feat: migrate Nix Ship Android to fork #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [master] | |
| pull_request: | |
| branches: [master] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| runtime-arm64: | |
| runs-on: ubuntu-24.04-arm | |
| timeout-minutes: 120 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 | |
| with: | |
| nix_path: nixpkgs=channel:nixos-unstable | |
| - name: Resolve latest control plane from master | |
| run: | | |
| nix shell nixpkgs#gitMinimal nixpkgs#jq nixpkgs#nix-prefetch-git \ | |
| -c scripts/update-control-plane.sh --skip-flake-check | |
| - name: Build, test, and export the native ARM64 control plane | |
| run: | | |
| nix develop .#runtime-export --command \ | |
| scripts/export-control-plane-closure.sh runtime-artifact | |
| - name: Preserve resolved configuration | |
| run: | | |
| mkdir -p resolved-config | |
| cp config/product.json resolved-config/product.json | |
| - name: Save verified ARM64 closure for downstream job | |
| uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: runtime-artifact | |
| key: nixship-ci-runtime-arm64-${{ github.run_id }}-${{ github.run_attempt }} | |
| - name: Save resolved configuration for downstream jobs | |
| uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: resolved-config | |
| key: nixship-ci-config-${{ github.run_id }}-${{ github.run_attempt }} | |
| test-and-build: | |
| needs: runtime-arm64 | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 120 | |
| steps: | |
| - name: Reclaim space from unused hosted-runner toolchains | |
| run: | | |
| sudo rm -rf -- \ | |
| /opt/ghc \ | |
| /opt/hostedtoolcache \ | |
| /usr/local/lib/android \ | |
| /usr/share/dotnet | |
| df -h / | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 | |
| with: | |
| nix_path: nixpkgs=channel:nixos-unstable | |
| - name: Restore resolved control-plane configuration | |
| uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: resolved-config | |
| key: nixship-ci-config-${{ github.run_id }}-${{ github.run_attempt }} | |
| fail-on-cache-miss: true | |
| - name: Apply resolved control-plane configuration | |
| run: cp resolved-config/product.json config/product.json | |
| - name: Restore native ARM64 control-plane closure | |
| uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: runtime-artifact | |
| key: nixship-ci-runtime-arm64-${{ github.run_id }}-${{ github.run_attempt }} | |
| fail-on-cache-miss: true | |
| - name: Verify and import ARM64 closure | |
| run: | | |
| nix develop .#runtime-import --command \ | |
| scripts/import-control-plane-closure.sh runtime-artifact | |
| - name: Validate flake and embedded runtime configuration | |
| run: nix flake check --print-build-logs | |
| - name: Check automation scripts | |
| run: nix develop --command shellcheck scripts/*.sh | |
| - name: Run Android unit tests and lint | |
| run: nix develop --command gradle :app:testDebugUnitTest :app:lintDebug --no-daemon | |
| - name: Validate the configured x86_64 acceptance workload | |
| run: nix develop --command scripts/verify-acceptance-workload.sh | |
| - name: Build hermetic release APK | |
| run: nix build .#default --print-build-logs | |
| - name: Verify APK package, ABI, alignment, and embedded provenance | |
| run: | | |
| apk="$(find -L result -type f -name '*.apk' -print -quit)" | |
| nix develop --command scripts/verify-apk.sh "$apk" | |
| install -Dm644 "$apk" dist/nixship-android-unsigned-arm64-v8a.apk | |
| nix develop --command scripts/generate-sbom.sh \ | |
| "$apk" \ | |
| dist/nixship-android.cdx.json | |
| - name: Save unsigned CI candidate | |
| uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: | | |
| dist/nixship-android-unsigned-arm64-v8a.apk | |
| dist/nixship-android.cdx.json | |
| key: nixship-ci-unsigned-${{ github.run_id }}-${{ github.run_attempt }} | |
| maestro-emulator: | |
| needs: test-and-build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 180 | |
| steps: | |
| - name: Reclaim space from unused hosted-runner toolchains | |
| run: | | |
| sudo rm -rf -- \ | |
| /opt/ghc \ | |
| /opt/hostedtoolcache/CodeQL \ | |
| /usr/local/lib/android \ | |
| /usr/share/dotnet | |
| df -h / | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 | |
| with: | |
| nix_path: nixpkgs=channel:nixos-unstable | |
| - name: Restore resolved control-plane configuration | |
| uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: resolved-config | |
| key: nixship-ci-config-${{ github.run_id }}-${{ github.run_attempt }} | |
| fail-on-cache-miss: true | |
| - name: Apply resolved control-plane configuration | |
| run: cp resolved-config/product.json config/product.json | |
| - name: Build the bundled x86_64 acceptance APK | |
| run: nix build .#emulator-apk --print-build-logs --out-link result-emulator | |
| - name: Reclaim build-only Nix paths before emulator boot | |
| run: | | |
| nix develop --profile "$RUNNER_TEMP/nixship-emulator-shell" \ | |
| .#emulator --command true | |
| nix-collect-garbage -d | |
| df -h / | |
| - name: Run the full Maestro emulator journey | |
| env: | |
| MAESTRO_ARTIFACTS: ${{ runner.temp }}/nixship-maestro-emulator | |
| run: | | |
| sudo chmod 0666 /dev/kvm | |
| apk="$(find -L result-emulator -type f -name '*.apk' -print -quit)" | |
| nix develop "$RUNNER_TEMP/nixship-emulator-shell" --command \ | |
| scripts/run-maestro-ci-emulator.sh "$apk" | |
| - name: Save emulator acceptance evidence | |
| id: upload-maestro-evidence | |
| if: always() | |
| continue-on-error: true | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: maestro-emulator-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: ${{ runner.temp }}/nixship-maestro-emulator | |
| if-no-files-found: error | |
| - name: Preserve emulator evidence when artifact storage is unavailable | |
| if: always() && steps.upload-maestro-evidence.outcome == 'failure' | |
| uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ${{ runner.temp }}/nixship-maestro-emulator | |
| key: nixship-ci-maestro-evidence-${{ github.run_id }}-${{ github.run_attempt }} |