ci.yaml

name: CI

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

jobs:
  pre-commit:
    name: Run pre-commit to check formatting and linting
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - name: Read asdf versions
        id: asdf
        run: cat .tool-versions | sed 's/ /=/' | tee -a "$GITHUB_OUTPUT"
      - name: Parse java version
        id: java-spec
        run: |
          DISTRIBUTION=(`echo ${{steps.asdf.outputs.java}} | cut -d - -f1`)
          VERSION=(`echo ${{steps.asdf.outputs.java}} | cut -d - -f2`)
          echo "java-distribution=$DISTRIBUTION" >> "$GITHUB_OUTPUT"
          echo "java-version=$VERSION" >> "$GITHUB_OUTPUT"
      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: ${{steps.java-spec.outputs.java-distribution}}
          java-version: ${{steps.java-spec.outputs.java-version}}
          cache: gradle
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      # pre-commit/action@v3.0.1
      - run: python -m pip install pre-commit
      - uses: actions/cache@v4
        with:
          path: ~/.cache/pre-commit
          key: pre-commit|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}
      - name: Run pre-commit
        run: pre-commit run --show-diff-on-failure --color=always --all-files
  android:
    name: Analyze, test, build, and ${{ github.event_name == 'pull_request' && 'validate on' || 'upload to' }} Google Play
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - name: Read asdf versions
        id: asdf
        run: cat .tool-versions | sed 's/ /=/' | tee -a "$GITHUB_OUTPUT"
      - name: Parse java version
        id: java-spec
        run: |
          DISTRIBUTION=(`echo ${{steps.asdf.outputs.java}} | cut -d - -f1`)
          VERSION=(`echo ${{steps.asdf.outputs.java}} | cut -d - -f2`)
          echo "java-distribution=$DISTRIBUTION" >> "$GITHUB_OUTPUT"
          echo "java-version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Configure AWS Credentials
        if: github.actor != 'dependabot[bot]'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1
      - name: Configure GCP Credentials
        if: github.actor != 'dependabot[bot]'
        uses: google-github-actions/auth@v2
        with:
          create_credentials_file: true
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: ${{steps.java-spec.outputs.java-distribution}}
          java-version: ${{steps.java-spec.outputs.java-version}}
          cache: gradle
      - uses: actions/cache@v4
        with:
          path: ~/.konan
          key: konan-${{ runner.os }}-${{ hashFiles('build.gradle.kts') }}
          restore-keys: konan-${{ runner.os }}
      - run: ./gradlew spotlessCheck
      - name: shared checks & unit tests
        run: ./gradlew shared:check
      - uses: actions/upload-artifact@v3
        if: failure()
        with:
          name: android-shared-reports
          path: shared/build/reports
      - name: android checks & unit tests
        run: ./gradlew androidApp:check
      - uses: actions/upload-artifact@v3
        if: failure()
        with:
          name: android-android-reports
          path: androidApp/build/reports

      - name: Fetch AWS secrets
        if: github.actor != 'dependabot[bot]'
        uses: aws-actions/aws-secretsmanager-get-secrets@v2
        with:
          secret-ids: |
            mobile-app-android-upload-key-passphrase
      - name: Load code signing key
        if: github.actor != 'dependabot[bot]'
        run: |
          cd androidApp
          aws secretsmanager get-secret-value --secret-id mobile-app-android-upload-key --output json | jq -r '.SecretBinary' | base64 --decode > upload-keystore.jks
      - name: Set up Ruby
        if: github.actor != 'dependabot[bot]'
        uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true
      - name: Patch Fastlane to pick up application default credentials
        if: github.actor != 'dependabot[bot]'
        run: bin/patch-fastlane.sh
      - name: Build and ${{ github.event_name == 'pull_request' && 'validate on' || 'upload to' }} Google Play
        if: github.actor != 'dependabot[bot]'
        env:
          KEYSTORE_FILE: "${{ github.workspace }}/androidApp/upload-keystore.jks"
          KEYSTORE_PASSWORD: ${{ env.MOBILE_APP_ANDROID_UPLOAD_KEY_PASSPHRASE }}
          KEY_ALIAS: "upload"
          KEY_PASSWORD: ${{ env.MOBILE_APP_ANDROID_UPLOAD_KEY_PASSPHRASE }}
        run: |
          bundle exec fastlane android internal validate_only:${{ github.event_name == 'pull_request' }}