined.aes -out android/secrets/kstreamlined.jks -k $ENCRYPTION_KEY
          openssl enc -d -aes-256-cbc -pbkdf2 -iter 10000 -salt -in android/secrets/android-google-services-dev.aes -out android/app/src/dev/google-services.json -k $ENCRYPTION_KEY
          openssl enc -d -aes-256-cbc -pbkdf2 -iter 10000 -salt -in android/secrets/android-google-services-prod.aes -out android/app/src/prod/google-services.json -k $ENCRYPTION_KEY

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

      - name: Assemble dev debug APK and signed release App Bundle
        run: ./gradlew app:assembleDevDebug app:bundleProdRelease -Pandroid.experimental.settings.executionProfile=ci --scan

      - name: Cleanup secrets
        if: always()
        run: |
          rm -f android/secrets/kstreamlined.jks
          rm -f android/app/src/dev/google-services.json
          rm -f android/app/src/prod/google-services.json

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-outputs
          path: android/app/build/outputs/
          retention-days: 7

  unit-tests:
    name: Unit tests
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      ENABLE_APP_VERSIONING: false

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '23'

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

      - name: Run unit tests
        run: ./gradlew test jvmTest -PslimTests

  static-analysis:
    name: Static analysis
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '23'

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

      - name: Run detekt, ktlint and Android Lint
        run: |
          ./gradlew detekt lint
          ./gradlew -p build-logic detekt

  deploy-dev-build:
    name: Upload dev build
    needs: [ assemble, unit-tests, static-analysis ]
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/android')
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
      ENABLE_APP_VERSIONING: false

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '23'

      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-outputs
          path: android/app/build/outputs

      - name: Decrypt secrets
        run: |
          mkdir android/app/src/dev
          openssl enc -d -aes-256-cbc -pbkdf2 -iter 10000 -salt -in secrets/firebase-key.aes -out secrets/firebase-key.json -k $ENCRYPTION_KEY
          openssl enc -d -aes-256-cbc -pbkdf2 -iter 10000 -salt -in android/secrets/android-google-services-dev.aes -out android/app/src/dev/google-services.json -k $ENCRYPTION_KEY

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

      - name: Publish dev build to Firebase App Distribution
        run: ./gradlew processDevDebugGoogleServices appDistributionUploadDevDebug

      - name: Cleanup secrets
        if: always()
        run: |
          rm -f secrets/firebase-key.json
          rm -f android/app/src/dev/google-services.json

  deploy-release-build:
    name: Publish release build to Play Store (internal test track)
    needs: [ assemble, unit-tests, static-analysis ]
    if: startsWith(github.ref, 'refs/tags/android')
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
      ENABLE_APP_VERSIONING: false

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '23'

      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-outputs
          path: android/app/build/outputs

      - name: Decrypt secrets
        run: |
          mkdir android/app/src/prod
          openssl enc -d -aes-256-cbc -pbkdf2 -iter 10000 -salt -in android/secrets/play-publishing.aes -out android/secrets/play-publishing.json -k $ENCRYPTION_KEY
          openssl enc -d -aes-256-cbc -pbkdf2 -iter 10000 -salt -in android/secrets/android-google-services-prod.aes -out android/app/src/prod/google-services.json -k $ENCRYPTION_KEY

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

      - name: Publish release App Bundle to Play Store
        run: ./gradlew publishBundle --artifact-dir android/app/build/outputs/bundle/prodRelease

      - name: Cleanup secrets
        if: always()
        run: |
          rm -f android/secrets/play-publishing.json
          rm -f android/app/src/prod/google-services.json