android.yml

name: Android viewer

on:
  pull_request:
    paths: ['client/**', 'scripts/gen-android-signing-key.sh', '.github/workflows/android.yml', '.github/workflows/android-release.yml', '.github/workflows/android-publish-play.yml', '.github/workflows/release.yml']
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: android-${{ github.ref }}
  cancel-in-progress: true

jobs:
  android:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'
      - uses: android-actions/setup-android@v3
        with:
          packages: platform-tools
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: armv7-linux-androideabi,aarch64-linux-android,x86_64-linux-android
      - uses: gradle/actions/setup-gradle@v4
      - name: Install Android build tools
        run: sdkmanager 'platforms;android-36' 'build-tools;36.0.0' 'ndk;27.2.12479018'
      - name: Shared policy and credential tests
        run: cargo test --manifest-path client/Cargo.toml -p betterframe-client-core -p betterframe-android-bridge --locked
      - name: APK verifier failure cases
        run: PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s client/android/scripts -p 'test_*.py' -v
      - name: Create disposable CI signing key
        run: |
          bash scripts/gen-android-signing-key.sh "$RUNNER_TEMP/android-ci-key"
          store_password=$(cat "$RUNNER_TEMP/android-ci-key/store-password.txt")
          key_password=$(cat "$RUNNER_TEMP/android-ci-key/key-password.txt")
          echo "::add-mask::$store_password"
          echo "::add-mask::$key_password"
          {
            echo "BF_ANDROID_KEYSTORE_PATH=$RUNNER_TEMP/android-ci-key/release.p12"
            echo "BF_ANDROID_KEYSTORE_PASSWORD=$store_password"
            echo "BF_ANDROID_KEY_PASSWORD=$key_password"
            echo "BF_ANDROID_KEY_ALIAS=$(cat "$RUNNER_TEMP/android-ci-key/key-alias.txt")"
            echo 'BF_ANDROID_REQUIRE_SIGNING=true'
            echo 'BF_ANDROID_VERSION_CODE=1001'
            echo 'BF_ANDROID_VERSION_NAME=ci.1'
          } >> "$GITHUB_ENV"
      - name: Build all three ABIs, unit tests and lint
        working-directory: client/android
        run: ./gradlew --no-daemon assembleDebug assembleRelease bundleRelease testDebugUnitTest lintDebug lintRelease
      - name: Verify store metadata and signed bundle
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          python3 client/android/scripts/check-play-metadata.py
          gh release download 1.18.3 --repo google/bundletool --pattern bundletool-all-1.18.3.jar --dir "$RUNNER_TEMP"
          echo "a099cfa1543f55593bc2ed16a70a7c67fe54b1747bb7301f37fdfd6d91028e29  $RUNNER_TEMP/bundletool-all-1.18.3.jar" | sha256sum --check
          certificate=$(cat "$RUNNER_TEMP/android-ci-key/certificate-sha256.txt")
          python3 client/android/scripts/verify-apk.py --apk client/android/app/build/outputs/apk/release/app-release.apk \
            --certificate-sha256 "$certificate" --version-code 1001 --version-name ci.1 \
            --apksigner "$ANDROID_HOME/build-tools/36.0.0/apksigner" --aapt "$ANDROID_HOME/build-tools/36.0.0/aapt" \
            --metadata "$RUNNER_TEMP/ci-android.json"
          python3 client/android/scripts/verify-aab.py --bundle client/android/app/build/outputs/bundle/release/app-release.aab \
            --metadata "$RUNNER_TEMP/ci-android.json" --bundletool "$RUNNER_TEMP/bundletool-all-1.18.3.jar" \
            --certificate-sha256 "$certificate"
          "$ANDROID_HOME/build-tools/36.0.0/zipalign" -c -P 16 4 client/android/app/build/outputs/apk/release/app-release.apk
      - name: Build and verify signed release upgrade
        run: |
          mkdir -p "$RUNNER_TEMP/android-upgrade"
          cp client/android/app/build/outputs/apk/release/app-release.apk "$RUNNER_TEMP/android-upgrade/base.apk"
          (
            cd client/android
            BF_ANDROID_VERSION_CODE=1002 BF_ANDROID_VERSION_NAME=ci.2 ./gradlew --no-daemon assembleRelease
          )
          cp client/android/app/build/outputs/apk/release/app-release.apk "$RUNNER_TEMP/android-upgrade/update.apk"
          certificate=$(cat "$RUNNER_TEMP/android-ci-key/certificate-sha256.txt")
          build_tools="$ANDROID_HOME/build-tools/36.0.0"
          python3 client/android/scripts/verify-apk.py --apk "$RUNNER_TEMP/android-upgrade/base.apk" \
            --certificate-sha256 "$certificate" --version-code 1001 --version-name ci.1 \
            --apksigner "$build_tools/apksigner" --aapt "$build_tools/aapt"
          python3 client/android/scripts/verify-apk.py --apk "$RUNNER_TEMP/android-upgrade/update.apk" \
            --certificate-sha256 "$certificate" --version-code 1002 --version-name ci.2 \
            --apksigner "$build_tools/apksigner" --aapt "$build_tools/aapt"
          if python3 client/android/scripts/verify-apk.py --apk "$RUNNER_TEMP/android-upgrade/update.apk" \
            --certificate-sha256 "$(printf '%064d' 0)" --version-code 1002 --version-name ci.2 \
            --apksigner "$build_tools/apksigner" --aapt "$build_tools/aapt"; then
            echo 'Verifier unexpectedly accepted an untrusted signing certificate' >&2
            exit 1
          fi
      - name: Enable emulator acceleration
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm
      - name: Android smoke tests and signed release upgrade continuity
        uses: reactivecircus/android-emulator-runner@v2
        with:
          api-level: 29
          arch: x86_64
          target: default
          disable-animations: true
          script: bash "$GITHUB_WORKSPACE/client/android/scripts/test-viewer.sh"
      - name: Android 16 target SDK smoke tests
        uses: reactivecircus/android-emulator-runner@v2
        with:
          api-level: 36
          arch: x86_64
          target: google_apis
          disable-animations: true
          script: bash "$GITHUB_WORKSPACE/client/android/scripts/test-viewer.sh"
      - name: Remove disposable signing material
        if: always()
        run: rm -rf "$RUNNER_TEMP/android-ci-key" "$RUNNER_TEMP/android-upgrade"
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: android-viewer-build
          path: |
            client/android/app/build/outputs/apk/
            client/android/app/build/reports/
          if-no-files-found: warn