Distribute

name: Distribute
on: workflow_dispatch
jobs:
  distribute:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: 'true'
      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 18
      - name: Decrypt secrets
        run: |
          echo ${{ secrets.ENCRYPT_KEY }} | release/signing-unpack.sh
      - name: Assemble & Distribute
        run: ./gradlew :catalog:assembleCi :catalog:appDistributionUploadCi
      - name: Clean secrets
        if: always()
        run: release/signing-cleanup.sh


Release Drafter

name: Release Drafter

on:
  push:
    branches:
      - main

jobs:
  update_release_draft:
    runs-on: ubuntu-latest
    steps:
      - uses: release-drafter/release-drafter@v6
        id: create_release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - run: |
          TAG_NAME="${{ steps.create_release.outputs.tag_name }}"
          VERSION_NAME="${TAG_NAME:1}"
          sed -i "s/VERSION_NAME=[0-9]\+.[0-9]\+.[0-9]\+/VERSION_NAME=$VERSION_NAME/g" gradle.properties
          if git diff --exit-code; then
            echo "::set-output name=changes_exist::false"
          else
            echo "::set-output name=changes_exist::true"
            echo "::set-output name=VERSION_NAME::$VERSION_NAME"
          fi
        id: version_job
      - name: Commit and push files
        if: ${{ steps.version_job.outputs.changes_exist == 'true' }}
        env:
          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
        run: |
          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
          ssh-add - <<< "${{ secrets.GH_ACTION_DEPLOY_PRIVATE_KEY }}"
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          git add gradle.properties
          git commit -m "Bump version to ${{ steps.version_job.outputs.VERSION_NAME }}"
          git push git@github.com:$GITHUB_REPOSITORY.git


Release

name: Release

on:
  release:
    types: [ published ]

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    env:
      TERM: dumb
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: 'true'
      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 18
      - name: Decrypt secrets
        run: |
          echo ${{ secrets.ENCRYPT_KEY }} | release/signing-unpack.sh
          mv gradle.properties gradle.backup.properties
          cat gradle.backup.properties | grep -v configuration-cache > gradle.properties
      - name: Deploy to Sonatype
        run: ./gradlew publish
        env:
          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_NEXUS_USERNAME }}
          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_NEXUS_PASSWORD }}
      - name: Build AAB & APK
        run: |
          ./gradlew :catalog:bundleRelease :catalog:assembleRelease
      - name: Upload APK to release
        uses: softprops/action-gh-release@v1
        id: release
        with:
          files: |
            catalog/build/outputs/apk/release/catalog-release.apk
      - name: Prepare Release Notes
        run: |
          mkdir whatsnew
          URL=${{ steps.release.outputs.url }}
          echo "See full release notes at $URL" > whatsnew/whatsnew-en-US
      - name: Release to Google Play
        uses: r0adkll/upload-google-play@v1.1.3
        with:
          serviceAccountJson: release/service-account.json
          packageName: kiwi.orbit.compose.catalog
          releaseFiles: catalog/build/outputs/bundle/release/catalog-release.aab
          track: production
          status: completed
          whatsNewDirectory: whatsnew
          mappingFile: catalog/build/outputs/mapping/release/mapping.txt
      - name: Clean secrets
        if: always()
        run: release/signing-cleanup.sh


Design Tokens Updater

name: Design Tokens Updater

on:
  schedule:
    - cron: '0 4 * * 1-5' # every work-day at 6:00am in +02:00
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          lfs: 'true'
      - name: set up JDK 18
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 18
      - name: Install pngquant
        run: sudo apt-get install -y pngquant
      - name: Today env
        run: echo "TODAY=$(date '+%Y-%m-%d')" >> $GITHUB_ENV
      - name: Update Tokens
        run: bash .github/tokens-updater.sh
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          FIGMA_TOKEN: ${{ secrets.FIGMA_TOKEN }}
      - uses: tibdex/github-app-token@v2
        id: generate-token
        with:
          app_id: ${{ secrets.PRBOT_APP_ID }}
          private_key: ${{ secrets.PRBOT_PRIVATE_KEY }}
      - name: Create Pull Request
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ steps.generate-token.outputs.token }}
          labels: |
            feature
            design-tokens-autoupdate
          title: Design Tokens Update on ${{ env.TODAY }}
          body: ""
          base: main
          branch: tokens-autoupdate


CD

name: CD

on:
  push:
    branches:
      - master

jobs:
  cd:
    name: Build library CD
    # simulator names changed in macos-12 . Waiting on this to be released
    # https://github.com/JetBrains/kotlin/commit/10947e2c45255cf89b8cee1598017b6fc61b0079
    runs-on: macos-11
    continue-on-error: false
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Gradle Cache
        uses: actions/cache@v3
        with:
          key: gradle-${{ hashFiles('**/gradle.properties') }}
          restore-keys: gradle-
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper

      - name: Kotlin Native Cache
        uses: actions/cache@v3
        with:
          key: kotlin-native-${{ hashFiles('gradle.properties') }}
          path: ~/.konan

      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          distribution: temurin
          java-version: 17

      - name: Release dev with gradle
        env:
          MAVEN_AWS_KEY: ${{ secrets.MIREGO_MAVEN_AWS_ACCESS_KEY_ID }}
          MAVEN_AWS_SECRET: ${{ secrets.MIREGO_MAVEN_AWS_SECRET_ACCESS_KEY }}
        run: |
          ./gradlew writeDevVersion -s
          ./gradlew check publish -Pdisable_samples -s
          ./gradlew tagVersion -s


CI

name: CI

on:
  # Trigger the workflow on push only for the master branch
  push:
    branches:
      - master
  # Trigger the workflow on any pull requests
  pull_request:
    branches:
      - "**"

jobs:
  ci:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v3
        with:
          node-version: 18

      - name: Run prettier
        run: npx prettier --check .

      - name: Gradle Cache
        uses: actions/cache@v3
        with:
          key: gradle-${{ hashFiles('**/gradle.properties') }}
          restore-keys: gradle-
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper

      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          distribution: temurin
          java-version: 17

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Build with Gradle
        run: ./gradlew check --parallel


Release

name: Release

on: workflow_dispatch

jobs:
  release:
    name: Release library
    # simulator names changed in macos-12 . Waiting on this to be released
    # https://github.com/JetBrains/kotlin/commit/10947e2c45255cf89b8cee1598017b6fc61b0079
    runs-on: macos-11
    continue-on-error: false
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Gradle Cache
        uses: actions/cache@v3
        with:
          key: gradle-${{ hashFiles('**/gradle.properties') }}
          restore-keys: gradle-
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper

      - name: Kotlin Native Cache
        uses: actions/cache@v3
        with:
          key: kotlin-native-${{ hashFiles('gradle.properties') }}
          path: ~/.konan

      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          distribution: temurin
          java-version: 17

      - name: Release with gradle
        env:
          MAVEN_AWS_KEY: ${{ secrets.MIREGO_MAVEN_AWS_ACCESS_KEY_ID }}
          MAVEN_AWS_SECRET: ${{ secrets.MIREGO_MAVEN_AWS_SECRET_ACCESS_KEY }}
        run: |
          ./gradlew check publish -Pdisable_samples -i -s
          ./gradlew tagVersion -i -s


Assemble Debug Project

name: Assemble Debug Project

on:
  pull_request:
    types:
      - opened
      - edited

concurrency:
  # Support push/pr as event types with different behaviors each:
  # 1. push: queue up builds by branch
  # 2. pr: only allow one run per PR
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref_name }}
  # If there is already a workflow running for the same pull request, cancel it
  # For non-PR triggers queue up builds
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build_sdk:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Setup Java 17
        uses: actions/setup-java@v3
        with:
          distribution: 'zulu'
          java-version: '17'
          architecture: x86_64

      - name: Cache Gradle
        uses: actions/cache@v3
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Fetch Properties File
        env:
          SECRETS_PROPERTIES: ${{ secrets.SECRETS_PROPERTIES }}
        run: echo $SECRETS_PROPERTIES | base64 --decode > secrets.properties

      - name: Assemble Debug Project
        env:
          WC_CLOUD_PROJECT_ID: ${{ secrets.WC_CLOUD_PROJECT_ID }}
          NOTIFY_INTEGRATION_TESTS_PROJECT_ID: ${{ secrets.NOTIFY_INTEGRATION_TESTS_PROJECT_ID }}
          NOTIFY_INTEGRATION_TESTS_SECRET: ${{ secrets.NOTIFY_INTEGRATION_TESTS_SECRET }}
        # See if we can build out the list of sample project instead of manually adding them here
        run: ./gradlew assembleDebug -x :sample:wallet:assembleDebug -x :sample:dapp:assembleDebug -x :sample:common:assembleDebug -x :sample:modal:assembleDebug

      - name: Stop Gradle
        run: ./gradlew --stop


DB Migration Verification

name: DB Migration Verification

on:
  pull_request:
    types:
      - opened
      - synchronize
      - edited

concurrency:
  # Support push/pr as event types with different behaviors each:
  # 1. push: queue up builds by branch
  # 2. pr: only allow one run per PR
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref_name }}
  # If there is already a workflow running for the same pull request, cancel it
  # For non-PR triggers queue up builds
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  db_migration_verification:
    strategy:
      matrix:
        conf: [
          { name: Android-Core SDK, command: ":core:android:verifyDebugAndroidCoreDatabaseMigration" },
          { name: Sign SDK, command: ":protocol:sign:verifyDebugSignDatabaseMigration" },
          { name: Auth SDK, command: ":protocol:auth:verifyDebugAuthDatabaseMigration" },
          { name: Notify SDK, command: ":protocol:notify:verifyDebugNotifyDatabaseMigration" },
        ]
    name: ${{ matrix.conf.name }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Setup Java 17
        uses: actions/setup-java@v3
        with:
          distribution: 'zulu'
          java-version: '17'
          architecture: x86_64

