clean-rate-android/.github/workflows/android.yml at d53448bddf0c2e99b3bb98be0fdabb29275ab50e · Etogerman/clean-rate-android · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: Проверка Android

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:

permissions:
  contents: read

jobs:
  test:
    name: Тесты, анализ и сборка
    runs-on: ubuntu-latest
    timeout-minutes: 25

    steps:
      - name: Получить исходный код
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Настроить JDK 17
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: temurin
          java-version: "17"

      - name: Проверить Gradle Wrapper
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

      - name: Настроить Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

      - name: Проверить пробелы в изменениях
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          if [[ -n "$BASE_SHA" ]]; then
            git diff --check "$BASE_SHA"...HEAD
          else
            git diff --check HEAD^ HEAD
          fi

      - name: Проверить проект
        run: ./gradlew --no-daemon test lint assembleDebug assembleRelease

      - name: Сохранить неподписанную релизную сборку
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: CleanRate-unsigned-${{ github.sha }}
          path: app/build/outputs/apk/release/app-release-unsigned.apk
          if-no-files-found: error
          retention-days: 14

      - name: Сохранить таблицу деобфускации
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: CleanRate-mapping-${{ github.sha }}
          path: app/build/outputs/mapping/release/mapping.txt
          if-no-files-found: error
          retention-days: 14

  provenance:
    name: Происхождение сборки тега
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [test, android-runtime]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      attestations: write

    steps:
      - name: Получить неподписанную сборку
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: CleanRate-unsigned-${{ github.sha }}
          path: release

      - name: Проверить состав артефакта
        run: test -f release/app-release-unsigned.apk

      - name: Подтвердить происхождение APK
        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
        with:
          subject-path: release/app-release-unsigned.apk

  android-runtime:
    name: Проверка на Android 15
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read

    steps:
      - name: Получить исходный код
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Разрешить аппаратное ускорение KVM
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Настроить JDK 17
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: temurin
          java-version: "17"

      - name: Настроить Gradle
        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

      - name: Запустить инструментальные тесты
        id: android-tests
        continue-on-error: true
        uses: ReactiveCircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
        with:
          api-level: 35
          arch: x86_64
          target: default
          disable-animations: true
          script: >-
            ./gradlew --no-daemon connectedDebugAndroidTest ||
            { android_test_status=$?; echo "Инструментальные тесты завершились ошибкой. Последние строки logcat:";
            adb logcat -d -v threadtime | tail -n 4000; exit "$android_test_status"; }

      - name: Сохранить отчёт инструментальных тестов
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: Android-15-test-report-${{ github.sha }}
          path: |
            app/build/outputs/androidTest-results/connected/
            app/build/reports/androidTests/connected/
          if-no-files-found: warn
          retention-days: 7

      - name: Завершить проверку при сбое тестов
        if: steps.android-tests.outcome == 'failure'
        run: exit 1