ci(nightly): prune old release assets before upload #591
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| tags-ignore: | |
| - '**' # Don't run on tag pushes - release.yml handles those | |
| pull_request: | |
| branches: [ main, develop ] | |
| # Required for security scan SARIF upload | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| build: | |
| name: Build and Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: '17' | |
| distribution: 'temurin' | |
| cache: gradle | |
| - name: Grant execute permission for gradlew | |
| run: chmod +x gradlew | |
| - name: Build with Gradle | |
| run: ./gradlew assembleDebug --stacktrace | |
| - name: Run pure JVM tests (987 tests) | |
| run: ./gradlew runPureTests --stacktrace | |
| # MockK tests (176) require android.jar stubs + specific classpath ordering | |
| # that can hang on CI runners. Run via ew-cli instrumented tests instead. | |
| - name: Upload test results | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: test-results | |
| path: | | |
| build/reports/tests/ | |
| build/test-results/ | |
| retention-days: 7 | |
| - name: Run lint checks | |
| run: ./gradlew lint --stacktrace | |
| continue-on-error: true | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v4 | |
| if: success() | |
| with: | |
| name: apk-debug | |
| path: build/outputs/apk/debug/*.apk | |
| retention-days: 7 | |
| - name: Upload lint results | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: lint-results | |
| path: build/reports/lint-results*.xml | |
| retention-days: 7 | |
| code-quality: | |
| name: Code Quality Checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: '17' | |
| distribution: 'temurin' | |
| cache: gradle | |
| - name: Grant execute permission for gradlew | |
| run: chmod +x gradlew | |
| - name: Run lint checks | |
| run: ./gradlew lint --stacktrace | |
| continue-on-error: true | |
| - name: Dependency analysis | |
| run: ./gradlew dependencies --stacktrace | |
| continue-on-error: true | |
| security: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Run security scan | |
| # SHA-pinned (= v0.36.0). Aqua deletes old version tags (0.28.0 was removed, which | |
| # failed this job at "Set up job"); a commit SHA can't be retagged away. To bump, | |
| # resolve a newer release tag to its commit SHA. | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: '.' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| continue-on-error: true | |
| - name: Upload security results | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() && hashFiles('trivy-results.sarif') != '' | |
| with: | |
| sarif_file: 'trivy-results.sarif' |