Signal-Android/.github/workflows/android.yml at main · DD007De/Signal-Android · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
name: Android CI

on:
  pull_request:
  push:
    branches:
    - 'main'
    - '8.**'

permissions:
  contents: read # to fetch code (actions/checkout)

jobs:
  build:

    runs-on: ubuntu-latest-8-cores

    steps:
    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      # gh api repos/actions/checkout/commits/v6 --jq '.sha'
      with:
          submodules: true
          lfs: true

    - name: set up JDK 21
      uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
      # gh api repos/actions/setup-java/commits/v5 --jq '.sha'
      with:
        distribution: temurin
        java-version: 21

    - name: Validate Gradle Wrapper
      uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
      # gh api repos/gradle/actions/commits/v6 --jq '.sha'

    - name: Set up Gradle
      uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
      # gh api repos/gradle/actions/commits/v6 --jq '.sha'
      with:
        # Only 8.** branch builds write to the cache; everything else (PRs, etc.) reads only.
        cache-read-only: ${{ !startsWith(github.ref, 'refs/heads/8.') }}
        # Required to persist the Gradle configuration cache across runs.
        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

    # Pull requests run the fast custom linter (ciRemote); pushes to main / 8.x branches run the
    # full Android lint (qaRemote). Both include screenshot validation, which is deliberately kept
    # out of the local qa/ci tasks because screenshot rendering is host-OS dependent.
    - name: Build with Gradle
      env:
        SIGNAL_BUILD_CACHE_URL: ${{ secrets.SIGNAL_BUILD_CACHE_URL }}
        SIGNAL_BUILD_CACHE_USER: ${{ secrets.SIGNAL_BUILD_CACHE_USER }}
        SIGNAL_BUILD_CACHE_PASSWORD: ${{ secrets.SIGNAL_BUILD_CACHE_PASSWORD }}
        SIGNAL_BUILD_CACHE_PUSH: ${{ startsWith(github.ref, 'refs/heads/8.') }}
      run: ./gradlew ${{ github.event_name == 'pull_request' && 'ciRemote' || 'qaRemote' }}

    - name: Archive reports for failed build
      if: ${{ failure() }}
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
      # gh api repos/actions/upload-artifact/commits/v7 --jq '.sha'
      with:
        name: reports
        path: |
          **/build/reports
          **/build/test-results
        if-no-files-found: ignore