| 1 |
// The OxygenHub Android app's pipeline (OxygenFlow, #19). Every push runs |
| 2 |
// the unit tests with coverage and a debug build in OxygenFlow's Android |
| 3 |
// image, with no network: the JDK, the Android SDK and NDK, Gradle, |
| 4 |
// cargo-ndk, rust-core's crates and the app's Gradle dependencies are all |
| 5 |
// in the image (oxygenflow/images/android). Rebuild and re-pin it when the |
| 6 |
// app's SDK, Gradle or dependency versions change, or rust-core's |
| 7 |
// Cargo.lock does. Locally, ./gradlew :app:createDebugUnitTestCoverageReport |
| 8 |
// runs the same tests. |
| 9 |
schema-version 1 |
| 10 |
|
| 11 |
// Cheap checks on the WASM tier (oxygenflow#96): OxygenFlow's checks module, |
| 12 |
// copied from oxygenflow/.flow/checks.wasm (built there from |
| 13 |
// crates/flow-checks; copy it again when it changes). No image and no KVM, |
| 14 |
// so any runner with the WASM tier takes it: a phone, plex, windows-1. |
| 15 |
sandbox "wasm" { |
| 16 |
runtime "wasm" |
| 17 |
memory-limit "64MiB" |
| 18 |
} |
| 19 |
|
| 20 |
// The changelog's shape, and a section for the version gradle.properties says, so a |
| 21 |
// release never finds its notes missing. |
| 22 |
job "changelog" { |
| 23 |
sandbox "wasm" |
| 24 |
scope "CHANGELOG.md" "gradle.properties" ".flow/checks.wasm" |
| 25 |
exec ".flow/checks.wasm" "changelog" "CHANGELOG.md" "gradle.properties" |
| 26 |
} |
| 27 |
|
| 28 |
sandbox "android" { |
| 29 |
runtime "microvm" |
| 30 |
rootfs "cas://blob/d5dabda3166dee2a2fdaca1b245c6e677aa95066beff8b8bb829987cb2fcacd7" |
| 31 |
memory-limit "8GiB" |
| 32 |
cpu-limit 4 |
| 33 |
network "isolated" |
| 34 |
// Gradle reads dependencies from the image's read-only cache and |
| 35 |
// writes its own state under /tmp. |
| 36 |
env { |
| 37 |
ANDROID_HOME "/opt/android-sdk" |
| 38 |
JAVA_HOME "/usr/lib/jvm/java-17-openjdk-amd64" |
| 39 |
GRADLE_RO_DEP_CACHE "/opt/gradle-home/caches" |
| 40 |
GRADLE_USER_HOME "/tmp/gradle" |
| 41 |
CARGO_INCREMENTAL "0" |
| 42 |
} |
| 43 |
} |
| 44 |
|
| 45 |
job "test" { |
| 46 |
sandbox "android" |
| 47 |
timeout "60m" |
| 48 |
// rust-core (with oxy-core and the runner) for two ABIs is most of the |
| 49 |
// build: kept from the last passing run, so only what changed builds. |
| 50 |
mount { |
| 51 |
source "ephemeral://disk" |
| 52 |
target "/src/rust-core/target" |
| 53 |
size "20GiB" |
| 54 |
cache "rust-core-target" |
| 55 |
key "rust-core/Cargo.lock" |
| 56 |
} |
| 57 |
exec "bash" "scripts/ci.sh" |
| 58 |
output { |
| 59 |
artifact "junit" { |
| 60 |
path "/src/junit.xml" |
| 61 |
when "always" |
| 62 |
} |
| 63 |
artifact "coverage" { |
| 64 |
path "/src/coverage.xml" |
| 65 |
when "always" |
| 66 |
} |
| 67 |
} |
| 68 |
} |
| 69 |
|
| 70 |
// The release's secrets checked in seconds, with no build (#7): the |
| 71 |
// keystore's SHA-256, the key its password opens and Firebase's JSON. |
| 72 |
// By hand only: oh run start --job release-check. |
| 73 |
job "release-check" { |
| 74 |
sandbox "android" |
| 75 |
timeout "5m" |
| 76 |
on { |
| 77 |
manual |
| 78 |
} |
| 79 |
secret "android-keystore" { |
| 80 |
mount-path "/run/secrets/android-keystore" |
| 81 |
} |
| 82 |
secret "android-keystore-password" { |
| 83 |
mount-path "/run/secrets/android-keystore-password" |
| 84 |
} |
| 85 |
secret "firebase-config" { |
| 86 |
mount-path "/run/secrets/firebase-config" |
| 87 |
} |
| 88 |
exec "bash" "scripts/release-check.sh" |
| 89 |
} |
| 90 |
|
| 91 |
// A signed release APK when the version in gradle.properties changes (#7), |
| 92 |
// for a release on oxygenhub.io. The keystore and its password are the |
| 93 |
// repository's secrets, mounted as files (never in the environment). |
| 94 |
job "release" { |
| 95 |
sandbox "android" |
| 96 |
timeout "60m" |
| 97 |
depends-on "test" |
| 98 |
scope "gradle.properties" |
| 99 |
mount { |
| 100 |
source "ephemeral://disk" |
| 101 |
target "/src/rust-core/target" |
| 102 |
size "20GiB" |
| 103 |
cache "rust-core-target" |
| 104 |
key "rust-core/Cargo.lock" |
| 105 |
} |
| 106 |
secret "android-keystore" { |
| 107 |
mount-path "/run/secrets/android-keystore" |
| 108 |
} |
| 109 |
secret "android-keystore-password" { |
| 110 |
mount-path "/run/secrets/android-keystore-password" |
| 111 |
} |
| 112 |
// Firebase's client settings (google-services.json) for alerts (#16). |
| 113 |
secret "firebase-config" { |
| 114 |
mount-path "/run/secrets/firebase-config" |
| 115 |
} |
| 116 |
exec "bash" "scripts/release.sh" |
| 117 |
output { |
| 118 |
artifact "oxygenhub-android-universal.apk" { |
| 119 |
path "/src/dist/oxygenhub-android-universal.apk" |
| 120 |
} |
| 121 |
artifact "SHA256SUMS" { |
| 122 |
path "/src/dist/SHA256SUMS" |
| 123 |
} |
| 124 |
} |
| 125 |
} |