      - name: Cache Gradle
        uses: actions/cache@v3
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Fetch Properties File
        env:
          SECRETS_PROPERTIES: ${{ secrets.SECRETS_PROPERTIES }}
        run: echo $SECRETS_PROPERTIES | base64 --decode > secrets.properties

      - name: Sdk Migration Verification
        env:
          WC_CLOUD_PROJECT_ID: ${{ secrets.WC_CLOUD_PROJECT_ID }}
          NOTIFY_INTEGRATION_TESTS_PROJECT_ID: ${{ secrets.NOTIFY_INTEGRATION_TESTS_PROJECT_ID }}
          NOTIFY_INTEGRATION_TESTS_SECRET: ${{ secrets.NOTIFY_INTEGRATION_TESTS_SECRET }}
        run: ./gradlew ${{ matrix.conf.command }}

      - name: Stop Gradle
        run: ./gradlew --stop


Release Samples - Debug

name: Release Samples - Debug

on:
  workflow_dispatch:

jobs:
  release_samples_debug:
    strategy:
      matrix:
        conf: [
          { name: wallet, command: ":sample:wallet:assembleDebug :sample:wallet:appDistributionUploadDebug" },
          { name: dapp, command: ":sample:dapp:assembleDebug :sample:dapp:appDistributionUploadDebug" },
          { name: modal, command: ":sample:modal:assembleDebug :sample:modal:appDistributionUploadDebug" }
        ]
    name: ${{ matrix.conf.name }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Setup Java 17
        uses: actions/setup-java@v3
        with:
          distribution: 'zulu'
          java-version: '17'
          architecture: x86_64
          cache: 'gradle'

      - name: Cache Gradle
        uses: actions/cache@v3
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Setup Required files to build samples
        with:
          GOOGLE_SERVICES_JSON: ${{ secrets.GOOGLE_SERVICES_JSON }}
          FIREBASE_SERVICE_CREDENTIALS: ${{ secrets.FIREBASE_SERVICE_CREDENTIALS }}
          SECRETS_PROPERTIES: ${{ secrets.SECRETS_PROPERTIES }}
          ENCODED_STRING_DEBUG: ${{ secrets.WC_KOTLIN_DEBUG_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_DEBUG: ${{ secrets.WC_KOTLIN_DEBUG_KEYSTORE_PATH }}
          ENCODED_STRING_INTERNAL: ${{ secrets.WC_KOTLIN_INTERNAL_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_INTERNAL: ${{ secrets.WC_KOTLIN_INTERNAL_KEYSTORE_PATH }}
          ENCODED_STRING_UPLOAD: ${{ secrets.WC_KOTLIN_UPLOAD_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_UPLOAD: ${{ secrets.WC_KOTLIN_UPLOAD_KEYSTORE_PATH }}
        uses: ./.github/actions/ci_setup

      - name: Release sample - Debug
        env:
          WC_CLOUD_PROJECT_ID: ${{ secrets.WC_CLOUD_PROJECT_ID }}
          FIREBASE_TOKEN: ${{ secrets.FIREBASE_TOKEN }}
          NOTIFY_INTEGRATION_TESTS_PROJECT_ID: ${{ secrets.NOTIFY_INTEGRATION_TESTS_PROJECT_ID }}
          NOTIFY_INTEGRATION_TESTS_SECRET: ${{ secrets.NOTIFY_INTEGRATION_TESTS_SECRET }}
        run: ./gradlew ${{ matrix.conf.command }}

      - name: Stop Gradle
        run: ./gradlew --stop


Instrumented Tests

name: Instrumented Tests

on:
  workflow_dispatch:
    inputs:
      testTimeoutSeconds:
        description: 'Seconds for test timeout'
        required: true
        default: 120  # should be same as env.TEST_TIMEOUT_SECONDS
  pull_request:
    branches:
      - develop
      - master
    path:
      - 'core/android/**'
      - 'protocol/sign/**'
      - 'protocol/notify/**'

env:
  TEST_TIMEOUT_SECONDS: 120 # Predefined timeout for integration tests

concurrency:
  # Support push/pr as event types with different behaviors each:
  # 1. push: queue up builds by branch
  # 2. pr: only allow one run per PR
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref_name }}
  # If there is already a workflow running for the same pull request, cancel it
  # For non-PR triggers queue up builds
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  sdk_tests:
    name: Run Instrumented Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Check what modules were changed
        id: what_modules_changed
        shell: bash
        run: |
          check_changes() {
            local module_path=$1
            local output_variable_name=$2

            changes=$(git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }} -- "$module_path/")

            if [ -n "$changes" ]; then
            echo "${output_variable_name}=true" >> $GITHUB_OUTPUT
            echo "${output_variable_name}=true"
            else
            echo "${output_variable_name}=false" >> $GITHUB_OUTPUT
            echo "${output_variable_name}=false"
            fi
          }

          check_changes "core/android" "CORE_MODULE_CHANGED"
          check_changes "protocol/sign" "SIGN_MODULE_CHANGED"
          check_changes "protocol/notify" "NOTIFY_MODULE_CHANGED"

      - name: Setup Required files to build SDKs
        with:
          GOOGLE_SERVICES_JSON: ${{ secrets.GOOGLE_SERVICES_JSON }}
          FIREBASE_SERVICE_CREDENTIALS: ${{ secrets.FIREBASE_SERVICE_CREDENTIALS }}
          SECRETS_PROPERTIES: ${{ secrets.SECRETS_PROPERTIES }}
          ENCODED_STRING_DEBUG: ${{ secrets.WC_KOTLIN_DEBUG_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_DEBUG: ${{ secrets.WC_KOTLIN_DEBUG_KEYSTORE_PATH }}
          ENCODED_STRING_INTERNAL: ${{ secrets.WC_KOTLIN_INTERNAL_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_INTERNAL: ${{ secrets.WC_KOTLIN_INTERNAL_KEYSTORE_PATH }}
          ENCODED_STRING_UPLOAD: ${{ secrets.WC_KOTLIN_UPLOAD_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_UPLOAD: ${{ secrets.WC_KOTLIN_UPLOAD_KEYSTORE_PATH }}
        uses: ./.github/actions/ci_setup

      - name: Enable KVM group perms
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Run Core instrumented tests
        if: ${{ steps.what_modules_changed.outputs.CORE_MODULE_CHANGED == 'true' || github.event_name == 'workflow_dispatch' }}
        uses: ./.github/actions/ci_instrumented_tests
        with:
          name: "Android_Core_SDK"
          command: ":core:android:allDevicesCheck"
          projectId: ${{ secrets.WC_CLOUD_PROJECT_ID }}
          notifyProjectId: ${{ secrets.NOTIFY_INTEGRATION_TESTS_PROJECT_ID }}
          notifySecret: ${{ secrets.NOTIFY_INTEGRATION_TESTS_SECRET }}
          testTimeoutSeconds: ${{ github.event.inputs.testTimeoutSeconds || env.TEST_TIMEOUT_SECONDS }} # Prioritise dispatch input timeout over env one

      - name: Run Sign instrumented tests
        if: ${{ steps.what_modules_changed.outputs.CORE_MODULE_CHANGED == 'true' || steps.what_modules_changed.outputs.SIGN_MODULE_CHANGED == 'true' || github.event_name == 'workflow_dispatch' }}
        uses: ./.github/actions/ci_instrumented_tests
        with:
          name: "Sign_SDK"
          command: ":protocol:sign:allDevicesCheck"
          projectId: ${{ secrets.WC_CLOUD_PROJECT_ID }}
          notifyProjectId: ${{ secrets.NOTIFY_INTEGRATION_TESTS_PROJECT_ID }}
          notifySecret: ${{ secrets.NOTIFY_INTEGRATION_TESTS_SECRET }}
          testTimeoutSeconds: ${{ github.event.inputs.testTimeoutSeconds || env.TEST_TIMEOUT_SECONDS }} # Prioritise dispatch input timeout over env one

      - name: Run Notify instrumented tests
        if: false
#        if: ${{ steps.what_modules_changed.outputs.CORE_MODULE_CHANGED == 'true' || steps.what_modules_changed.outputs.NOTIFY_MODULE_CHANGED == 'true' || github.event_name == 'workflow_dispatch' }}
        uses: ./.github/actions/ci_instrumented_tests
        with:
          name: "Notify_SDK"
          command: ":protocol:notify:allDevicesCheck"
          projectId: ${{ secrets.WC_CLOUD_PROJECT_ID }}
          notifyProjectId: ${{ secrets.NOTIFY_INTEGRATION_TESTS_PROJECT_ID }}
          notifySecret: ${{ secrets.NOTIFY_INTEGRATION_TESTS_SECRET }}
          testTimeoutSeconds: ${{ github.event.inputs.testTimeoutSeconds || env.TEST_TIMEOUT_SECONDS }} # Prioritise dispatch input timeout over env one


Release Samples - Internal

name: Release Samples - Internal

on:
  push:
    branches:
      - develop
    paths:
      - 'foundation/**'
      - 'core/**'
      - 'protocol/**'
      - 'product/**'
      - 'sample/**'
  workflow_dispatch:

jobs:
  release_samples_internal:
    strategy:
      matrix:
        conf: [
          { name: wallet, command: ":sample:wallet:assembleInternal :sample:wallet:appDistributionUploadInternal" },
          { name: dapp, command: ":sample:dapp:assembleInternal :sample:dapp:appDistributionUploadInternal" },
          { name: modal, command: ":sample:modal:assembleInternal :sample:modal:appDistributionUploadInternal" }
        ]
    name: ${{ matrix.conf.name }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Setup Java 17
        uses: actions/setup-java@v3
        with:
          distribution: 'zulu'
          java-version: '17'
          architecture: x86_64
          cache: 'gradle'

