publishReactNativeAndroidArtifacts.yml

name: Publish React Native Android Artifacts

on:
  workflow_call:
    inputs:
      build_targets:
        description: JSON array of `is_hybrid` values to build (e.g. ["true","false"]).
        required: true
        type: string
      app_ref:
        description: Expensify/App ref to checkout (empty = triggering ref).
        required: false
        type: string
        default: ''
      mobile_expensify_ref:
        description: Mobile-Expensify ref to checkout for hybrid builds (empty = pinned submodule).
        required: false
        type: string
        default: ''
    secrets:
      OS_BOTIFY_TOKEN:
        description: Token used to checkout private submodules.
        required: true
      SLACK_WEBHOOK:
        description: Webhook used to announce failures.
        required: true

jobs:
  buildAndPublishReactNativeArtifacts:
    name: Build and Publish React Native Artifacts
    runs-on: ${{ github.repository_owner == 'Expensify' && 'blacksmith-16vcpu-ubuntu-2404' || 'blacksmith-2vcpu-ubuntu-2404' }}
    strategy:
      # Disable fail-fast to prevent cancelling both jobs when only one needs to be stopped due to concurrency limits
      fail-fast: false
      matrix:
        # Dynamically build the matrix based on the build targets
        is_hybrid: ${{ fromJSON(inputs.build_targets) }}
    concurrency:
      group: ${{ github.workflow }}-android-build-${{ matrix.is_hybrid }}
      cancel-in-progress: true
    steps:
      - name: Checkout Code
        uses: useblacksmith/checkout@0647fdbab2614a5eb86d2971070e325060d91056 # v1.7.0
        with:
          ref: ${{ inputs.app_ref }}
          submodules: ${{ matrix.is_hybrid }}
          token: ${{ secrets.OS_BOTIFY_TOKEN }}

      - name: Checkout Mobile-Expensify to specified branch or commit
        if: ${{ matrix.is_hybrid == 'true' && inputs.mobile_expensify_ref != '' }}
        run: |
          cd Mobile-Expensify
          git fetch origin ${{ inputs.mobile_expensify_ref }}
          git checkout ${{ inputs.mobile_expensify_ref }}

      # Recompute the patches hash from the actually checked-out tree (which may include a custom Mobile-Expensify
      # ref) so the published artifact is tagged with a hash that consumers will match against.
      - name: Compute patches hash
        id: computePatchesHash
        run: |
          if [[ '${{ matrix.is_hybrid }}' == 'true' ]]; then
            echo "PATCHES_HASH=$(./scripts/artifacts-utils/compute-patches-hash.sh patches Mobile-Expensify/patches)" >> "$GITHUB_OUTPUT"
          else
            echo "PATCHES_HASH=$(./scripts/artifacts-utils/compute-patches-hash.sh patches)" >> "$GITHUB_OUTPUT"
          fi

      - name: Setup Node
        uses: ./.github/actions/composite/setupNode
        with:
          IS_HYBRID_BUILD: ${{ matrix.is_hybrid }}

      # react-android is compiled against the headers of the Hermes that hermes-engine builds for this release.
      # Recording its version in the POM lets the resolver reject an artifact whose Hermes differs from the one the
      # consuming app links.
      - name: Resolve Hermes version
        id: hermes
        run: echo "VERSION=$(./scripts/artifacts-utils/get-hermes-version.sh)" >> "$GITHUB_OUTPUT"

      - name: Get Java version
        id: get-java-version
        uses: ./.github/actions/composite/getJavaVersion

      - name: Setup Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
        with:
          distribution: oracle
          java-version: ${{ steps.get-java-version.outputs.version }}

      # v6.1.0
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e

      - name: Block compromised Java certificates
        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@b70c378d6cfae84f6844379eef3568cb33ea9680
        with:
          restrict-gradle: 'true'

      - name: Determine new patched RN version
        id: getNewPatchedVersion
        run: echo "NEW_PATCHED_VERSION=$(./.github/scripts/getNewPatchedRNVersion.sh)" >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: ${{ github.token }}
          IS_HYBRID_BUILD: ${{ matrix.is_hybrid }}
          ARTIFACT_ID: react-android

      - name: Build and publish React Native artifacts
        working-directory: ${{ matrix.is_hybrid == 'true' && 'Mobile-Expensify/Android' || 'android' }}
        run: |
          echo "Starting artifacts build for ${{ matrix.is_hybrid == 'true' && 'HybridApp' || 'NewDot Standalone' }}"
          echo "Version: ${{ env.PATCHED_VERSION }}"
          echo "Patches hash: ${{ env.PATCHES_HASH }}"
          echo "Hermes version: ${{ env.HERMES_VERSION }}"
          export ORG_GRADLE_PROJECT_reactNativeArchitectures="armeabi-v7a,arm64-v8a,x86,x86_64"

          # Exclude ktfmt and test tasks from the included react-native build
          EXCLUDE_TASKS=(
            -x :react-native:packages:react-native:ReactAndroid:ktfmtCheck
            -x :react-native:packages:react-native:ReactAndroid:ktfmtCheckMain
            -x :react-native:packages:react-native:ReactAndroid:ktfmtCheckScripts
            -x :react-native:packages:react-native:ReactAndroid:testDebugOptimizedUnitTest
            -x :react-native:packages:react-native:ReactAndroid:testDebugUnitTest
            -x :react-native:packages:react-native:ReactAndroid:testReleaseUnitTest
          )

          ./gradlew buildReactNativeArtifacts -PpatchedArtifacts.forceBuildFromSource=true -x lint -x test -x check "${EXCLUDE_TASKS[@]}"
          ./gradlew publishReactNativeArtifacts -PpatchedArtifacts.forceBuildFromSource=true
        env:
          GH_PUBLISH_ACTOR: ${{ github.actor }}
          GH_PUBLISH_TOKEN: ${{ github.token }}
          IS_HYBRID_BUILD: ${{ matrix.is_hybrid }}
          PATCHED_VERSION: ${{ steps.getNewPatchedVersion.outputs.NEW_PATCHED_VERSION }}
          PATCHES_HASH: ${{ steps.computePatchesHash.outputs.PATCHES_HASH }}
          HERMES_VERSION: ${{ steps.hermes.outputs.VERSION }}
          CMAKE_VERSION: 3.31.6

      - name: Announce failed workflow in Slack
        if: ${{ failure() }}
        uses: ./.github/actions/composite/announceFailedWorkflowInSlack
        with:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
          CHANNEL: '#expensify-open-source'