docs(todo): clean HANDOFF section for next agent + instrumented test … #600
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| tags-ignore: | |
| - '**' # Don't run on tag pushes - release.yml handles those | |
| pull_request: | |
| branches: [ main, develop ] | |
| # Required for security scan SARIF upload | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| build: | |
| name: Build and Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: '17' | |
| distribution: 'temurin' | |
| cache: gradle | |
| - name: Grant execute permission for gradlew | |
| run: chmod +x gradlew | |
| - name: Build with Gradle | |
| run: ./gradlew assembleDebug --stacktrace | |
| - name: Run pure JVM tests | |
| run: ./gradlew runPureTests --stacktrace | |
| # MockK tests (runMockTests) require android.jar stubs + specific classpath | |
| # ordering that can hang on CI runners. Run via ew-cli instrumented tests instead. | |
| - name: Upload test results | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: test-results | |
| path: | | |
| build/reports/tests/ | |
| build/test-results/ | |
| retention-days: 7 | |
| - name: Run lint checks | |
| # Lint gate phase 1: abortOnError=true in build.gradle + baseline suppresses | |
| # pre-existing issues, so this fails only on NEW lint regressions. | |
| run: ./gradlew lint --stacktrace | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v4 | |
| if: success() | |
| with: | |
| name: apk-debug | |
| path: build/outputs/apk/debug/*.apk | |
| retention-days: 7 | |
| - name: Upload lint results | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: lint-results | |
| path: build/reports/lint-results*.xml | |
| retention-days: 7 | |
| code-quality: | |
| name: Code Quality Checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: '17' | |
| distribution: 'temurin' | |
| cache: gradle | |
| - name: Grant execute permission for gradlew | |
| run: chmod +x gradlew | |
| # Lint runs (as a hard gate) in the "Build and Test" job; not duplicated here. | |
| - name: Dependency analysis | |
| run: ./gradlew dependencies --stacktrace | |
| continue-on-error: true | |
| security: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Run security scan | |
| # SHA-pinned (= v0.36.0). Aqua deletes old version tags (0.28.0 was removed, which | |
| # failed this job at "Set up job"); a commit SHA can't be retagged away. To bump, | |
| # resolve a newer release tag to its commit SHA. | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: '.' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| continue-on-error: true | |
| - name: Upload security results | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() && hashFiles('trivy-results.sarif') != '' | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| # Per-ABI APK size report (folded in from the former build.yml, which duplicated | |
| # assembleDebug). Consumes the debug APKs uploaded by the "Build and Test" job. | |
| size-analysis: | |
| name: APK Size Analysis | |
| runs-on: ubuntu-latest | |
| needs: build | |
| steps: | |
| - name: Download debug APKs | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: apk-debug | |
| path: ./ | |
| - name: Analyze APK sizes | |
| run: | | |
| echo "## Build Analysis - Per-ABI APK Sizes" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "| ABI | Size | Status |" >> $GITHUB_STEP_SUMMARY | |
| echo "|-----|------|--------|" >> $GITHUB_STEP_SUMMARY | |
| ls -la *.apk || { echo "No APK files found"; ls -la; exit 1; } | |
| FAIL=0 | |
| for APK_FILE in *.apk; do | |
| APK_SIZE=$(stat -c%s "$APK_FILE" 2>/dev/null || stat -f%z "$APK_FILE") | |
| APK_SIZE_MB=$((APK_SIZE / 1024 / 1024)) | |
| # Determine ABI from filename | |
| if [[ "$APK_FILE" == *"universal"* ]]; then | |
| ABI="universal" | |
| MAX_SIZE=60 | |
| elif [[ "$APK_FILE" == *"arm64"* ]]; then | |
| ABI="arm64-v8a" | |
| MAX_SIZE=40 | |
| elif [[ "$APK_FILE" == *"armeabi"* ]] || [[ "$APK_FILE" == *"armv7"* ]]; then | |
| ABI="armeabi-v7a" | |
| MAX_SIZE=35 | |
| elif [[ "$APK_FILE" == *"x86_64"* ]]; then | |
| ABI="x86_64" | |
| MAX_SIZE=40 | |
| else | |
| ABI="unknown" | |
| MAX_SIZE=60 | |
| fi | |
| if [ $APK_SIZE_MB -gt $MAX_SIZE ]; then | |
| echo "| $ABI | ${APK_SIZE_MB}MB | ⚠️ Exceeds ${MAX_SIZE}MB |" >> $GITHUB_STEP_SUMMARY | |
| FAIL=1 | |
| else | |
| echo "| $ABI | ${APK_SIZE_MB}MB | ✅ OK |" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| done | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Neural Models**: Included (ONNX Runtime + transformer)" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Package**: tribixbite.cleverkeys" >> $GITHUB_STEP_SUMMARY | |
| if [ $FAIL -eq 1 ]; then | |
| echo "::warning::Some APKs exceed size thresholds" | |
| fi |