      - name: Cache Gradle
        uses: actions/cache@v3
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Setup Required files to build samples
        with:
          GOOGLE_SERVICES_JSON: ${{ secrets.GOOGLE_SERVICES_JSON }}
          FIREBASE_SERVICE_CREDENTIALS: ${{ secrets.FIREBASE_SERVICE_CREDENTIALS }}
          SECRETS_PROPERTIES: ${{ secrets.SECRETS_PROPERTIES }}
          ENCODED_STRING_DEBUG: ${{ secrets.WC_KOTLIN_DEBUG_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_DEBUG: ${{ secrets.WC_KOTLIN_DEBUG_KEYSTORE_PATH }}
          ENCODED_STRING_INTERNAL: ${{ secrets.WC_KOTLIN_INTERNAL_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_INTERNAL: ${{ secrets.WC_KOTLIN_INTERNAL_KEYSTORE_PATH }}
          ENCODED_STRING_UPLOAD: ${{ secrets.WC_KOTLIN_UPLOAD_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_UPLOAD: ${{ secrets.WC_KOTLIN_UPLOAD_KEYSTORE_PATH }}
        uses: ./.github/actions/ci_setup

      - name: Release sample - Internal
        env:
          WC_CLOUD_PROJECT_ID: ${{ secrets.WC_CLOUD_PROJECT_ID }}
          FIREBASE_TOKEN: ${{ secrets.FIREBASE_TOKEN }}
          NOTIFY_INTEGRATION_TESTS_PROJECT_ID: ${{ secrets.NOTIFY_INTEGRATION_TESTS_PROJECT_ID }}
          NOTIFY_INTEGRATION_TESTS_SECRET: ${{ secrets.NOTIFY_INTEGRATION_TESTS_SECRET }}
          MIX_PANEL: ${{ secrets.MIX_PANEL }}
        run: ./gradlew ${{ matrix.conf.command }}

      - name: Stop Gradle
        run: ./gradlew --stop


Record Snapshots

name: Record Snapshots

on:
  workflow_dispatch:

jobs:
  record_snapshots:
    strategy:
      matrix:
        conf: [
          { name: wcm, command: ":product:walletconnectmodal:recordPaparazziDebug"}
        ]
    name: ${{ matrix.conf.name }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Setup Java 17
        uses: actions/setup-java@v3
        with:
          distribution: 'zulu'
          java-version: '17'
          architecture: x86_64
          cache: 'gradle'

      - name: Cache Gradle
        uses: actions/cache@v3
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Fetch Properties File
        env:
          SECRETS_PROPERTIES: ${{ secrets.SECRETS_PROPERTIES }}
        run: echo $SECRETS_PROPERTIES | base64 --decode > secrets.properties

      - name: Records snapshots
        run: ./gradlew ${{ matrix.conf.command }}

      - name: Stop Gradle
        run: ./gradlew --stop


Relay Integration Tests

name: Relay Integration Tests

on:
  pull_request:
    types:
      - opened
      - edited

concurrency:
  # Support push/pr as event types with different behaviors each:
  # 1. push: queue up builds by branch
  # 2. pr: only allow one run per PR
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref_name }}
  # If there is already a workflow running for the same pull request, cancel it
  # For non-PR triggers queue up builds
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  integration_tests:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Run Relay CI
        env:
          TEST_RELAY_URL: wss://relay.walletconnect.com
          TEST_PROJECT_ID: ${{ secrets.WC_CLOUD_PROJECT_ID }}
          NOTIFY_INTEGRATION_TESTS_PROJECT_ID: ${{ secrets.NOTIFY_INTEGRATION_TESTS_PROJECT_ID }}
          NOTIFY_INTEGRATION_TESTS_SECRET: ${{ secrets.NOTIFY_INTEGRATION_TESTS_SECRET }}
        with:
          SECRETS_PROPERTIES: ${{ secrets.SECRETS_PROPERTIES }}
        uses: ./.github/actions/ci_relay


Release Samples

name: Release Samples

on:
  release:
    types: [ published ]

jobs:
  release_samples:
    strategy:
      matrix:
        conf: [
          { name: wallet, command: ":sample:wallet:assembleRelease :sample:wallet:appDistributionUploadRelease" },
          { name: dapp, command: ":sample:dapp:assembleRelease :sample:dapp:appDistributionUploadRelease" },
          { name: modal, command: ":sample:modal:assembleRelease :sample:modal:appDistributionUploadRelease" }
        ]
    name: ${{ matrix.conf.name }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Setup Java 17
        uses: actions/setup-java@v3
        with:
          distribution: 'zulu'
          java-version: '17'
          architecture: x86_64
          cache: 'gradle'

      - name: Cache Gradle
        uses: actions/cache@v3
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Setup Required files to build samples
        with:
          GOOGLE_SERVICES_JSON: ${{ secrets.GOOGLE_SERVICES_JSON }}
          FIREBASE_SERVICE_CREDENTIALS: ${{ secrets.FIREBASE_SERVICE_CREDENTIALS }}
          SECRETS_PROPERTIES: ${{ secrets.SECRETS_PROPERTIES }}
          ENCODED_STRING_DEBUG: ${{ secrets.WC_KOTLIN_DEBUG_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_DEBUG: ${{ secrets.WC_KOTLIN_DEBUG_KEYSTORE_PATH }}
          ENCODED_STRING_INTERNAL: ${{ secrets.WC_KOTLIN_INTERNAL_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_INTERNAL: ${{ secrets.WC_KOTLIN_INTERNAL_KEYSTORE_PATH }}
          ENCODED_STRING_UPLOAD: ${{ secrets.WC_KOTLIN_UPLOAD_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_UPLOAD: ${{ secrets.WC_KOTLIN_UPLOAD_KEYSTORE_PATH }}
        uses: ./.github/actions/ci_setup

      - name: Release sample
        env:
          WC_CLOUD_PROJECT_ID: ${{ secrets.WC_CLOUD_PROJECT_ID }}
          FIREBASE_TOKEN: ${{ secrets.FIREBASE_TOKEN }}
          NOTIFY_INTEGRATION_TESTS_PROJECT_ID: ${{ secrets.NOTIFY_INTEGRATION_TESTS_PROJECT_ID }}
          NOTIFY_INTEGRATION_TESTS_SECRET: ${{ secrets.NOTIFY_INTEGRATION_TESTS_SECRET }}
        run: ./gradlew ${{ matrix.conf.command }}

      - name: Stop Gradle
        run: ./gradlew --stop


Kotlin Scheduled Integration

name: Kotlin Scheduled Integration

on:
  schedule:
    - cron: '0 0,12 * * *' # Runs every day at 0:00 and 12:00 UTC
  workflow_dispatch:
    inputs:
      testTimeoutSeconds:
        description: 'Seconds for test timeout'
        required: true
        default: 40  # should be same as env.TEST_TIMEOUT_SECONDS
      shouldUseCache:
        description: 'Flag to use and save cache gradle. Tests results are cached!'
        required: true
        default: false

env:
  TEST_TIMEOUT_SECONDS: 40 # Predefined timeout for integration tests

jobs:
# Copy of ci_relay.yml
  relay_tests:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Run Relay CI
        env:
          TEST_RELAY_URL: wss://relay.walletconnect.com
          TEST_PROJECT_ID: ${{ secrets.WC_CLOUD_PROJECT_ID }}
        with:
          SECRETS_PROPERTIES: ${{ secrets.SECRETS_PROPERTIES }}
        uses: ./.github/actions/ci_relay

# Copy of ci_instrumented_test.yml
#   sdk_tests:
#     strategy:
#       fail-fast: false
#       matrix:
#         conf: [
#           { name: 'Sign_SDK', command: ":protocol:sign:allDevicesCheck" },
#           { name: 'Android_Core_SDK', command: ":core:android:allDevicesCheck" },
#         ]

#     name: ${{ matrix.conf.name }}
#     runs-on: self-hosted
#     steps:
#       - uses: actions/checkout@v3

#       - name: Run instrumented tests
#         uses: ./.github/actions/ci_instrumented_tests
#         with:
#           shouldUseCache: ${{ github.event.inputs.testTimeoutSeconds || true }} # Setting to true faster pass unchanged code
#           name: ${{ matrix.conf.name }}
#           command: ${{ matrix.conf.command }}
#           report: ${{ matrix.conf.report }}
#           projectId: ${{ secrets.WC_CLOUD_PROJECT_ID }}
#           testTimeoutSeconds: ${{ github.event.inputs.testTimeoutSeconds || env.TEST_TIMEOUT_SECONDS }} # Prioritise dispatch input timeout over env one

  trigger_slack_webhook:
    runs-on: ubuntu-latest
#     needs: [sdk_tests, relay_tests]
    needs: [relay_tests]
    if: failure()
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Send GitHub Action trigger data to Slack workflow
        id: slack
        uses: slackapi/slack-github-action@v1.24.0
        with:
          payload: |
            {
              "action_url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_SCHEDULED_CI_WEBHOOK_URL }}


