name: Android CI

on:
  workflow_dispatch:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

permissions:
  contents: read

env:
  JAVA_VERSION: 21.0.11+10

jobs:
  verify:
    name: Test and lint
    runs-on: ubuntu-24.04

    steps:
      - name: Checkout code
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Set up pinned JDK
        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
        with:
          distribution: temurin
          java-version: ${{ env.JAVA_VERSION }}

      - name: Set up and validate Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

      - name: Verify native library inputs
        run: tools/arti-build/verify-checksums.sh

      - name: Run unit tests
        run: ./gradlew testDebugUnitTest

      - name: Run lint
        run: ./gradlew lintDebug

      - name: Upload test reports
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: test-reports
          path: |
            **/build/test-results/
            **/build/reports/tests/

      - name: Upload lint results
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: lint-results
          path: "**/build/reports/lint-results-*.html"

  build-debug:
    name: Build debug APK
    runs-on: ubuntu-24.04
    needs: verify

    steps:
      - name: Checkout code
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Set up pinned JDK
        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
        with:
          distribution: temurin
          java-version: ${{ env.JAVA_VERSION }}

      - name: Set up and validate Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

      - name: Build debug APK
        run: ./gradlew assembleDebug

      - name: Upload debug APK
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: Debug-apk
          path: app/build/outputs/apk/debug/*.apk

  reproducible-build:
    name: Reproducible release build ${{ matrix.replica }}
    runs-on: ubuntu-24.04
    needs: verify
    strategy:
      fail-fast: false
      matrix:
        replica: [a, b]

    steps:
      - name: Checkout code
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Set up pinned JDK
        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
        with:
          distribution: temurin
          java-version: ${{ env.JAVA_VERSION }}

      - name: Set up and validate Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
        with:
          cache-disabled: true

      - name: Build canonical unsigned release
        run: tools/reproducible-builds/build-in-container.sh "$RUNNER_TEMP/release-${{ matrix.replica }}"

      - name: Upload build replica
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: reproducible-release-${{ matrix.replica }}
          path: ${{ runner.temp }}/release-${{ matrix.replica }}/*
          if-no-files-found: error

  compare-reproducible-builds:
    name: Compare release bytes
    runs-on: ubuntu-24.04
    needs: reproducible-build

    steps:
      - name: Checkout verification script
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Download replica A
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: reproducible-release-a
          path: ${{ runner.temp }}/release-a

      - name: Download replica B
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: reproducible-release-b
          path: ${{ runner.temp }}/release-b

      - name: Compare every canonical byte
        run: tools/reproducible-builds/compare-release.sh "$RUNNER_TEMP/release-a" "$RUNNER_TEMP/release-b"