ci.yml

name: CI
run-name: CI · ${{ github.event.pull_request.title || github.ref_name }}

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    name: Change scope
    permissions:
      contents: read
      actions: read
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      android: ${{ steps.scope.outputs.android }}
      native: ${{ steps.scope.outputs.native }}
      python: ${{ steps.scope.outputs.python }}
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
          persist-credentials: false
      - name: "Comparison base: ${{ github.event.pull_request.base.sha || github.event.before }}"
        run: ":"
      - name: Classify changes since successful checks
        id: scope
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          EVENT_NAME: ${{ github.event_name }}
          PR_BRANCH: ${{ github.head_ref }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          GH_TOKEN: ${{ github.token }}
        run: |
          args=(--base "$BASE_SHA" --head "$HEAD_SHA" --run-attempt "$GITHUB_RUN_ATTEMPT" --github-output "$GITHUB_OUTPUT" --summary "$GITHUB_STEP_SUMMARY")
          if [[ "$EVENT_NAME" == push ]]; then args+=(--push); else args+=(--history); fi
          python3 scripts/ci_changes.py "${args[@]}"

  native-tests:
    needs: changes
    if: needs.changes.outputs.native == 'true'
    name: Native Go tests
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: native/go.mod
          cache-dependency-path: native/go.sum

      - name: Set up Ruby and Fastlane
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: "3.4.10"
          bundler-cache: true

      - name: Run native tests with the race detector
        run: bundle exec fastlane android native_tests

  python-tests:
    needs: changes
    if: needs.changes.outputs.python == 'true'
    name: Python tests and style
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Set up Ruby and Fastlane
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: "3.4.10"
          bundler-cache: true

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: requirements-dev.txt

      - name: Install Python formatting tools
        run: python -m pip install -r requirements-dev.txt

      - name: Check Python formatting and Python tests
        run: bundle exec fastlane android python_checks

  android-tests:
    needs: changes
    if: needs.changes.outputs.android == 'true'
    name: Android tests and checks
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Set up JDK 21
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: "21"
          cache: gradle

      - name: Set up Go
        uses: actions/setup-go@v7
        with:
          go-version-file: native/go.mod
          cache-dependency-path: native/go.sum

      - name: Set up Ruby and Fastlane
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: "3.4.10"
          bundler-cache: true

      - name: Install Android SDK components
        run: |
          sdkmanager="$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager"
          if [[ ! -x "$sdkmanager" ]]; then
            echo "sdkmanager is unavailable at $sdkmanager" >&2
            exit 1
          fi
          yes | "$sdkmanager" --licenses >/dev/null || true
          "$sdkmanager" \
            "platforms;android-36" \
            "build-tools;36.0.0" \
            "ndk;29.0.14206865"
          echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/29.0.14206865" >> "$GITHUB_ENV"

      - name: Run Android checks and verify the unsigned APK
        run: bundle exec fastlane android android_checks

      - name: Publish PR debug APK
        if: github.event_name == 'pull_request'
        id: debug_apk_upload
        uses: actions/upload-artifact@v7
        with:
          name: megaproxy-pr-${{ github.event.pull_request.number }}-debug-apk
          path: app/build/outputs/apk/debug/app-debug.apk
          if-no-files-found: error
          compression-level: 0
          retention-days: 14

      - name: Publish PR unsigned release APK
        if: github.event_name == 'pull_request'
        id: unsigned_release_apk_upload
        uses: actions/upload-artifact@v7
        with:
          name: megaproxy-pr-${{ github.event.pull_request.number }}-unsigned-release-apk
          path: app/build/outputs/apk/release/app-release-unsigned.apk
          if-no-files-found: error
          compression-level: 0
          retention-days: 14

      - name: Add APK download links to the job summary
        if: github.event_name == 'pull_request'
        env:
          DEBUG_APK_URL: ${{ steps.debug_apk_upload.outputs.artifact-url }}
          UNSIGNED_RELEASE_APK_URL: ${{ steps.unsigned_release_apk_upload.outputs.artifact-url }}
        run: |
          {
            echo "## APK artifacts"
            echo
            echo "- [Download debug APK]($DEBUG_APK_URL) — signed with the disposable Android debug key"
            echo "- [Download unsigned release APK]($UNSIGNED_RELEASE_APK_URL) — verified unsigned"
            echo
            echo "Artifacts expire after 14 days. Neither APK uses the MegaProxy release key."
          } >> "$GITHUB_STEP_SUMMARY"