SonarCloud

name: SonarCloud

on:
  push:
    branches:
      - develop
      - master
  pull_request:
    types: [opened, synchronize, reopened]

concurrency:
  # Support push/pr as event types with different behaviors each:
  # 1. push: queue up builds by branch
  # 2. pr: only allow one run per PR
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref_name }}
  # If there is already a workflow running for the same pull request, cancel it
  # For non-PR triggers queue up builds
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    if: ${{ github.event_name == 'push' || github.event.pull_request.base.ref == 'develop' }}
    name: Build and analyze
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: 17
          distribution: 'zulu'

      - name: Cache SonarCloud packages
        uses: actions/cache@v3
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar

      - name: Cache Gradle packages
        uses: actions/cache@v3
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
          restore-keys: ${{ runner.os }}-gradle

      - name: Setup Required files to build samples
        with:
          GOOGLE_SERVICES_JSON: ${{ secrets.GOOGLE_SERVICES_JSON }}
          FIREBASE_SERVICE_CREDENTIALS: ${{ secrets.FIREBASE_SERVICE_CREDENTIALS }}
          SECRETS_PROPERTIES: ${{ secrets.SECRETS_PROPERTIES }}
          ENCODED_STRING_DEBUG: ${{ secrets.WC_KOTLIN_DEBUG_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_DEBUG: ${{ secrets.WC_KOTLIN_DEBUG_KEYSTORE_PATH }}
          ENCODED_STRING_INTERNAL: ${{ secrets.WC_KOTLIN_INTERNAL_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_INTERNAL: ${{ secrets.WC_KOTLIN_INTERNAL_KEYSTORE_PATH }}
          ENCODED_STRING_UPLOAD: ${{ secrets.WC_KOTLIN_UPLOAD_KEYSTORE }}
          SIGNING_KEY_STORE_PATH_UPLOAD: ${{ secrets.WC_KOTLIN_UPLOAD_KEYSTORE_PATH }}
        uses: ./.github/actions/ci_setup

      - name: Build and analyze
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: ./gradlew sonar --stacktrace
#        jacocoDebugTestReport --stacktrace


Verify Snapshots

name: Verify Snapshots

on:
  workflow_dispatch:

jobs:
  verify_snapshots:
    strategy:
      matrix:
        conf: [
          { name: wcm, command: ":product:walletconnectmodal:verifyPaparazziDebug"}
        ]
    name: ${{ matrix.conf.name }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Setup Java 17
        uses: actions/setup-java@v3
        with:
          distribution: 'zulu'
          java-version: '17'
          architecture: x86_64
          cache: 'gradle'

      - name: Cache Gradle
        uses: actions/cache@v3
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Fetch Properties File
        env:
          SECRETS_PROPERTIES: ${{ secrets.SECRETS_PROPERTIES }}
        run: echo $SECRETS_PROPERTIES | base64 --decode > secrets.properties

      - name: Verify snapshots
        run: ./gradlew ${{ matrix.conf.command }}

      - name: Stop Gradle
        run: ./gradlew --stop


intake

# This workflow moves issues to the board
# when they receive the "accepted" label
# When WalletConnect Org members create issues they
# are automatically "accepted".
# Else they need to manually receive that label during intake.
name: intake

on:
  issues:
    types: [opened, labeled]

jobs:
  add-to-project:
    name: Add issue to board
    if: github.event.action == 'labeled' && github.event.label.name == 'accepted'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/add-to-project@v0.1.0
        with:
          project-url: https://github.com/orgs/WalletConnect/projects/4
          github-token: ${{ secrets.ASSIGN_TO_PROJECT_GITHUB_TOKEN }}
          labeled: accepted
          label-operator: OR
  auto-promote:
    name: auto-promote
    if: github.event.action == 'opened'
    runs-on: ubuntu-latest
    steps:
      - name: Check Core Team membership
        uses: tspascoal/get-user-teams-membership@v1
        id: is-core-team
        with:
          username: ${{ github.event_name != 'pull_request' && github.event.issue.user.login || github.event.sender.login }}
          team: "Core Team"
          GITHUB_TOKEN: ${{ secrets.ASSIGN_TO_PROJECT_GITHUB_TOKEN }}
      - name: Print result
        env:
          CREATOR: ${{ github.event_name != 'pull_request' && github.event.issue.user.login || github.event.sender.login }}
          IS_TEAM_MEMBER: ${{ steps.is-core-team.outputs.isTeamMember }}
        run: echo "$CREATOR (Core Team Member $IS_TEAM_MEMBER) created this issue/PR"
      - name: Label issues
        if: ${{ steps.is-core-team.outputs.isTeamMember == 'true' }}
        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90
        with:
          add-labels: "accepted"
          repo-token: ${{ secrets.ASSIGN_TO_PROJECT_GITHUB_TOKEN }}


Slack Release Notifications

# This file was generated using Kotlin DSL (.github/workflows/scripts/slack_release_notifications_workflow.main.kts).
# If you want to modify the workflow, please change the Kotlin file and regenerate this YAML file.
# Generated with https://github.com/typesafegithub/github-workflows-kt

name: 'Slack Release Notifications'
on:
  release:
    types: [ published, edited ]
jobs:
  push-notifications:
    runs-on: 'ubuntu-latest'
    strategy:
      matrix:
        conf:
        - webhook_url: SLACK_WEBHOOK_URL_KOTLIN
    steps:
    - id: 'step-0'
      name: 'Check out'
      uses: 'actions/checkout@v4'
    - id: 'step-1'
      name: 'Notify Channel'
      uses: 'slackapi/slack-github-action@v1.24.0'
      with:
        payload: |-
          {
            "text":"Kotlin Release ${{ github.event.release.name }} was just released. Please update and let us know if you have any issues."
          }
      env:
        SLACK_WEBHOOK_URL: ${{ secrets[matrix.conf.webhook_url] }}
        SLACK_WEBHOOK_TYPE: 'INCOMING_WEBHOOK'


Android Build

name: Android Build

on:
  workflow_call:
    inputs:
      env_name:
        required: true
        default: default
        type: string
      ref:
        required: false
        type: string
      NVMRC:
        required: true
        type: string
      MAP_IMPL:
        description: "The map implementation to use (mapbox,mapbox11)"
        default: mapbox
        required: false
        type: string
      NEW_ARCH:
        description: "If build with new architecture or not"
        default: false
        required: false
        type: boolean
    secrets:
      MAPBOX_ACCESS_TOKEN:
        required: true
      MAPBOX_DOWNLOAD_TOKEN:
        required: true
      ENV_MAPBOX_ACCESS_TOKEN:
        required: false
      ENV_MAPBOX_DOWNLOAD_TOKEN:
        required: false

jobs:
  build_example:
    name: Android Example Build ${{ inputs.NEW_ARCH && 'Fabric' || 'Paper' }} ${{ inputs.MAP_IMPL }}
    runs-on: ubuntu-latest
    environment: ${{ inputs.env_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        if: ${{ inputs.ref == '' }}

      - name: Checkout fork
        uses: actions/checkout@v4
        if: ${{ inputs.ref != '' }}
        with:
          ref: ${{ inputs.ref }}

      - name: Setup node ${{ inputs.NVMRC }}
        uses: actions/setup-node@v3.5.1
        with:
          node-version: ${{ inputs.NVMRC }}

      - name: Setup JDK zulu 17
        uses: actions/setup-java@v3
        with:
          distribution: 'zulu'
          java-version: '17'

      - run: |
          mkdir -p ~/.gradle/
          echo MAPBOX_DOWNLOADS_TOKEN=$MAPBOX_DOWNLOAD_TOKEN > ~/.gradle/gradle.properties
        working-directory: example
        env:
          MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.MAPBOX_DOWNLOAD_TOKEN || secrets.ENV_MAPBOX_DOWNLOAD_TOKEN }}

      - run: echo $MAPBOX_ACCESS_TOKEN > ./accesstoken
        working-directory: example
        env:
          MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN || secrets.ENV_MAPBOX_ACCESS_TOKEN }}

      - run: yarn install --network-timeout 1000000
        working-directory: example

      - run: yarn postinstall
        working-directory: example

      - run: ./gradlew assemble
        working-directory: example/android
        env:
          CI_MAP_IMPL: ${{ inputs.MAP_IMPL }}
          ORG_GRADLE_PROJECT_newArchEnabled: ${{ inputs.NEW_ARCH && 'true' || 'false' }}


Bump version

# This is a basic workflow that is manually triggered

name: Bump version

# Controls when the action will run. Workflow runs when manually triggered using the UI
# or API.
on:
  workflow_dispatch:
    # Inputs the workflow accepts.
    inputs:
      version:
        # Friendly description to be shown in the UI instead of 'name'
        description: 'Semver type of new version (major / minor / patch)'
        # Input has to be provided for the workflow to run
        required: true
        type: choice
        options:
        - patch
        - minor
        - major
        - prerelease --preid=beta
        - prerelease --preid=rc

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "bump-version"
  bump-version:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
    # Check out the content (source branch).  Use a deploy key so that
    # when we push changes, it will trigger the release workflow
    # run that runs on: tag. (Using the GitHub token would
    # not run the workflow to prevent infinite recursion.)
    - name: Check out source
      uses: actions/checkout@v3
      with:
        ssh-key: ${{ secrets.DEPLOY_KEY }}

    - name: Setup Node.js
      uses: actions/setup-node@v3.5.1
      with:
        node-version: '16'

    - name: Setup Git
      run: |
        git config user.name 'RNMapbox robot'
        git config user.email 'rnmapbox@gmail.com'
    - name: bump version
      run: npm version ${{ github.event.inputs.version }}

