// The OxygenHub Android app's pipeline (OxygenFlow, #19). Every push runs

// the unit tests with coverage and a debug build in OxygenFlow's Android

// image, with no network: the JDK, the Android SDK and NDK, Gradle,

// cargo-ndk, rust-core's crates and the app's Gradle dependencies are all

// in the image (oxygenflow/images/android). Rebuild and re-pin it when the

// app's SDK, Gradle or dependency versions change, or rust-core's

// Cargo.lock does. Locally, ./gradlew :app:createDebugUnitTestCoverageReport

// runs the same tests.

schema-version 1

// Cheap checks on the WASM tier (oxygenflow#96): OxygenFlow's checks module,

// copied from oxygenflow/.flow/checks.wasm (built there from

// crates/flow-checks; copy it again when it changes). No image and no KVM,

// so any runner with the WASM tier takes it: a phone, plex, windows-1.

sandbox "wasm" {

    runtime "wasm"

    memory-limit "64MiB"

}

// The changelog's shape, and a section for the version gradle.properties says, so a

// release never finds its notes missing.

job "changelog" {

    sandbox "wasm"

    scope "CHANGELOG.md" "gradle.properties" ".flow/checks.wasm"

    exec ".flow/checks.wasm" "changelog" "CHANGELOG.md" "gradle.properties"

}

sandbox "android" {

    runtime "microvm"

    rootfs "cas://blob/d5dabda3166dee2a2fdaca1b245c6e677aa95066beff8b8bb829987cb2fcacd7"

    memory-limit "8GiB"

    cpu-limit 4

    // Loopback only, still offline: Gradle will not start without a

    // usable interface for its file-lock listener.

    network "loopback"

    // Gradle reads dependencies from the image's read-only cache and

    // writes its own state under /tmp.

    env {

        ANDROID_HOME "/opt/android-sdk"

        JAVA_HOME "/usr/lib/jvm/java-17-openjdk-amd64"

        GRADLE_RO_DEP_CACHE "/opt/gradle-home/caches"

        GRADLE_USER_HOME "/tmp/gradle"

        CARGO_INCREMENTAL "0"

    }

}

job "test" {

    sandbox "android"

    timeout "60m"

    // rust-core (with oxy-core and the runner) for two ABIs is most of the

    // build: kept from the last passing run, so only what changed builds.

    mount {

        source "ephemeral://disk"

        target "/src/rust-core/target"

        size "20GiB"

        cache "rust-core-target"

        key "rust-core/Cargo.lock"

    }

    // The workspace has room for the checkout and a little more: the app's

    // build output and Gradle's project cache get disks of their own.

    mount {

        source "ephemeral://disk"

        target "/src/app/build"

        size "8GiB"

    }

    mount {

        source "ephemeral://disk"

        target "/src/.gradle"

        size "2GiB"

    }

    exec "bash" "scripts/ci.sh"

    output {

        artifact "junit" {

            path "/src/junit.xml"

            when "always"

        }

        artifact "coverage" {

            path "/src/coverage.xml"

            when "always"

        }

    }

}

// The release's secrets checked in seconds, with no build (#7): the

// keystore's SHA-256, the key its password opens and Firebase's JSON.

// By hand only: oh run start --job release-check.

job "release-check" {

    sandbox "android"

    timeout "5m"

    on {

        manual

    }

    secret "android-keystore" {

        mount-path "/run/secrets/android-keystore"

    }

    secret "android-keystore-password" {

        mount-path "/run/secrets/android-keystore-password"

    }

    secret "firebase-config" {

        mount-path "/run/secrets/firebase-config"

    }

    exec "bash" "scripts/release-check.sh"

}

// A signed release APK when the version in gradle.properties changes (#7),

// for a release on oxygenhub.io. The keystore and its password are the

// repository's secrets, mounted as files (never in the environment).

job "release" {

    sandbox "android"

    timeout "60m"

    depends-on "test"

    scope "gradle.properties"

    mount {

        source "ephemeral://disk"

        target "/src/rust-core/target"

        size "20GiB"

        cache "rust-core-target"

        key "rust-core/Cargo.lock"

    }

    // The workspace has room for the checkout and a little more: the app's

    // build output and Gradle's project cache get disks of their own.

    mount {

        source "ephemeral://disk"

        target "/src/app/build"

        size "8GiB"

    }

    mount {

        source "ephemeral://disk"

        target "/src/.gradle"

        size "2GiB"

    }

    secret "android-keystore" {

        mount-path "/run/secrets/android-keystore"

    }

    secret "android-keystore-password" {

        mount-path "/run/secrets/android-keystore-password"

    }

    // Firebase's client settings (google-services.json) for alerts (#16).

    secret "firebase-config" {

        mount-path "/run/secrets/firebase-config"

    }

    exec "bash" "scripts/release.sh"

    output {

        artifact "oxygenhub-android-universal.apk" {

            path "/src/dist/oxygenhub-android-universal.apk"

        }

        artifact "SHA256SUMS" {

            path "/src/dist/SHA256SUMS"

        }

    }

}