Skip to content

Commit f68135f

Browse files
imxadeimxade
committed
feat: migrate Nix Ship Android to fork
1 parent e87b609 commit f68135f

110 files changed

Lines changed: 6124 additions & 1237 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/actionlint.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
self-hosted-runner:
2+
labels:
3+
- android-controller

‎.github/dependabot.yml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,7 @@
11
version: 2
22
updates:
3-
- package-ecosystem: github-actions
4-
directory: /
5-
schedule:
6-
interval: daily
7-
commit-message:
8-
# Prefix all commit messages with "Changed: "
9-
prefix: "Changed"
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: monthly
7+
open-pull-requests-limit: 5

‎.github/workflows/attach_debug_apks_to_release.yml‎

Lines changed: 0 additions & 84 deletions
This file was deleted.

‎.github/workflows/ci.yml‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [master]
6+
pull_request:
7+
branches: [master]
8+
workflow_dispatch:
9+
10+
permissions:
11+
contents: read
12+
13+
concurrency:
14+
group: ci-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
jobs:
18+
runtime-arm64:
19+
runs-on: ubuntu-24.04-arm
20+
timeout-minutes: 120
21+
steps:
22+
- name: Check out repository
23+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
24+
with:
25+
persist-credentials: false
26+
27+
- name: Install Nix
28+
uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
29+
with:
30+
nix_path: nixpkgs=channel:nixos-unstable
31+
32+
- name: Resolve latest control plane from master
33+
run: |
34+
nix shell nixpkgs#gitMinimal nixpkgs#jq nixpkgs#nix-prefetch-git \
35+
-c scripts/update-control-plane.sh --skip-flake-check
36+
37+
- name: Build, test, and export the native ARM64 control plane
38+
run: |
39+
nix develop .#runtime-export --command \
40+
scripts/export-control-plane-closure.sh runtime-artifact
41+
42+
- name: Preserve resolved configuration
43+
run: |
44+
mkdir -p resolved-config
45+
cp config/product.json resolved-config/product.json
46+
47+
- name: Save verified ARM64 closure for downstream job
48+
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
49+
with:
50+
path: runtime-artifact
51+
key: nixship-ci-runtime-arm64-${{ github.run_id }}-${{ github.run_attempt }}
52+
53+
- name: Save resolved configuration for downstream jobs
54+
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
55+
with:
56+
path: resolved-config
57+
key: nixship-ci-config-${{ github.run_id }}-${{ github.run_attempt }}
58+
59+
test-and-build:
60+
needs: runtime-arm64
61+
runs-on: ubuntu-latest
62+
timeout-minutes: 120
63+
steps:
64+
- name: Reclaim space from unused hosted-runner toolchains
65+
run: |
66+
sudo rm -rf -- \
67+
/opt/ghc \
68+
/opt/hostedtoolcache \
69+
/usr/local/lib/android \
70+
/usr/share/dotnet
71+
df -h /
72+
73+
- name: Check out repository
74+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
75+
with:
76+
persist-credentials: false
77+
78+
- name: Install Nix
79+
uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
80+
with:
81+
nix_path: nixpkgs=channel:nixos-unstable
82+
83+
- name: Restore resolved control-plane configuration
84+
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
85+
with:
86+
path: resolved-config
87+
key: nixship-ci-config-${{ github.run_id }}-${{ github.run_attempt }}
88+
fail-on-cache-miss: true
89+
90+
- name: Apply resolved control-plane configuration
91+
run: cp resolved-config/product.json config/product.json
92+
93+
- name: Restore native ARM64 control-plane closure
94+
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
95+
with:
96+
path: runtime-artifact
97+
key: nixship-ci-runtime-arm64-${{ github.run_id }}-${{ github.run_attempt }}
98+
fail-on-cache-miss: true
99+
100+
- name: Verify and import ARM64 closure
101+
run: |
102+
nix develop .#runtime-import --command \
