ci.yml

name: CI — build and quality checks

on:
  pull_request:
    types: [opened, synchronize, reopened]

# The coverage step comments on the pull request; everything else only reads.
permissions:
  contents: read
  pull-requests: write

jobs:
  editor:
    name: Build notes editor and audit dependencies
    runs-on: ubuntu-latest

    defaults:
      run:
        working-directory: notes_editor

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: notes_editor/package-lock.json

      - name: Install editor dependencies
        run: npm ci

      - name: Build editor bundle
        run: npm run build

      - name: Audit dependencies
        run: npm audit --audit-level=high

  build:
    name: Android build, tests, lint, and formatting
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up JDK 17
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '17'

      - name: Cache Gradle
        uses: actions/cache@v5
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: ${{ runner.os }}-gradle-

      - name: Set up Android SDK
        uses: android-actions/setup-android@v4
        with:
          log-accepted-android-sdk-licenses: 'false'

      - name: Install Android platform
        run: |
          sdkmanager \
            --channel=3 \
            "platforms;android-37.2" \
            "build-tools;35.0.0"

      - name: Make gradlew executable
        run: chmod +x ./gradlew

      - name: Decode google-services.json
        env:
          GOOGLE_SERVICES_JSON: ${{ secrets.GOOGLE_SERVICES_JSON }}
        run: |
          # Kept out of the repository and injected here. A fork or a pull request from a fork
          # gets no secrets, and the build is deliberately able to run without the file: sign-in
          # and Drive sync are simply disabled in that case.
          if [ -n "$GOOGLE_SERVICES_JSON" ]; then
            echo "$GOOGLE_SERVICES_JSON" | base64 -d > app/google-services.json
            echo "google-services.json restored from the repository secret."
          else
            echo "GOOGLE_SERVICES_JSON is not available; building without Firebase."
          fi

      - name: Build debug
        run: ./gradlew :app:assembleDebug --no-daemon --stacktrace

      - name: Compile release
        run: ./gradlew :app:assembleRelease --no-daemon --stacktrace

      - name: Run unit tests and generate coverage
        run: ./gradlew :app:test :app:createDebugUnitTestCoverageReport --no-daemon --stacktrace

      - name: Upload debug unit-test coverage
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-unit
          path: app/build/reports/coverage/test/debug/report.xml
          if-no-files-found: error

      - name: Run lint
        run: ./gradlew :app:lintDebug --no-daemon --stacktrace

      - name: Check Java formatting
        run: ./gradlew :app:spotlessCheck --no-daemon --stacktrace

  instrumentation:
    name: Android instrumentation and Room migrations
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up JDK 17
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Android SDK
        uses: android-actions/setup-android@v4
        with:
          log-accepted-android-sdk-licenses: 'false'

      # Without this the x86_64 emulator runs unaccelerated on GitHub-hosted Linux runners
      # and boot times out before any test runs. Required by reactivecircus/android-emulator-runner.
      - name: Enable KVM
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
            | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Run sync integration and migration tests
        uses: reactivecircus/android-emulator-runner@v2
        with:
          api-level: 35
          target: google_apis
          arch: x86_64
          # The coverage variant also runs the tests, and the Room store, the DAOs and the
          # preference adapters are only reachable here — without this report they look untested.
          script: ./gradlew :app:createDebugAndroidTestCoverageReport --no-daemon --stacktrace

      - name: Upload instrumentation coverage
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-instrumentation
          path: app/build/reports/coverage/androidTest/debug/connected/report.xml
          if-no-files-found: error

  coverage:
    name: Report test coverage on the pull request
    runs-on: ubuntu-latest
    needs: [build, instrumentation]
    # Report whatever exists even if a test job failed, so a coverage drop is still visible.
    if: always()

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download unit-test coverage
        uses: actions/download-artifact@v4
        continue-on-error: true
        with:
          name: coverage-unit
          path: coverage/unit

      - name: Download instrumentation coverage
        uses: actions/download-artifact@v4
        continue-on-error: true
        with:
          name: coverage-instrumentation
          path: coverage/instrumentation

      # Posts, and on later pushes updates, a single comment showing overall coverage and the
      # coverage of the files this PR actually changed. Both reports are passed together so the
      # numbers reflect the unit and on-device suites combined.
      #
      # Skipped for a pull request from a fork: its GITHUB_TOKEN is read-only whatever the
      # workflow asks for, so the comment call would fail with a 403 and turn the whole job red for
      # a reason unrelated to the change.
      - name: Comment coverage
        if: github.event.pull_request.head.repo.full_name == github.repository
        uses: madrapps/jacoco-report@v1.7.1
        with:
          paths: |
            ${{ github.workspace }}/coverage/unit/report.xml
            ${{ github.workspace }}/coverage/instrumentation/report.xml
          token: ${{ secrets.GITHUB_TOKEN }}
          title: Test coverage (unit + instrumentation)
          update-comment: true
          min-coverage-overall: 0
          min-coverage-changed-files: 0