feat: establish openIME visual language v1

.github/workflows/android.yml

@@ -68,16 +68,31 @@ jobs:
         run: chmod +x gradlew
 
       - name: Run unit tests, lint, and assemble
-        run: ./gradlew :app:testDebugUnitTest :app:lintDebug :app:assembleDebug --no-daemon --console=plain
+        shell: bash
+        run: |
+          set +e
+          ./gradlew :app:testDebugUnitTest :app:lintDebug :app:assembleDebug :app:assembleDebugAndroidTest --build-cache --parallel --no-daemon --console=plain
+          status=$?
+          if [[ $status -ne 0 && -f app/build/reports/lint-results-debug.txt ]]; then
+            echo "::group::Full Android Lint report"
+            cat app/build/reports/lint-results-debug.txt
+            echo "::endgroup::"
+          fi
+          exit $status
 
-      - name: Upload debug APK
+      - name: Upload test APKs
         uses: actions/upload-artifact@v7
         with:
-          name: openIME-debug
-          path: app/build/outputs/apk/debug/app-debug.apk
+          name: openIME-test-apks
+          path: |
+            app/build/outputs/apk/debug/app-debug.apk
+            app/build/outputs/apk/androidTest/debug/app-debug-androidTest.apk
           if-no-files-found: error
+          compression-level: 0
+          retention-days: 1
 
   compatibility:
+    needs: verify
     name: Compatibility API ${{ matrix.api-level }}
     runs-on: ubuntu-latest
     timeout-minutes: 45
@@ -87,47 +102,43 @@ jobs:
         api-level: [29, 31]
 
     steps:
-      - name: Checkout source and LFS files
-        uses: actions/checkout@v7
-        with:
-          lfs: true
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v6
-        with:
-          distribution: temurin
-          java-version: '17'
-          cache: gradle
+      - name: Enable KVM group perms
+        shell: bash
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
 
       - name: Set up Android SDK
         uses: android-actions/setup-android@v4
         with:
           packages: 'platform-tools'
 
-      - name: Install Android build components
-        shell: bash
-        run: |
-          sdkmanager "platforms;android-36" \
-            "build-tools;35.0.0" \
-            "ndk;27.0.12077973" \
-            "cmake;3.22.1"
+      - name: Download prebuilt test APKs
+        uses: actions/download-artifact@v7
+        with:
+          name: openIME-test-apks
+          path: ci-apks
 
-      - name: Verify LFS objects
+      - name: Prepare instrumentation runner
         shell: bash
         run: |
-          git lfs checkout
-          if grep -RIl --exclude-dir=.git "version https://git-lfs.github.com/spec/v1" app/libs app/src/main/assets/models; then
-            echo "A Git LFS pointer was left unresolved" >&2
-            exit 1
-          fi
-
-      - name: Fetch pinned librime dependencies
-        shell: bash
-        run: bash scripts/fetch_rime_deps.sh
-
-      - name: Ensure Gradle wrapper is executable
-        shell: bash
-        run: chmod +x gradlew
+          cat > ci-run-instrumentation.sh <<'EOF'
+          #!/usr/bin/env bash
+          set -euo pipefail
+          api_level="$1"
+          mkdir -p ci-reports
+          app_apk="$(find ci-apks -type f -name 'app-debug.apk' -print -quit)"
+          test_apk="$(find ci-apks -type f -name 'app-debug-androidTest.apk' -print -quit)"
+          test -n "$app_apk"
+          test -n "$test_apk"
+          adb install -r "$app_apk"
+          adb install -r "$test_apk"
+          adb shell am instrument -w -r \
+            llc.slacker.openime.test/androidx.test.runner.AndroidJUnitRunner \
+            | tee "ci-reports/instrumentation-api-${api_level}.txt"
+          EOF
+          chmod +x ci-run-instrumentation.sh
 
       - name: Run compatibility instrumentation
         uses: reactivecircus/android-emulator-runner@v2
@@ -138,14 +149,14 @@ jobs:
           profile: pixel_2
           disable-animations: true
           emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
-          script: ./gradlew :app:connectedDebugAndroidTest --no-daemon --console=plain
+          script: bash ci-run-instrumentation.sh ${{ matrix.api-level }}
 
-      - name: Upload compatibility test reports
+      - name: Upload compatibility test report
         if: always()
         uses: actions/upload-artifact@v7
         with:
           name: compatibility-api-${{ matrix.api-level }}
-          path: |
-            app/build/reports/androidTests/connected
-            app/build/outputs/androidTest-results/connected
+          path: ci-reports
           if-no-files-found: warn
+          compression-level: 0
+          retention-days: 7