    - name: Push latest version
      run: git push origin main --follow-tags


CheckCodeExampleInIssue

name: CheckCodeExampleInIssue

on:
  issues:
    types: [opened, edited]

jobs:
  check-issue-example-code:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    permissions:
      issues: write

    steps:
      - uses: actions/checkout@v3

      - name: setup node
        uses: actions/setup-node@v4
        with:
          node-version: '18'

      - name: run lint-code-example-in-issues.js
        run: |
          npm install
          node lint-code-example-in-issues.js
        working-directory: ./scripts/actions/lint-code-example-in-issues
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


on:
  pull_request_target:
    branches: [ main ]

jobs:
  call_ci_requiring_tokens:
    if: github.repository == 'rnmapbox/maps' && github.event.pull_request.head.repo.fork == true
    name: "CI requiring tokens"
    uses: ./.github/workflows/ci-requiring-tokens.yml
    with:
      NVMRC: v18.18.0
      env_name: CI with Mapbox Tokens
      ref: ${{ github.event.pull_request.head.sha }}
    secrets:
      ENV_MAPBOX_ACCESS_TOKEN: ${{ secrets.ENV_MAPBOX_ACCESS_TOKEN }}
      ENV_MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.ENV_MAPBOX_DOWNLOAD_TOKEN }}


CI Builds requiring mapbox tokens

name: CI Builds requiring mapbox tokens

on:
  workflow_call:
    inputs:
      NVMRC:
        required: true
        type: string
      env_name:
        required: false
        type: string
        default: default
      ref:
        required: false
        type: string
    secrets:
      MAPBOX_ACCESS_TOKEN:
        required: false
      MAPBOX_DOWNLOAD_TOKEN:
        required: false
      ENV_MAPBOX_ACCESS_TOKEN:
        required: false
      ENV_MAPBOX_DOWNLOAD_TOKEN:
        required: false

concurrency:
  group: ${{ github.head_ref || github.run_id }}-ci-with-tokens
  cancel-in-progress: true

jobs:
  call_android_workflow:
    name: "Android/Mapbox"
    uses: ./.github/workflows/android-actions.yml
    with:
      env_name: ${{ inputs.env_name }}
      ref: ${{ inputs.ref }}
      NVMRC: ${{ inputs.NVMRC }}
      MAP_IMPL: mapbox
    secrets:
      MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN }}
      MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.MAPBOX_DOWNLOAD_TOKEN }}
      ENV_MAPBOX_ACCESS_TOKEN: ${{ secrets.ENV_MAPBOX_ACCESS_TOKEN }}
      ENV_MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.ENV_MAPBOX_DOWNLOAD_TOKEN }}

  call_android_workflow_fabric:
    name: "Android/Mapbox/Fabric"
    uses: ./.github/workflows/android-actions.yml
    with:
      env_name: ${{ inputs.env_name }}
      ref: ${{ inputs.ref }}
      NVMRC: ${{ inputs.NVMRC }}
      MAP_IMPL: mapbox
      NEW_ARCH: true
    secrets:
      MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN }}
      MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.MAPBOX_DOWNLOAD_TOKEN }}
      ENV_MAPBOX_ACCESS_TOKEN: ${{ secrets.ENV_MAPBOX_ACCESS_TOKEN }}
      ENV_MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.ENV_MAPBOX_DOWNLOAD_TOKEN }}

  call_android_workflow_11:
    name: "Android/Mapbox11"
    uses: ./.github/workflows/android-actions.yml
    with:
      env_name: ${{ inputs.env_name }}
      ref: ${{ inputs.ref }}
      NVMRC: ${{ inputs.NVMRC }}
      MAP_IMPL: mapbox11
    secrets:
      MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN }}
      MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.MAPBOX_DOWNLOAD_TOKEN }}
      ENV_MAPBOX_ACCESS_TOKEN: ${{ secrets.ENV_MAPBOX_ACCESS_TOKEN }}
      ENV_MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.ENV_MAPBOX_DOWNLOAD_TOKEN }}

  call_ios_workflow:
    name: "iOS/Mapbox"
    uses: ./.github/workflows/ios-actions.yml
    with:
      env_name: ${{ inputs.env_name }}
      ref: ${{ inputs.ref }}
      NVMRC: ${{ inputs.NVMRC }}
      MAP_IMPL: mapbox
    secrets:
      MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN }}
      MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.MAPBOX_DOWNLOAD_TOKEN }}
      ENV_MAPBOX_ACCESS_TOKEN: ${{ secrets.ENV_MAPBOX_ACCESS_TOKEN }}
      ENV_MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.ENV_MAPBOX_DOWNLOAD_TOKEN }}

  call_ios_workflow_fabric:
    name: "iOS/Mapbox/Fabric"
    uses: ./.github/workflows/ios-actions.yml
    with:
      env_name: ${{ inputs.env_name }}
      ref: ${{ inputs.ref }}
      NVMRC: ${{ inputs.NVMRC }}
      MAP_IMPL: mapbox
      NEW_ARCH: true
    secrets:
      MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN }}
      MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.MAPBOX_DOWNLOAD_TOKEN }}
      ENV_MAPBOX_ACCESS_TOKEN: ${{ secrets.ENV_MAPBOX_ACCESS_TOKEN }}
      ENV_MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.ENV_MAPBOX_DOWNLOAD_TOKEN }}

  call_ios_workflow_11:
    name: "iOS/Mapbox11"
    uses: ./.github/workflows/ios-actions.yml
    with:
      env_name: ${{ inputs.env_name }}
      ref: ${{ inputs.ref }}
      NVMRC: ${{ inputs.NVMRC }}
      MAP_IMPL: mapbox11
    secrets:
      MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN }}
      MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.MAPBOX_DOWNLOAD_TOKEN }}
      ENV_MAPBOX_ACCESS_TOKEN: ${{ secrets.ENV_MAPBOX_ACCESS_TOKEN }}
      ENV_MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.ENV_MAPBOX_DOWNLOAD_TOKEN }}

  call_web_workflow:
    name: "Web/Mapbox"
    uses: ./.github/workflows/web-actions.yml
    with:
      env_name: ${{ inputs.env_name }}
      ref: ${{ inputs.ref }}
      NVMRC: ${{ inputs.NVMRC }}
    secrets:
      MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN }}
      MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.MAPBOX_DOWNLOAD_TOKEN }}
      ENV_MAPBOX_ACCESS_TOKEN: ${{ secrets.ENV_MAPBOX_ACCESS_TOKEN }}
      ENV_MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.ENV_MAPBOX_DOWNLOAD_TOKEN }}


iOS Build & Detox

name: iOS Build & Detox

on:
  workflow_call:
    inputs:
      env_name:
        required: true
        default: default
        type: string
      ref:
        required: false
        type: string
      NVMRC:
        required: true
        type: string
      MAP_IMPL:
        description: "The map implementation to use (mapbox,mapbox11)"
        default: mapbox
        required: false
        type: string
      NEW_ARCH:
        description: "If build with new architecture or not"
        default: false
        required: false
        type: boolean
    secrets:
      MAPBOX_ACCESS_TOKEN:
        required: true
      MAPBOX_DOWNLOAD_TOKEN:
        required: true
      ENV_MAPBOX_ACCESS_TOKEN:
        required: false
      ENV_MAPBOX_DOWNLOAD_TOKEN:
        required: false

jobs:
  build:
    name: iOS Example Build ${{ inputs.NEW_ARCH && 'Fabric' || 'Paper' }} ${{ inputs.MAP_IMPL }}
    runs-on: macos-13
    timeout-minutes: 55
    environment: ${{ inputs.env_name }}

    defaults:
      run:
        working-directory: ./example

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        if: ${{ inputs.ref == '' }}

      - name: Checkout fork
        uses: actions/checkout@v4
        if: ${{ inputs.ref != '' }}
        with:
          ref: ${{ inputs.ref }}

      - name: Access Token
        run: echo $MAPBOX_ACCESS_TOKEN > ./accesstoken
        env:
          MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN || secrets.ENV_MAPBOX_ACCESS_TOKEN }}

      - name: Setup .netrc with MAPBOX_DOWNLOAD_TOKEN
        run: |
          echo 'machine api.mapbox.com' >> ~/.netrc
          echo 'login mapbox' >> ~/.netrc
          echo "password $MAPBOX_DOWNLOAD_TOKEN" >> ~/.netrc
          chmod 0600 ~/.netrc
        if: "${{ env.MAPBOX_DOWNLOAD_TOKEN != '' }}"
        env:
          MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.MAPBOX_DOWNLOAD_TOKEN || secrets.ENV_MAPBOX_DOWNLOAD_TOKEN }}

      - name: Setup node ${{ inputs.NVMRC }}
        uses: actions/setup-node@v3.5.1
        with:
          node-version: ${{ inputs.NVMRC }}

      - name: Cache node_modules
        uses: actions/cache@v3
        id: yarn-cache
        with:
          path: node_modules
          key: node-modules-${{ hashFiles('**/yarn.lock') }}

      - name: Install Yarn Dependencies
        if: steps.yarn-cache.outputs.cache-hit != 'true'
        run: yarn install --network-timeout 1000000

      - run: yarn postinstall
        working-directory: example

      - name: Cache Pods
        uses: actions/cache@v3
        id: pods-cache
        with:
          path: ios/Pods
          key: pods-${{ hashFiles('**/Podfile.lock') }}-${{ inputs.MAP_IMPL }}-${{ inputs.NEW_ARCH }}}

      - name: Check CocoaPods version
        id: cocoapods-version
        run: |
          pod --version > version.txt
          cat version.txt
          echo "version=$(cat version.txt)" >> $GITHUB_OUTPUT

      - name: Upgrade CocoaPods
        if: steps.cocoapods-version.outputs.version == '1.15.0'
        run: sudo gem install cocoapods -v 1.15.2

