wtclaude
7a8231ba9c
All checks were successful
PR Checks / android-build (pull_request) Successful in 21m22s
Step 1 of M8 (docs/android/PLAN.md item 9). - compileSdk/targetSdk 36 (Play's floor since 2026-08-31). AGP 8.6.1 cannot build against 36, so AGP goes to 8.13.2 (the last 8.x) with the Gradle 8.14.3 wrapper. Kotlin, KSP and Hilt are unchanged. All three workflows install platforms;android-36; AGP 8.13 still defaults to build-tools 35.0.0. - release.yml also runs bundleRelease, signed with the same keystore, and attaches the .aab to the Gitea release beside the APK (the first bundle has to be uploaded by hand, and this is where it comes from). - A last step uploads the bundle to Play's internal track through the Play Developer API v3 edit flow. The OAuth token comes from a service-account JWT signed with openssl; the key is the new PLAY_SERVICE_ACCOUNT_JSON secret. While that secret is unset, the step warns and skips. The step runs after the Gitea release, so a Play failure never holds back the APK. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
88 lines
3.9 KiB
YAML
88 lines
3.9 KiB
YAML
# Gate every pull request into `main` or `edge` on lint + unit tests + a debug
|
|
# build, so a broken build can't reach the deployable branch. Debug builds are auto-signed,
|
|
# so this gate needs no secrets. The signed *release* APK + Gitea release come
|
|
# later (release.yml, M6). See docs/android/PLAN.md §12.
|
|
#
|
|
# Enforcement (one-time, in the Gitea UI):
|
|
# Repository Settings -> Branches -> Branch Protection (rule for `main`)
|
|
# * Enable Status Check
|
|
# * Status check patterns: PR Checks / *
|
|
#
|
|
# Runner: the org's self-hosted `ubuntu-latest`. The container lacks
|
|
# git/curl/unzip (needed by checkout + sdkmanager), so the first step installs
|
|
# them. It also installs JDK 17 from the Ubuntu archive rather than using
|
|
# actions/setup-java, because this runner can't resolve api.adoptium.net (that
|
|
# download fails with EAI_AGAIN) while the Ubuntu mirrors are reachable.
|
|
# (Faster later: switch to a prebuilt Android-SDK+JDK container image so nothing
|
|
# installs per-run.)
|
|
|
|
name: PR Checks
|
|
|
|
# `edge` is here because a workstream that lands ten phase PRs onto it before one
|
|
# cutover PR into `main` otherwise gets NO CI at all until the cutover — which is
|
|
# exactly what happened to all nine M12 phase PRs, and would have happened again
|
|
# to engagement Phase 8 (ENGAGEMENT.md §7.1 Q8). A phase should fail on its own
|
|
# PR, not inside the cutover window with a whole workstream's diff to bisect.
|
|
on:
|
|
pull_request:
|
|
branches: [main, edge]
|
|
|
|
concurrency:
|
|
group: pr-checks-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
android-build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# Install the tools checkout + the SDK installer need, plus JDK 17 (see the
|
|
# header note on why we avoid actions/setup-java on this runner).
|
|
- name: Install base tools + JDK 17
|
|
run: |
|
|
apt-get update
|
|
apt-get install -y git curl unzip openjdk-17-jdk-headless
|
|
echo "JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64" >> "$GITHUB_ENV"
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
# `packages: ''` is load-bearing, not tidying. The action's own default is
|
|
# `tools` -- a package Google has REMOVED from the SDK repository -- so the
|
|
# default makes `sdkmanager tools` exit 1 and the step fails before a line
|
|
# of this repo is compiled. It is redundant here regardless: the next step
|
|
# installs exactly what the build targets.
|
|
- name: Set up Android SDK
|
|
uses: android-actions/setup-android@v3
|
|
with:
|
|
packages: ''
|
|
|
|
# Install exactly what the build targets so it never depends on AGP's
|
|
# build-time auto-download. `yes |` accepts any license prompts; `set
|
|
# +o pipefail` so `yes` dying with SIGPIPE (exit 141) once sdkmanager
|
|
# closes the pipe doesn't fail the step -- sdkmanager's own exit, last in
|
|
# the pipeline, still gates success.
|
|
- name: Install Android SDK packages
|
|
run: |
|
|
set +o pipefail
|
|
yes | sdkmanager "platform-tools" "platforms;android-36" "build-tools;35.0.0"
|
|
|
|
- name: Cache Gradle
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.gradle/caches
|
|
~/.gradle/wrapper
|
|
key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle.kts', 'gradle/libs.versions.toml', 'gradle/wrapper/gradle-wrapper.properties') }}
|
|
restore-keys: |
|
|
gradle-${{ runner.os }}-
|
|
|
|
# chmod defensively: this runner's checkout doesn't preserve the git
|
|
# executable bit, so `./gradlew` alone fails with "Permission denied".
|
|
# Debug-variant-only gate: unit tests, lint, and the debug APK. Scoping to
|
|
# the debug variant (vs. the aggregate `test`/`lint`) avoids compiling and
|
|
# linting the release variant in parallel, which halves peak memory on the
|
|
# runner and keeps lint's report phase from GC-thrashing (see gradle.properties).
|
|
- name: Lint, test, assemble debug
|
|
run: |
|
|
chmod +x ./gradlew
|
|
./gradlew --no-daemon testDebugUnitTest lintDebug assembleDebug
|