wtclaude
21e235a07f
ENGAGEMENT.md §7.1 Q8. `pr-checks.yml` triggered only on PRs into `main`, so a workstream that lands its phases on `edge` before one cutover PR got no CI at all until the cutover — all nine M12 phase PRs merged without a single run, and engagement Phase 8 was about to do the same. A phase should fail on its own PR. Sonar is untouched: `sonarqube.yml` is a push-on-`main` analysis, not a PR gate, so no phase PR was ever expected to run it. Co-Authored-By: Claude <noreply@anthropic.com>
81 lines
3.5 KiB
YAML
81 lines
3.5 KiB
YAML
# Gate every pull request into `main` or `edge` on lint + unit tests + a debug
|
|
# build, so a broken build can't reach the deployable branch. Debug builds are auto-signed,
|
|
# so this gate needs no secrets. The signed *release* APK + Gitea release come
|
|
# later (release.yml, M6). See docs/android/PLAN.md §12.
|
|
#
|
|
# Enforcement (one-time, in the Gitea UI):
|
|
# Repository Settings -> Branches -> Branch Protection (rule for `main`)
|
|
# * Enable Status Check
|
|
# * Status check patterns: PR Checks / *
|
|
#
|
|
# Runner: the org's self-hosted `ubuntu-latest`. The container lacks
|
|
# git/curl/unzip (needed by checkout + sdkmanager), so the first step installs
|
|
# them. It also installs JDK 17 from the Ubuntu archive rather than using
|
|
# actions/setup-java, because this runner can't resolve api.adoptium.net (that
|
|
# download fails with EAI_AGAIN) while the Ubuntu mirrors are reachable.
|
|
# (Faster later: switch to a prebuilt Android-SDK+JDK container image so nothing
|
|
# installs per-run.)
|
|
|
|
name: PR Checks
|
|
|
|
# `edge` is here because a workstream that lands ten phase PRs onto it before one
|
|
# cutover PR into `main` otherwise gets NO CI at all until the cutover — which is
|
|
# exactly what happened to all nine M12 phase PRs, and would have happened again
|
|
# to engagement Phase 8 (ENGAGEMENT.md §7.1 Q8). A phase should fail on its own
|
|
# PR, not inside the cutover window with a whole workstream's diff to bisect.
|
|
on:
|
|
pull_request:
|
|
branches: [main, edge]
|
|
|
|
concurrency:
|
|
group: pr-checks-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
android-build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# Install the tools checkout + the SDK installer need, plus JDK 17 (see the
|
|
# header note on why we avoid actions/setup-java on this runner).
|
|
- name: Install base tools + JDK 17
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y git curl unzip openjdk-17-jdk-headless
|
|
echo "JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64" >> "$GITHUB_ENV"
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Android SDK
|
|
uses: android-actions/setup-android@v3
|
|
|
|
# Install exactly what the build targets so it never depends on AGP's
|
|
# build-time auto-download. `yes |` accepts any license prompts; `set
|
|
# +o pipefail` so `yes` dying with SIGPIPE (exit 141) once sdkmanager
|
|
# closes the pipe doesn't fail the step -- sdkmanager's own exit, last in
|
|
# the pipeline, still gates success.
|
|
- name: Install Android SDK packages
|
|
run: |
|
|
set +o pipefail
|
|
yes | sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"
|
|
|
|
- name: Cache Gradle
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.gradle/caches
|
|
~/.gradle/wrapper
|
|
key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle.kts', 'gradle/libs.versions.toml', 'gradle/wrapper/gradle-wrapper.properties') }}
|
|
restore-keys: |
|
|
gradle-${{ runner.os }}-
|
|
|
|
# chmod defensively: this runner's checkout doesn't preserve the git
|
|
# executable bit, so `./gradlew` alone fails with "Permission denied".
|
|
# Debug-variant-only gate: unit tests, lint, and the debug APK. Scoping to
|
|
# the debug variant (vs. the aggregate `test`/`lint`) avoids compiling and
|
|
# linting the release variant in parallel, which halves peak memory on the
|
|
# runner and keeps lint's report phase from GC-thrashing (see gradle.properties).
|
|
- name: Lint, test, assemble debug
|
|
run: |
|
|
chmod +x ./gradlew
|
|
./gradlew --no-daemon testDebugUnitTest lintDebug assembleDebug
|