      - name: Install Pod Dependencies
        if: steps.pods-cache.outputs.cache-hit != 'true'
        run: cd ios && pod --version && pod update MapboxMaps hermes-engine RCT-Folly Turf SocketRocket && pod install
        env:
          CI_MAP_IMPL: ${{ inputs.MAP_IMPL }}
          RCT_NEW_ARCH_ENABLED: ${{ inputs.NEW_ARCH && 1 || 0 }}
          NO_FLIPPER: 1

      - name: Install Detox Dependencies
        run: |
          brew tap wix/brew
          brew install applesimutils
          brew install xcbeautify

      - name: Build for detox
        run: set -o pipefail && NSUnbufferedIO=YES  yarn detox build --configuration ios.debug.ci 2>&1

      - name: Test with detox
        if: inputs.NEW_ARCH != 1
        run: |
          npx detox --version
          yarn detox test --configuration ios.debug.ci --debug-synchronization 500 --loglevel trace --record-logs all --take-screenshots all  | xcbeautify -qq --renderer github-actions
        env:
          SKIP_TESTS_NO_METAL: ${{ inputs.MAP_IMPL == 'mapbox' || inputs.MAP_IMPL == 'mapbox11' }}

      - name: Store Detox artifacts on test failure
        uses: actions/upload-artifact@v3
        if: failure()
        with:
          name: detox-artifacts
          path: example/artifacts


Label Actions

# Configuration for Label Actions - https://github.com/dessant/label-actions

name: "Label Actions"

on:
  issues:
    types: labeled

permissions:
  contents: read
  issues: write

jobs:
  action:
    runs-on: ubuntu-latest
    steps:
      - uses: dessant/label-actions@v2


CI

name: CI
on:
  push:
    branches:
    - 'main'
    - 'v8'
    - 'v10.0'
  pull_request:

concurrency:
  group: ${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  lint_test_generate:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Read .nvmrc
        run: echo ::set-output name=NVMRC::$(cat .nvmrc)
        id: nvm

      - name: Setup node ${{ steps.nvm.outputs.NVMRC }}
        uses: actions/setup-node@v3.5.1
        with:
          node-version: ${{ steps.nvm.outputs.NVMRC }}

      - name: Install
        run: yarn install --network-timeout 1000000

      - name: Lint
        run: yarn lint

      - name: Type check
        run: yarn type:check

      - name: Example/install
        run: yarn install --ignore-scripts --network-timeout 1000000
        working-directory: example

      - name: Example type check
        run: yarn type:check
        working-directory: example

      - name: Test
        run: yarn unittest

      - name: Generate
        run: yarn generate

    outputs:
      NVMRC: ${{ steps.nvm.outputs.NVMRC }}

  has_mapbox_token:
    runs-on: ubuntu-latest
    outputs:
      has-mapbox-token: ${{ steps.has-mapbox-token.outputs.defined }}
    steps:
      - id: has-mapbox-token
        env:
          MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN }}
        if: "${{ env.MAPBOX_ACCESS_TOKEN != '' }}"
        run: echo "::set-output name=defined::true"

  call_ci_requiring_tokens:
    name: "CI requiring tokens"
    needs: [lint_test_generate,has_mapbox_token]
    uses: ./.github/workflows/ci-requiring-tokens.yml
    with:
      NVMRC: ${{ needs.lint_test_generate.outputs.NVMRC }}
    if: needs.has_mapbox_token.outputs.has-mapbox-token == 'true'
    secrets:
      MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN }}
      MAPBOX_DOWNLOAD_TOKEN: ${{ secrets.MAPBOX_DOWNLOAD_TOKEN }}

  publish:
    if: startsWith(github.ref, 'refs/tags/') && (github.event_name == 'push')
    needs: [lint_test_generate]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Setup node ${{ steps.nvm.outputs.NVMRC }}
        uses: actions/setup-node@v3.5.1
        with:
          node-version: ${{ needs.lint_test_generate.outputs.NVMRC }}
          registry-url: https://registry.npmjs.org/

      - name: Install and Publish
        run: npm install --force && npm publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}


Publish to NPM

name: Publish to NPM
on:
  release:
    types: [created]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Read .nvmrc
        run: echo ::set-output name=NVMRC::$(cat .nvmrc)
        id: nvm
      - name: Setup node ${{ steps.nvm.outputs.NVMRC }}
        uses: actions/setup-node@v3.5.1
        with:
          node-version: ${{ steps.nvm.outputs.NVMRC }}
          registry-url: https://registry.npmjs.org/
      - name: Setup Node
        uses: actions/setup-node@v3.5.1
        with:
          node-version: '14.x'
          registry-url: 'https://registry.npmjs.org'
      - name: Install dependencies and build 🔧
        run: npm install --force
      - name: Publish package on NPM 📦
        run: npm publish ${{ github.event.release.prerelease && '--tag next' || ''}}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN_RNMAPBOX }}


Update docs to maps-docs repo

name: Update docs to maps-docs repo

on:
  push:
    branches:
      - main

jobs:
  update_docs:
    name: Update docs on maps-docs repo
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: maps
    steps:
      - name: Install ImageMagick
        run: sudo apt-get install -y imagemagick
        working-directory: /
      - name: test convert
        run: convert -version
        working-directory: /
      - name: Checkout maps repo
        uses: actions/checkout@v4
        with:
          path: maps
      - name: Checkout maps-docs repo
        uses: actions/checkout@v4
        with:
          repository: rnmapbox/maps-docs
          ssh-key: ${{ secrets.MAPS_DOCS_DEPLOY_KEY }}
          path: maps-docs
      - uses: actions/setup-node@v4
        with:
          node-version: 18
      - uses: oven-sh/setup-bun@v1
        with:
          bun-version: latest
      - name: Install dependencies
        run: yarn install
      - name: Generate component docs into maps-docs repo
        run: node scripts/doc-generate.mjs
      - name: Generate example docs into maps-docs repo
        run: bun scripts/example-docs.ts
      - name: Generate example app into maps-docs repo
        run: |
          cd example
          echo $MAPBOX_WEB_ACCESS_TOKEN > accesstoken
          yarn install
          npx expo export -p web --output-dir ../../maps-docs/static/example-app
        working-directory: maps
        env:
          MAPBOX_WEB_ACCESS_TOKEN: ${{ secrets.MAPBOX_WEB_ACCESS_TOKEN }}
      - name: Setup deploy key for github deploy
        uses: webfactory/ssh-agent@v0.5.0
        with:
          ssh-private-key: ${{ secrets.MAPS_DOCS_DEPLOY_KEY }}
      - name: Add all changed files to git and push to origin main
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add .
          git commit -m "Update docs from maps  rnmapbox/maps@${GITHUB_SHA::7}"
          git push origin main
        working-directory: maps-docs
        env:
          GITHUB_SHA: ${{ github.sha }}


Web Build

name: Web Build

on:
  workflow_call:
    inputs:
      env_name:
        required: true
        default: default
        type: string
      ref:
        required: false
        type: string
      NVMRC:
        required: true
        type: string
    secrets:
      MAPBOX_ACCESS_TOKEN:
        required: true
      MAPBOX_DOWNLOAD_TOKEN:
        required: true
      ENV_MAPBOX_ACCESS_TOKEN:
        required: false
      ENV_MAPBOX_DOWNLOAD_TOKEN:
        required: false

jobs:
  build_example:
    name: Example Build for Web
    runs-on: ubuntu-latest
    environment: ${{ inputs.env_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        if: ${{ inputs.ref == '' }}

      - name: Checkout fork
        uses: actions/checkout@v4
        if: ${{ inputs.ref != '' }}
        with:
          ref: ${{ inputs.ref }}

      - name: Setup node ${{ inputs.NVMRC }}
        uses: actions/setup-node@v3.5.1
        with:
          node-version: ${{ inputs.NVMRC }}

      - run: echo $MAPBOX_ACCESS_TOKEN > ./accesstoken
        working-directory: example
        env:
          MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN || secrets.ENV_MAPBOX_ACCESS_TOKEN }}

      - run: yarn install --network-timeout 1000000
        working-directory: example

      - run: yarn postinstall
        working-directory: example

      - run: npx expo export --platform web
        working-directory: example


Android CI

# Copyright (C) 2020 The Android Open Source Project
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Android CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:

  build:
    name: Build
    runs-on: ubuntu-20.04

    steps:
      - uses: actions/checkout@v1
      - name: Set up JDK 17
        uses: actions/setup-java@v1
        with:
          java-version: 17
     #- name: Check Detekt
     #   run: chmod +x .github/scripts/gradlew_recursive.sh ; .github/scripts/gradlew_recursive.sh detekt
      - name: Build project
        run:  chmod +x .github/scripts/gradlew_recursive.sh ; .github/scripts/gradlew_recursive.sh assembleDebug
      - name: Zip artifacts
        run: zip -r assemble.zip . -i '**/build/*.apk' '**/build/*.aab' '**/build/*.aar' '**/build/*.so'
      - name: Upload artifacts
        uses: actions/upload-artifact@v1
        with:
          name: assemble
          path: assemble.zip
      - name: Adding markdown
        run: echo '### Hello world! :rocket:' >> $GITHUB_STEP_SUMMARY


