ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

env:
  ANDROID_HOME: /usr/local/lib/android/sdk
  NDK_VERSION: "29.0.14206865"
  CARGO_NDK_VERSION: "4.1.2"
  RUST_VERSION: "1.89.0"

jobs:
  build:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false)

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup keep checkout
        uses: ./.github/actions/setup-keep

      - name: Set up JDK 21
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Verify toolchain version pins are consistent
        run: ./scripts/check-toolchain-pins.sh

      - name: Check for hardcoded user-facing strings
        run: ./scripts/check-hardcoded-strings.sh

      - name: Check for locale drift
        run: ./scripts/check-locale-drift.sh

      - name: Verify release changelogs exist for this versionCode
        run: ./scripts/check-release-changelogs.sh

      # Assert the guard's rules before trusting them. A member access split
      # after a trailing dot, and a class name assembled by concatenation, both
      # walked past the scanner and nothing would have noticed.
      - name: Self-test the RNG hygiene guard
        run: ./scripts/test-rng-hygiene.sh

      - name: Check for silent RNG fallbacks and GCM IV reuse
        run: ./scripts/check-rng-hygiene.sh

      - name: Setup Android SDK
        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1

      - name: Install Android NDK
        run: sdkmanager --install "ndk;${{ env.NDK_VERSION }}"

      - name: Install Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
        with:
          toolchain: ${{ env.RUST_VERSION }}
          targets: aarch64-linux-android

      - name: Cache Rust
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          workspaces: keep/keep-mobile

      # The uniffi path assumes uniffi-bindgen only writes into the
      # io/privkey/keep/uniffi package (see build-rust.sh). release.yml has an
      # analogous cache keyed by github.sha for bit-for-bit reproducibility.
      - name: Cache Rust build outputs
        id: cache-rust-outputs
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            app/src/main/jniLibs
            app/src/main/kotlin/io/privkey/keep/uniffi
          key: rust-outputs-${{ runner.os }}-aarch64-linux-android-ndk${{ env.NDK_VERSION }}-rust${{ env.RUST_VERSION }}-ndkcargo${{ env.CARGO_NDK_VERSION }}-keep${{ hashFiles('keep.version') }}-lock${{ hashFiles('keep/Cargo.lock') }}-toolchain${{ hashFiles('keep/rust-toolchain.toml') }}-scripts${{ hashFiles('build-rust.sh', 'scripts/**/*.sh') }}

      - name: Install cargo-ndk
        uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2
        with:
          tool: cargo-ndk@${{ env.CARGO_NDK_VERSION }}

      - name: Build native libraries
        if: steps.cache-rust-outputs.outputs.cache-hit != 'true'
        run: ./build-rust.sh
        env:
          KEEP_REPO: ${{ github.workspace }}/keep
          ANDROID_NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/${{ env.NDK_VERSION }}
          TARGETS: aarch64-linux-android
          AWS_LC_SYS_CMAKE_BUILDER: "1"

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
        with:
          cache-read-only: ${{ github.event_name == 'pull_request' }}

      - name: Build, test, and lint
        run: ./gradlew assembleDebug testDebugUnitTest lintDebug --no-daemon

      - name: Verify no proprietary dependencies on release classpath
        run: ./gradlew :app:verifyNoProprietaryDeps --no-daemon

  instrumented-tests:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    permissions:
      contents: read
    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false)

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup keep checkout
        uses: ./.github/actions/setup-keep

      - name: Set up JDK 21
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Verify toolchain version pins are consistent
        run: ./scripts/check-toolchain-pins.sh

      - name: Setup Android SDK
        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1

      - name: Install Android NDK
        run: sdkmanager --install "ndk;${{ env.NDK_VERSION }}"

      - name: Install Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
        with:
          toolchain: ${{ env.RUST_VERSION }}
          targets: x86_64-linux-android

      - name: Cache Rust
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          workspaces: keep/keep-mobile

      # See aarch64 job for rationale.
      - name: Cache Rust build outputs
        id: cache-rust-outputs
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            app/src/main/jniLibs
            app/src/main/kotlin/io/privkey/keep/uniffi
          key: rust-outputs-${{ runner.os }}-x86_64-linux-android-ndk${{ env.NDK_VERSION }}-rust${{ env.RUST_VERSION }}-ndkcargo${{ env.CARGO_NDK_VERSION }}-keep${{ hashFiles('keep.version') }}-lock${{ hashFiles('keep/Cargo.lock') }}-toolchain${{ hashFiles('keep/rust-toolchain.toml') }}-scripts${{ hashFiles('build-rust.sh', 'scripts/**/*.sh') }}

      - name: Install cargo-ndk
        uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2
        with:
          tool: cargo-ndk@${{ env.CARGO_NDK_VERSION }}

      - name: Build native libraries
        if: steps.cache-rust-outputs.outputs.cache-hit != 'true'
        run: ./build-rust.sh
        env:
          KEEP_REPO: ${{ github.workspace }}/keep
          ANDROID_NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/${{ env.NDK_VERSION }}
          TARGETS: x86_64-linux-android
          AWS_LC_SYS_CMAKE_BUILDER: "1"

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
        with:
          cache-read-only: ${{ github.event_name == 'pull_request' }}

      - name: Free up disk space for emulator
        run: |
          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/.ghcup /usr/local/share/boost /usr/local/share/powershell /usr/share/swift /opt/hostedtoolcache/CodeQL || true
          sudo docker image prune --all --force || true
          df -h /

      - name: Enable KVM
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Run instrumented tests
        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2
        env:
          KEEP_REPO: ${{ github.workspace }}/keep
          ANDROID_NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/${{ env.NDK_VERSION }}
          TARGETS: x86_64-linux-android
          AWS_LC_SYS_CMAKE_BUILDER: "1"
        with:
          api-level: 33
          arch: x86_64
          target: google_apis
          profile: pixel_6
          script: ./gradlew connectedDebugAndroidTest --no-daemon