// The OxygenHub Android app's pipeline (OxygenFlow, #19). Every push runs
// the unit tests with coverage and a debug build in OxygenFlow's Android
// image, with no network: the JDK, the Android SDK and NDK, Gradle,
// cargo-ndk, rust-core's crates and the app's Gradle dependencies are all
// in the image (oxygenflow/images/android). Rebuild and re-pin it when the
// app's SDK, Gradle or dependency versions change, or rust-core's
// Cargo.lock does. Locally, ./gradlew :app:createDebugUnitTestCoverageReport
// runs the same tests.
schema-version 1

sandbox "android" {
    runtime "microvm"
    rootfs "cas://blob/6605d6c0b87e32667bb0b19ec473e76e7139a9f1cfa6cb36a03e773eee5af06c"
    memory-limit "8GiB"
    cpu-limit 4
    // Loopback only, still offline: Gradle will not start without a
    // usable interface for its file-lock listener.
    network "loopback"
    // Gradle reads dependencies from the image's read-only cache and
    // writes its own state under /tmp.
    env {
        ANDROID_HOME "/opt/android-sdk"
        JAVA_HOME "/usr/lib/jvm/java-17-openjdk-amd64"
        GRADLE_RO_DEP_CACHE "/opt/gradle-home/caches"
        GRADLE_USER_HOME "/tmp/gradle"
        CARGO_INCREMENTAL "0"
    }
}

job "test" {
    sandbox "android"
    timeout "60m"
    // rust-core (with oxy-core and the runner) for two ABIs is most of the
    // build: kept from the last passing run, so only what changed builds.
    mount {
        source "ephemeral://disk"
        target "/src/rust-core/target"
        size "20GiB"
        cache "rust-core-target"
        key "rust-core/Cargo.lock"
    }
    exec "bash" "scripts/ci.sh"
    output {
        artifact "junit" {
            path "/src/junit.xml"
            when "always"
        }
        artifact "coverage" {
            path "/src/coverage.xml"
            when "always"
        }
    }
}

// The release's secrets checked in seconds, with no build (#7): the
// keystore's SHA-256, the key its password opens and Firebase's JSON.
// By hand only: oh run start --job release-check.
job "release-check" {
    sandbox "android"
    timeout "5m"
    on {
        manual
    }
    secret "android-keystore" {
        mount-path "/run/secrets/android-keystore"
    }
    secret "android-keystore-password" {
        mount-path "/run/secrets/android-keystore-password"
    }
    secret "firebase-config" {
        mount-path "/run/secrets/firebase-config"
    }
    exec "bash" "scripts/release-check.sh"
}

// A signed release APK when the version in gradle.properties changes (#7),
// for a release on oxygenhub.io. The keystore and its password are the
// repository's secrets, mounted as files (never in the environment).
job "release" {
    sandbox "android"
    timeout "60m"
    depends-on "test"
    scope "gradle.properties"
    mount {
        source "ephemeral://disk"
        target "/src/rust-core/target"
        size "20GiB"
        cache "rust-core-target"
        key "rust-core/Cargo.lock"
    }
    secret "android-keystore" {
        mount-path "/run/secrets/android-keystore"
    }
    secret "android-keystore-password" {
        mount-path "/run/secrets/android-keystore-password"
    }
    // Firebase's client settings (google-services.json) for alerts (#16).
    secret "firebase-config" {
        mount-path "/run/secrets/firebase-config"
    }
    exec "bash" "scripts/release.sh"
    output {
        artifact "oxygenhub-android-universal.apk" {
            path "/src/dist/oxygenhub-android-universal.apk"
        }
        artifact "SHA256SUMS" {
            path "/src/dist/SHA256SUMS"
        }
    }
}