CD

name: CD

on:
  push:
    tags:
      - '*'

jobs:
  publish:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        assets:
          # analysers:
          - analyser_diff_changes/build/libs/analyser_diff_changes*-all.jar
          - analyser_git/build/libs/analyser_git*-all.jar
          - analyser_sca/build/libs/analyser_sca*-all.jar
          - analyser_estimate/build/libs/analyser_estimate*-all.jar
          - analyser_openapi/build/libs/analyser_openapi*-all.jar
          # source code
          - analyser_sourcecode/feat_apicalls/build/libs/feat_apicalls*-all.jar
          - analyser_sourcecode/feat_datamap/build/libs/feat_datamap*-all.jar
          - analyser_sourcecode/lang_csharp/build/libs/lang_csharp*-all.jar
          - analyser_sourcecode/lang_golang/build/libs/lang_golang*-all.jar
          - analyser_sourcecode/lang_java/build/libs/lang_java*-all.jar
          - analyser_sourcecode/lang_kotlin/build/libs/lang_kotlin*-all.jar
          - analyser_sourcecode/lang_python/build/libs/lang_python*-all.jar
          - analyser_sourcecode/lang_scala/build/libs/lang_scala*-all.jar
          - analyser_sourcecode/lang_typescript/build/libs/lang_typescript*-all.jar
          - analyser_sourcecode/lang_c/build/libs/lang_c*-all.jar
          - analyser_sourcecode/lang_cpp/build/libs/lang_cpp*-all.jar
          - analyser_sourcecode/lang_rust/build/libs/lang_rust*-all.jar
          # cli:
          - scanner_cli/build/libs/scanner_cli*-all.jar
          # rules:
          - rule-linter/rule-sql/build/libs/rule-sql*-all.jar
          - rule-linter/rule-webapi/build/libs/rule-webapi*-all.jar
          - rule-linter/rule-test/build/libs/rule-test*-all.jar
          - rule-linter/rule-comment/build/libs/rule-comment*-all.jar
          # server:
          - server/build/libs/server*.jar

    permissions:
      contents: write
      packages: write
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-java@v2
        with:
          java-version: '11'
          distribution: 'adopt'

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2

      - name: Execute Gradle build
        run: ./gradlew build -x test

      - name: Upload assets to release
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: ${{ matrix.assets }}
          tag: ${{ github.ref }}
          overwrite: true
          file_glob: true


CI

name: CI

on: [ push ]

jobs:
  build:
    strategy:
      matrix:
        os: [ macos-latest, ubuntu-latest, windows-latest ]
    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-java@v3
        with:
          distribution: 'zulu'
          java-version: '11'

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2

      - name: Execute Gradle build
        run: ./gradlew build

      - name: Execute Gradle Coverage
        run: ./gradlew check

      - name: Execute Gradle Coverage
        if: runner.os == 'macOS'
        uses: codecov/codecov-action@v3
        with:
          token: ${{ secrets.CODECOV_TOKEN }}


Docker CD

name: Docker CD

on:
  push:
    tags:
      - '*'

jobs:
  publish:
    runs-on: ubuntu-latest

    permissions:
      contents: write
      packages: write
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-java@v2
        with:
          java-version: '11'
          distribution: 'adopt'

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2

      - name: Execute Gradle build
        run: ./gradlew build -x test

      - name: Log in to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: archguard/archguard-backend

      - name: Build and push Docker image
        uses: docker/build-push-action@v3
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}


Linter

name: Linter

on:
  push:
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-java@v3
        with:
          distribution: 'zulu'
          java-version: '11'

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2

      - name: Execute Gradle build
        run: ./gradlew ktlintCheck


Android Test

name: Android Test

on:
  workflow_dispatch:

jobs:
  test:
    runs-on: macos-latest
    timeout-minutes: 50

    strategy:
      # Allow tests to continue on other devices if they fail on one device.
      fail-fast: false
      matrix:
        api-level: [ 30, 33 ]

    env:
      TERM: dumb

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          lfs: 'true'

      - name: Install pulseaudio
        run: brew install pulseaudio

      - name: Copy CI gradle.properties
        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 17

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v3

      - name: Run tests
        uses: reactivecircus/android-emulator-runner@v2
        with:
          api-level: ${{ matrix.api-level }}
          target: android-wear
          profile: wearos_large_round
          channel: beta
          arch: ${{ matrix.api-level == 33 && 'x86_64' || 'x86' }}
          emulator-options: -no-window -no-snapshot
          script: ./gradlew connectedDebugAndroidTest -Pandroid.testInstrumentationRunnerArguments.androidx.benchmark.enabledRules=Microbenchmark -x media:benchmark:connectedDebugAndroidTest

      - name: Upload logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: logs-${{ matrix.api-level }}-${{ matrix.shard }}
          path: logcat.txt

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results-${{ matrix.api-level }}-${{ matrix.shard }}
          path: |
            **/build/reports/*
            **/build/outputs/*/connected/*
            **/out/failures/


Build & test

name: Build & test

on:
  push:
    branches:
      - main
      - release-0.1.x
    paths-ignore:
      - '**.md'
  pull_request:
  workflow_dispatch:

jobs:
  build:
    # Skip build if head commit contains 'skip ci'
    if: "!contains(github.event.head_commit.message, 'skip ci')"

    runs-on: ubuntu-latest
    timeout-minutes: 40

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          lfs: 'true'

      - name: Copy CI gradle.properties
        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 17

      - name: Unit Tests
        uses: gradle/gradle-build-action@v3
        with:
          arguments: testDebug -Dtest.excludeCategories=com.google.android.horologist.screenshots.rng.ScreenshotTest

      - name: test-results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: build-results
          path: |
            **/build/test-results/*
            **/build/reports/*
            **/out/*

  screenshot1:
    # Skip build if head commit contains 'skip ci'
    if: "!contains(github.event.head_commit.message, 'skip ci')"

    runs-on: ubuntu-latest
    timeout-minutes: 40

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          lfs: 'true'

      - name: Copy CI gradle.properties
        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 17

      - name: Unit Tests
        uses: gradle/gradle-build-action@v3
        id: screenshotsverify
        with:
          arguments: --no-daemon verifyRoborazziDebug -x composables:verifyRoborazziDebug -x sample:verifyRoborazziDebug

      - name: screenshot-test-results-1
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: screenshot-results-1
          path: |
            **/build/test-results/*
            **/build/reports/*
            **/build/outputs/roborazzi/*
            **/out/*

  screenshot2:
    # Skip build if head commit contains 'skip ci'
    if: "!contains(github.event.head_commit.message, 'skip ci')"

    runs-on: ubuntu-latest
    timeout-minutes: 40

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          lfs: 'true'

      - name: Copy CI gradle.properties
        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 17

      - name: Unit Tests 2
        uses: gradle/gradle-build-action@v3
        id: screenshotsverify2
        with:
          arguments: --no-daemon composables:verifyRoborazziDebug sample:verifyRoborazziDebug

      - name: screenshot-test-results-2
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: screenshot-results-2
          path: |
            **/build/test-results/*
            **/build/reports/*
            **/build/outputs/roborazzi/*
            **/out/*

  compiletests:
    # Skip build if head commit contains 'skip ci'
    if: "!contains(github.event.head_commit.message, 'skip ci')"

    runs-on: ubuntu-latest
    timeout-minutes: 50

    env:
      TERM: dumb

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          lfs: 'true'

      - name: Copy CI gradle.properties
        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 17

      - name: Compile tests
        uses: gradle/gradle-build-action@v3
        with:
          arguments: -Pstrict.build=true compileDebugAndroidTestSources

  verify:
    # Skip build if head commit contains 'skip ci'
    if: "!contains(github.event.head_commit.message, 'skip ci')"

    runs-on: ubuntu-latest
    timeout-minutes: 40

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          lfs: 'true'

      - name: Copy CI gradle.properties
        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 17

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v3

      - name: Check GIT lfs images
        run: |
          ./scripts/git-lfs-check.sh

      - name: Metalava compatibility check
        uses: gradle/gradle-build-action@v3
        with:
          arguments: --stacktrace
            metalavaCheckCompatibility metalavaCheckCompatibilityRelease

      - name: Code analysis
        uses: gradle/gradle-build-action@v3
        with:
          arguments: --stacktrace
            spotlessCheck
            lintDebug

      - name: Dependencies analysis
        uses: gradle/gradle-build-action@v3
        if: ${{ false }} # Disabled until -android supported https://github.com/google/horologist/issues/1314
        with:
          arguments: --stacktrace
            projectHealth


Build & test (nightly release)

name: Build & test (nightly release)

on:
  schedule:
    - cron: '0 2 * * *' # 2am UTC
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 40

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          lfs: 'true'

      - name: Copy CI gradle.properties
        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 17

      - name: Generate cache key
        run: ./checksum.sh checksum.txt

      - uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches/modules-*
            ~/.gradle/caches/jars-*
            ~/.gradle/caches/build-cache-*
          key: gradle-${{ hashFiles('checksum.txt') }}

      - name: Build (Release)
        run: |
          ./gradlew --scan --stacktrace \
              assembleRelease

      - name: Code analysis
        run: |
          ./gradlew --scan --stacktrace \
              lintRelease

      - name: Upload test results and reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: build-results
          path: |
            **/build/test-results/*
            **/build/reports/*

      - name: Upload apks
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: apks
          path: |
            **/build/outputs/apk/release/*.apk


Fixups

name: Fixups

on:
  workflow_dispatch:

jobs:
  fixes:
    runs-on: ubuntu-latest
    timeout-minutes: 40

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          lfs: 'true'

      - name: Copy CI gradle.properties
        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 17

      - name: Reformat
        uses: gradle/gradle-build-action@v3
        with:
          arguments: spotlessApply

      - name: Push reformatted code
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          file_pattern: '**/*.kt'
          disable_globbing: true
          commit_message: "🤖 reformat"