103+
scripts/import-control-plane-closure.sh runtime-artifact
104+
105+
- name: Validate flake and embedded runtime configuration
106+
run: nix flake check --print-build-logs
107+
108+
- name: Check automation scripts
109+
run: nix develop --command shellcheck scripts/*.sh
110+
111+
- name: Run Android unit tests and lint
112+
run: nix develop --command gradle :app:testDebugUnitTest :app:lintDebug --no-daemon
113+
114+
- name: Validate the configured x86_64 acceptance workload
115+
run: nix develop --command scripts/verify-acceptance-workload.sh
116+
117+
- name: Build hermetic release APK
118+
run: nix build .#default --print-build-logs
119+
120+
- name: Verify APK package, ABI, alignment, and embedded provenance
121+
run: |
122+
apk="$(find -L result -type f -name '*.apk' -print -quit)"
123+
nix develop --command scripts/verify-apk.sh "$apk"
124+
install -Dm644 "$apk" dist/nixship-android-unsigned-arm64-v8a.apk
125+
nix develop --command scripts/generate-sbom.sh \
126+
"$apk" \
127+
dist/nixship-android.cdx.json
128+
129+
- name: Save unsigned CI candidate
130+
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
131+
with:
132+
path: |
133+
dist/nixship-android-unsigned-arm64-v8a.apk
134+
dist/nixship-android.cdx.json
135+
key: nixship-ci-unsigned-${{ github.run_id }}-${{ github.run_attempt }}
136+
137+
maestro-emulator:
138+
needs: test-and-build
139+
runs-on: ubuntu-latest
140+
timeout-minutes: 180
141+
steps:
142+
- name: Reclaim space from unused hosted-runner toolchains
143+
run: |
144+
sudo rm -rf -- \
145+
/opt/ghc \
146+
/opt/hostedtoolcache/CodeQL \
147+
/usr/local/lib/android \
148+
/usr/share/dotnet
149+
df -h /
150+
151+
- name: Check out repository
152+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
153+
with:
154+
persist-credentials: false
155+
156+
- name: Install Nix
157+
uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
158+
with:
159+
nix_path: nixpkgs=channel:nixos-unstable
160+
161+
- name: Restore resolved control-plane configuration
162+
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
163+
with:
164+
path: resolved-config
165+
key: nixship-ci-config-${{ github.run_id }}-${{ github.run_attempt }}
166+
fail-on-cache-miss: true
167+
168+
- name: Apply resolved control-plane configuration
169+
run: cp resolved-config/product.json config/product.json
170+
171+
- name: Build the bundled x86_64 acceptance APK
172+
run: nix build .#emulator-apk --print-build-logs --out-link result-emulator
173+
174+
- name: Reclaim build-only Nix paths before emulator boot
175+
run: |
176+
nix develop --profile "$RUNNER_TEMP/nixship-emulator-shell" \
177+
.#emulator --command true
178+
nix-collect-garbage -d
179+
df -h /
180+
181+
- name: Run the full Maestro emulator journey
182+
env:
183+
MAESTRO_ARTIFACTS: ${{ runner.temp }}/nixship-maestro-emulator
184+
run: |
185+
sudo chmod 0666 /dev/kvm
186+
apk="$(find -L result-emulator -type f -name '*.apk' -print -quit)"
187+
nix develop "$RUNNER_TEMP/nixship-emulator-shell" --command \
188+
scripts/run-maestro-ci-emulator.sh "$apk"
189+
190+
- name: Save emulator acceptance evidence
191+
id: upload-maestro-evidence
192+
if: always()
193+
continue-on-error: true
194+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
195+
with:
196+
name: maestro-emulator-${{ github.run_id }}-${{ github.run_attempt }}
197+
path: ${{ runner.temp }}/nixship-maestro-emulator
198+
if-no-files-found: error
199+
200+
- name: Preserve emulator evidence when artifact storage is unavailable
201+
if: always() && steps.upload-maestro-evidence.outcome == 'failure'
202+
uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
203+
with:
204+
path: ${{ runner.temp }}/nixship-maestro-emulator
205+
key: nixship-ci-maestro-evidence-${{ github.run_id }}-${{ github.run_attempt }}

0 commit comments

Comments
 (0)