.github/workflows/release.yml

@@ -0,0 +1,179 @@
+name: Android Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: Build signed arm64 release
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+      - name: Checkout source and LFS files
+        uses: actions/checkout@v7
+        with:
+          lfs: true
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v6
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: gradle
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v4
+        with:
+          packages: 'platform-tools'
+
+      - name: Install Android build components
+        shell: bash
+        run: |
+          sdkmanager "platforms;android-36" \
+            "build-tools;35.0.0" \
+            "ndk;27.0.12077973" \
+            "cmake;3.22.1"
+
+      - name: Verify LFS objects
+        shell: bash
+        run: |
+          git lfs checkout
+          if grep -RIl --exclude-dir=.git "version https://git-lfs.github.com/spec/v1" app/libs app/src/main/assets/models; then
+            echo "A Git LFS pointer was left unresolved" >&2
+            exit 1
+          fi
+
+      - name: Fetch pinned librime dependencies
+        shell: bash
+        run: bash scripts/fetch_rime_deps.sh
+
+      - name: Ensure Gradle wrapper is executable
+        shell: bash
+        run: chmod +x gradlew
+
+      - name: Validate signing secrets
+        shell: bash
+        env:
+          OPENIME_KEYSTORE_B64: ${{ secrets.OPENIME_KEYSTORE_B64 }}
+          OPENIME_KEYSTORE_PASSWORD: ${{ secrets.OPENIME_KEYSTORE_PASSWORD }}
+          OPENIME_KEY_ALIAS: ${{ secrets.OPENIME_KEY_ALIAS }}
+          OPENIME_KEY_PASSWORD: ${{ secrets.OPENIME_KEY_PASSWORD }}
+        run: |
+          for name in \
+            OPENIME_KEYSTORE_B64 \
+            OPENIME_KEYSTORE_PASSWORD \
+            OPENIME_KEY_ALIAS \
+            OPENIME_KEY_PASSWORD
+          do
+            if [[ -z "${!name}" ]]; then
+              echo "Missing required release signing secret: ${name}" >&2
+              exit 1
+            fi
+          done
+
+      - name: Decode release keystore
+        shell: bash
+        env:
+          OPENIME_KEYSTORE_B64: ${{ secrets.OPENIME_KEYSTORE_B64 }}
+        run: |
+          printf '%s' "$OPENIME_KEYSTORE_B64" \
+            | base64 --decode \
+            > "$RUNNER_TEMP/openime-release.jks"
+          chmod 600 "$RUNNER_TEMP/openime-release.jks"
+
+      - name: Run tests, lint, and release build
+        shell: bash
+        env:
+          OPENIME_KEYSTORE_PATH: ${{ runner.temp }}/openime-release.jks
+          OPENIME_KEYSTORE_PASSWORD: ${{ secrets.OPENIME_KEYSTORE_PASSWORD }}
+          OPENIME_KEY_ALIAS: ${{ secrets.OPENIME_KEY_ALIAS }}
+          OPENIME_KEY_PASSWORD: ${{ secrets.OPENIME_KEY_PASSWORD }}
+        run: |
+          ./gradlew \
+            :app:testDebugUnitTest \
+            :app:lintRelease \
+            :app:assembleRelease \
+            --no-daemon \
+            --console=plain
+
+      - name: Verify signed arm64 artifact
+        id: artifact
+        shell: bash
+        run: |
+          APK="$(find app/build/outputs/apk/release -maxdepth 1 -type f -name 'app-release*.apk' | head -n 1)"
+          if [[ -z "$APK" || ! -f "$APK" ]]; then
+            echo "Release APK not found" >&2
+            exit 1
+          fi
+
+          "$ANDROID_HOME/build-tools/35.0.0/apksigner" verify --verbose "$APK"
+
+          mapfile -t ABIS < <(
+            unzip -Z1 "$APK" \
+              | awk -F/ '/^lib\/[^/]+\/[^/]+$/ {print $2}' \
+              | sort -u
+          )
+          if [[ "${#ABIS[@]}" -ne 1 || "${ABIS[0]}" != "arm64-v8a" ]]; then
+            echo "Release APK must contain only arm64-v8a; found: ${ABIS[*]:-none}" >&2
+            exit 1
+          fi
+
+          VERSION_NAME="$(
+            sed -n 's/^[[:space:]]*versionName = "\(.*\)"/\1/p' app/build.gradle.kts \
+              | head -n 1
+          )"
+          if [[ -z "$VERSION_NAME" ]]; then
+            echo "Unable to read versionName" >&2
+            exit 1
+          fi
+          if [[ "$GITHUB_REF_NAME" != "v$VERSION_NAME" ]]; then
+            echo "Tag $GITHUB_REF_NAME does not match versionName $VERSION_NAME" >&2
+            exit 1
+          fi
+
+          OUTPUT="openIME-v${VERSION_NAME}-arm64-release.apk"
+          cp "$APK" "$OUTPUT"
+          sha256sum "$OUTPUT" > SHA256SUMS.txt
+          cp THIRD_PARTY_NOTICES.md THIRD_PARTY_NOTICES.release.md
+          echo "apk=$OUTPUT" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION_NAME" >> "$GITHUB_OUTPUT"
+
+      - name: Create release notes
+        shell: bash
+        run: |
+          cat > RELEASE_NOTES.md <<'EOF'
+          ## 更新内容
+          - 此版本包含标签所对应提交中的 openIME 功能、稳定性与界面更新。
+
+          ## 已知问题
+          - 首次安装时，完整 Rime 词典可能需要完成首次部署后才达到稳定候选表现。
+          - 发布 APK 仅包含 arm64-v8a；模拟器继续使用 Debug 构建。
+
+          ## 校验方式
+          下载 APK 后，在同一目录执行：
+
+          ```bash
+          sha256sum -c SHA256SUMS.txt
+          ```
+
+          校验通过后再安装。
+          EOF
+
+      - name: Publish GitHub Release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" \
+            "${{ steps.artifact.outputs.apk }}" \
+            SHA256SUMS.txt \
+            THIRD_PARTY_NOTICES.release.md \
+            --verify-tag \
+            --title "openIME $GITHUB_REF_NAME" \
+            --notes-file RELEASE_NOTES.md

.gitignore

@@ -24,6 +24,8 @@ artifacts/
 
 # Local screenshots and UI dumps kept outside the source tree
 *.png
+!docs/images/
+!docs/images/*.png
 *.xml
 !app/src/**/*.xml
 !app/src/main/assets/