| 1 |
// The OxygenHub Android app's pipeline (OxygenFlow, #19). Every push runs |
| 2 |
// the unit tests with coverage and a debug build in OxygenFlow's Android |
| 3 |
// image, with no network: the JDK, the Android SDK and NDK, Gradle, |
| 4 |
// cargo-ndk, rust-core's crates and the app's Gradle dependencies are all |
| 5 |
// in the image (oxygenflow/images/android). Rebuild and re-pin it when the |
| 6 |
// app's SDK, Gradle or dependency versions change, or rust-core's |
| 7 |
// Cargo.lock does. Locally, ./gradlew :app:createDebugUnitTestCoverageReport |
| 8 |
// runs the same tests. |
| 9 |
schema-version 1 |
| 10 |
|
| 11 |
sandbox "android" { |
| 12 |
runtime "microvm" |
| 13 |
rootfs "cas://blob/cceb10ea42f539bed31c4bbe16e4f49961533f80a2397ca4981afb483a066d0a" |
| 14 |
memory-limit "8GiB" |
| 15 |
cpu-limit 4 |
| 16 |
network "isolated" |
| 17 |
// Gradle reads dependencies from the image's read-only cache and |
| 18 |
// writes its own state under /tmp. |
| 19 |
env { |
| 20 |
ANDROID_HOME "/opt/android-sdk" |
| 21 |
JAVA_HOME "/usr/lib/jvm/java-17-openjdk-amd64" |
| 22 |
GRADLE_RO_DEP_CACHE "/opt/gradle-home/caches" |
| 23 |
GRADLE_USER_HOME "/tmp/gradle" |
| 24 |
CARGO_INCREMENTAL "0" |
| 25 |
} |
| 26 |
} |
| 27 |
|
| 28 |
job "test" { |
| 29 |
sandbox "android" |
| 30 |
timeout "60m" |
| 31 |
// rust-core (with oxy-core and the runner) for two ABIs is most of the |
| 32 |
// build: kept from the last passing run, so only what changed builds. |
| 33 |
mount { |
| 34 |
source "ephemeral://disk" |
| 35 |
target "/src/rust-core/target" |
| 36 |
size "20GiB" |
| 37 |
cache "rust-core-target" |
| 38 |
key "rust-core/Cargo.lock" |
| 39 |
} |
| 40 |
exec "bash" "scripts/ci.sh" |
| 41 |
output { |
| 42 |
artifact "junit" { |
| 43 |
path "/src/junit.xml" |
| 44 |
when "always" |
| 45 |
} |
| 46 |
artifact "coverage" { |
| 47 |
path "/src/coverage.xml" |
| 48 |
when "always" |
| 49 |
} |
| 50 |
} |
| 51 |
} |
| 52 |
|
| 53 |
// The release's secrets checked in seconds, with no build (#7): the |
| 54 |
// keystore's SHA-256, the key its password opens and Firebase's JSON. |
| 55 |
// By hand only: oh run start --job release-check. |
| 56 |
job "release-check" { |
| 57 |
sandbox "android" |
| 58 |
timeout "5m" |
| 59 |
on { |
| 60 |
manual |
| 61 |
} |
| 62 |
secret "android-keystore" { |
| 63 |
mount-path "/run/secrets/android-keystore" |
| 64 |
} |
| 65 |
secret "android-keystore-password" { |
| 66 |
mount-path "/run/secrets/android-keystore-password" |
| 67 |
} |
| 68 |
secret "firebase-config" { |
| 69 |
mount-path "/run/secrets/firebase-config" |
| 70 |
} |
| 71 |
exec "bash" "scripts/release-check.sh" |
| 72 |
} |
| 73 |
|
| 74 |
// A signed release APK when the version in gradle.properties changes (#7), |
| 75 |
// for a release on oxygenhub.io. The keystore and its password are the |
| 76 |
// repository's secrets, mounted as files (never in the environment). |
| 77 |
job "release" { |
| 78 |
sandbox "android" |
| 79 |
timeout "60m" |
| 80 |
depends-on "test" |
| 81 |
scope "gradle.properties" |
| 82 |
mount { |
| 83 |
source "ephemeral://disk" |
| 84 |
target "/src/rust-core/target" |
| 85 |
size "20GiB" |
| 86 |
cache "rust-core-target" |
| 87 |
key "rust-core/Cargo.lock" |
| 88 |
} |
| 89 |
secret "android-keystore" { |
| 90 |
mount-path "/run/secrets/android-keystore" |
| 91 |
} |
| 92 |
secret "android-keystore-password" { |
| 93 |
mount-path "/run/secrets/android-keystore-password" |
| 94 |
} |
| 95 |
// Firebase's client settings (google-services.json) for alerts (#16). |
| 96 |
secret "firebase-config" { |
| 97 |
mount-path "/run/secrets/firebase-config" |
| 98 |
} |
| 99 |
exec "bash" "scripts/release.sh" |
| 100 |
output { |
| 101 |
artifact "oxygenhub-android-universal.apk" { |
| 102 |
path "/src/dist/oxygenhub-android-universal.apk" |
| 103 |
} |
| 104 |
artifact "SHA256SUMS" { |
| 105 |
path "/src/dist/SHA256SUMS" |
| 106 |
} |
| 107 |
} |
| 108 |
} |