// The OxygenHub Android app's pipeline (OxygenFlow, #19). Every push runs

// the unit tests with coverage and a debug build in OxygenFlow's Android

// image, with no network: the JDK, the Android SDK and NDK, Gradle,

// cargo-ndk, rust-core's crates and the app's Gradle dependencies are all

// in the image (oxygenflow/images/android). Rebuild and re-pin it when the

// app's SDK, Gradle or dependency versions change, or rust-core's

// Cargo.lock does. Locally, ./gradlew :app:createDebugUnitTestCoverageReport

// runs the same tests.

schema-version 1

sandbox "android" {

    runtime "microvm"

    rootfs "cas://blob/6605d6c0b87e32667bb0b19ec473e76e7139a9f1cfa6cb36a03e773eee5af06c"

    memory-limit "8GiB"

    cpu-limit 4

    // Loopback only, still offline: Gradle will not start without a

    // usable interface for its file-lock listener.

    network "loopback"

    // Gradle reads dependencies from the image's read-only cache and

    // writes its own state under /tmp.

    env {

        ANDROID_HOME "/opt/android-sdk"

        JAVA_HOME "/usr/lib/jvm/java-17-openjdk-amd64"

        GRADLE_RO_DEP_CACHE "/opt/gradle-home/caches"

        GRADLE_USER_HOME "/tmp/gradle"

        CARGO_INCREMENTAL "0"

    }

}

job "test" {

    sandbox "android"

    timeout "60m"

    // rust-core (with oxy-core and the runner) for two ABIs is most of the

    // build: kept from the last passing run, so only what changed builds.

    mount {

        source "ephemeral://disk"

        target "/src/rust-core/target"

        size "20GiB"

        cache "rust-core-target"

        key "rust-core/Cargo.lock"

    }

    exec "bash" "scripts/ci.sh"

    output {

        artifact "junit" {

            path "/src/junit.xml"

            when "always"

        }

        artifact "coverage" {

            path "/src/coverage.xml"

            when "always"

        }

    }

}

// The release's secrets checked in seconds, with no build (#7): the

// keystore's SHA-256, the key its password opens and Firebase's JSON.

// By hand only: oh run start --job release-check.

job "release-check" {

    sandbox "android"

    timeout "5m"

    on {

        manual

    }

    secret "android-keystore" {

        mount-path "/run/secrets/android-keystore"

    }

    secret "android-keystore-password" {

        mount-path "/run/secrets/android-keystore-password"

    }

    secret "firebase-config" {

        mount-path "/run/secrets/firebase-config"

    }

    exec "bash" "scripts/release-check.sh"

}

// A signed release APK when the version in gradle.properties changes (#7),

// for a release on oxygenhub.io. The keystore and its password are the

// repository's secrets, mounted as files (never in the environment).

job "release" {

    sandbox "android"

    timeout "60m"

    depends-on "test"

    scope "gradle.properties"

    mount {

        source "ephemeral://disk"

        target "/src/rust-core/target"

        size "20GiB"

        cache "rust-core-target"

        key "rust-core/Cargo.lock"

    }

    secret "android-keystore" {

        mount-path "/run/secrets/android-keystore"

    }

    secret "android-keystore-password" {

        mount-path "/run/secrets/android-keystore-password"

    }

    // Firebase's client settings (google-services.json) for alerts (#16).

    secret "firebase-config" {

        mount-path "/run/secrets/firebase-config"

    }

    exec "bash" "scripts/release.sh"

    output {

        artifact "oxygenhub-android-universal.apk" {

            path "/src/dist/oxygenhub-android-universal.apk"

        }

        artifact "SHA256SUMS" {

            path "/src/dist/SHA256SUMS"

        }

    }

}