# Gate every pull request into `main` on lint + unit tests + a debug build, so a
# broken build can't reach the deployable branch. Debug builds are auto-signed,
# so this gate needs no secrets. The signed *release* APK + Gitea release come
# later (release.yml, M6). See docs/android/PLAN.md §12.
#
# Enforcement (one-time, in the Gitea UI):
#   Repository Settings -> Branches -> Branch Protection (rule for `main`)
#     * Enable Status Check
#     * Status check patterns:  PR Checks / *
#
# Runner: the org's self-hosted `ubuntu-latest`. The container lacks
# git/curl/unzip (needed by checkout + sdkmanager), so the first step installs
# them. It also installs JDK 17 from the Ubuntu archive rather than using
# actions/setup-java, because this runner can't resolve api.adoptium.net (that
# download fails with EAI_AGAIN) while the Ubuntu mirrors are reachable.
# (Faster later: switch to a prebuilt Android-SDK+JDK container image so nothing
# installs per-run.)

name: PR Checks

on:
  pull_request:
    branches: [main]

concurrency:
  group: pr-checks-${{ github.ref }}
  cancel-in-progress: true

jobs:
  android-build:
    runs-on: ubuntu-latest
    steps:
      # Install the tools checkout + the SDK installer need, plus JDK 17 (see the
      # header note on why we avoid actions/setup-java on this runner).
      - name: Install base tools + JDK 17
        run: |
          apt-get update
          apt-get install -y git curl unzip openjdk-17-jdk-headless
          echo "JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64" >> "$GITHUB_ENV"

      - uses: actions/checkout@v4

      - name: Set up Android SDK
        uses: android-actions/setup-android@v3

      # Install exactly what the build targets so it never depends on AGP's
      # build-time auto-download. `yes |` accepts any license prompts.
      - name: Install Android SDK packages
        run: yes | sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"

      - name: Cache Gradle
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle.kts', 'gradle/libs.versions.toml', 'gradle/wrapper/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-${{ runner.os }}-

      # chmod defensively: this runner's checkout doesn't preserve the git
      # executable bit, so `./gradlew` alone fails with "Permission denied".
      - name: Lint, test, assemble debug
        run: |
          chmod +x ./gradlew
          ./gradlew --no-daemon lint test assembleDebug