      - name: Generate APIs
        uses: gradle/gradle-build-action@v3
        with:
          arguments: metalavaGenerateSignature metalavaGenerateSignatureDebug

      - name: Push new apis
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          file_pattern: '**/current.api'
          disable_globbing: true
          commit_message: "🤖 metalava"

      - name: Repair screenshots
        uses: gradle/gradle-build-action@v3
        with:
          arguments: verifyAndRecordRoborazziDebug

      - name: Push new screenshots if available
        uses: stefanzweifel/git-auto-commit-action@v5
        if: ${{ always() }}
        with:
          file_pattern: '**/snapshots/images/*.png **/screenshots/*.png'
          disable_globbing: true
          commit_message: "🤖 Updates screenshots"


Macrobenchmark

name: Macrobenchmark

on: workflow_dispatch

jobs:
  macrobenchmark:
    runs-on: macos-latest
    timeout-minutes: 50

    env:
      TERM: dumb

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          lfs: 'true'

      - name: Copy CI gradle.properties
        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 17

      - name: Generate cache key
        run: ./checksum.sh checksum.txt

      - uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches/modules-*
            ~/.gradle/caches/jars-*
            ~/.gradle/caches/build-cache-*
          key: gradle-${{ hashFiles('checksum.txt') }}

      - name: Run tests
        uses: reactivecircus/android-emulator-runner@v2
        with:
          api-level: 30
          target: android-wear
          profile: wear_round_454
          script: |
            adb root
            ./gradlew connectedCheck "-Pandroid.testInstrumentationRunnerArguments.androidx.benchmark.enabledRules=Macrobenchmark" "-Pandroid.testInstrumentationRunnerArguments.androidx.benchmark.dryRunMode.enable=true"

      - name: Upload logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: logs-${{ matrix.api-level }}-${{ matrix.shard }}
          path: logcat.txt

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results-${{ matrix.api-level }}-${{ matrix.shard }}
          path: |
            **/build/reports/*
            **/build/outputs/*/connected/*


Publish docs

name: Publish docs

on:
  push:
    tags:
      - v0.6.*
  workflow_dispatch:

jobs:
  deploy_docs:
    runs-on: ubuntu-latest
    env:
      TERM: dumb

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          lfs: 'true'

      - name: Copy CI gradle.properties
        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 17

      - name: Generate cache key
        run: ./checksum.sh checksum.txt

      - uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches/modules-*
            ~/.gradle/caches/jars-*
            ~/.gradle/caches/build-cache-*
          key: gradle-${{ hashFiles('checksum.txt') }}

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Install dependencies
        run: |
          python3 -m pip install --upgrade pip
          python3 -m pip install mkdocs
          python3 -m pip install mkdocs-material
      - name: Generate docs
        run: ./generate_docs.sh

      - name: Build site
        run: mkdocs build

      - name: Deploy
        uses: peaceiris/actions-gh-pages@v4
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: ./site


CI

name: CI

on:
  # Only run push on main
  push:
    branches:
      - main
    paths-ignore:
      - '**/*.md'
  # Always run on PRs
  pull_request:
    branches: [ main ]
  merge_group:

concurrency:
  group: 'ci-${{ github.event.merge_group.head_ref || github.head_ref }}-${{ github.workflow }}'
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Gradle Wrapper Validation
        uses: gradle/actions/wrapper-validation@v3

      - name: Export JDK version
        shell: bash
        run: |
          JDK_VERSION=$(grep "jdk =" gradle/libs.versions.toml | head -n 1 | cut -d'=' -f2 | tr -d '"' | xargs)
          echo "JDK_VERSION=${JDK_VERSION}" >> $GITHUB_ENV

      - name: Install JDK ${{ env.JDK_VERSION }}
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '${{ env.JDK_VERSION }}'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v3

      - name: Build and run tests
        id: gradle
        run: ./gradlew check

      - name: Print build scan url
        if: always()
        run: echo ${{ steps.gradle.outputs.build-scan-url }}

      - name: (Fail-only) Upload build reports
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: reports
          path: |
            **/build/reports/**

  publish-snapshot:
    name: 'Publish snapshot (main only)'
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    needs: 'build'
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Export JDK version
        shell: bash
        run: |
          JDK_VERSION=$(grep "jdk =" gradle/libs.versions.toml | head -n 1 | cut -d'=' -f2 | tr -d '"' | xargs)
          echo "JDK_VERSION=${JDK_VERSION}" >> $GITHUB_ENV

      - name: Install JDK ${{ env.JDK_VERSION }}
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '${{ env.JDK_VERSION }}'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v3

      - name: Publish snapshot
        if: github.repository == 'slackhq/slack-gradle-plugin'
        run: ./gradlew publish -PmavenCentralUsername=${{ secrets.SONATYPEUSERNAME }} -PmavenCentralPassword=${{ secrets.SONATYPEPASSWORD }} -x dokkaHtml --no-configuration-cache


Code Review

# This workflow triggers a code review using the OpenAI GPT-3.5 Turbo model with a 16k context window
name: Code Review

on:
  pull_request:
    types:
      - opened

jobs:
  code-review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    if: ${{ github.actor != 'slack-oss-bot' }}
    steps:
      - name: Trigger code review
        uses: fxchen/code-review@v0.2.9-alpha
        with:
          model: 'gpt-3.5-turbo-16k'
          openai-key: ${{ secrets.OPENAI_API_KEY }}


Publish docs

name: Publish docs

on:
  # Run on new version tags...
  push:
    tags:
      - v*
  # or manually from workflow dispatch (from GitHub UI)
  workflow_dispatch:

jobs:
  deploy_docs:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Gradle Wrapper Validation
        uses: gradle/actions/wrapper-validation@v3

      - name: Install JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '20'

      - name: Build Dokka API docs
        uses: gradle/gradle-build-action@v3
        with:
          arguments: dokkaHtml --no-configuration-cache

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Install python dependencies
        run: |
          python3 -m pip install --upgrade pip
          python3 -m pip install -r .github/workflows/mkdocs-requirements.txt

      - name: Build site
        run: ./deploy_website.sh --ci

      - name: Deploy site
        uses: peaceiris/actions-gh-pages@v4
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: ./site


Renovate

name: Renovate

on:
  schedule:
    - cron: "0 8 * * *" # 8am daily
  workflow_dispatch:

jobs:
  renovate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Self-hosted Renovate
        uses: renovatebot/github-action@v39.0.1
        with:
          configurationFile: renovate.json
          token: ${{ secrets.SLACKHQ_MBR_GITHUB_TOKEN }}


Publish Assets

name: Publish Assets

on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest

    permissions:
      contents: write  # for Git to git push

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: 'maven'

      - name: Build app
        run: ./mvnw --batch-mode clean deploy

      - name: setup git config
        run: |
          git config user.name "GitHub Actions Bot"
          git config user.email "<>"

      - name: Publish maven assets
        run: |
          ls
          rsync -r ./*/target/mvn-repo ./target/mvn-repo /tmp/
          git checkout --orphan maven || git checkout maven
          git reset .
          rm -r mvn-repo || true
          cp -r /tmp/mvn-repo ./
          ls
          git add mvn-repo
          git commit -a -m "add artifacts"
          git push origin maven


CI

name: CI

on:
  pull_request:
    branches: [ main, production ]
  push:
    branches: [ main, production ]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        ecosystem: [adoptium, adoptopenjdk]

    steps:
    - name: Setup mvnw arguments
      run: |
        case ${{ matrix.ecosystem }} in
          adoptium) echo "ARGS=-Padoptium,-adoptopenjdk" >> $GITHUB_ENV ;;
          adoptopenjdk) echo "ARGS=-Padoptopenjdk,-adoptium" >> $GITHUB_ENV ;;
        esac

    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      with:
        persist-credentials: false

    - uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
      with:
        java-version: '21'
        distribution: 'temurin'
        cache: 'maven'

    - name: Build app
      run: ./mvnw --batch-mode clean install ${{ env.ARGS }}


Docker Build (Adoptium)

name: Docker Build (Adoptium)

on:
  workflow_dispatch:
  push:
   branches: [ main, production ]

permissions:
  id-token: write
  contents: read

jobs:
  docker-build:
    if: startsWith(github.repository, 'adoptium/')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Login to Azure
        uses: ./.github/actions/azure-login
        with:
          AZURE_CLIENT_ID_OIDC: ${{ secrets.AZURE_CLIENT_ID_OIDC }}
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}

      - name: Detect Branch
        run: |
          case ${GITHUB_REF##*/} in
            production) echo "NAMESPACE=api" >> $GITHUB_ENV ;;
            *) echo "NAMESPACE=api-staging" >> $GITHUB_ENV ;;
          esac

      - name: Build container image and push to Azure
        uses: ./.github/actions/docker-build
        with:
          DOCKER_REPO: adoptopenjdkacr.azurecr.io/adoptopenjdk-${{ env.NAMESPACE }}
          DOCKER_FILE: ./deploy/Dockerfile

      - name: Redeploy Kubernetes Updater and Frontend
        uses: ./.github/actions/kubectl-redeploy
        with:
          NAMESPACE: ${{ env.NAMESPACE }}


Docker Build (AdoptOpenJDK)

name: Docker Build (AdoptOpenJDK)

on:
  workflow_dispatch:
  push:
   branches: [ main, production ]

permissions:
  id-token: write
  contents: read

jobs:
  docker-build:
    if: startsWith(github.repository, 'adoptium/')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Login to Azure
        uses: ./.github/actions/azure-login
        with:
          AZURE_CLIENT_ID_OIDC: ${{ secrets.AZURE_CLIENT_ID_OIDC }}
          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}

      - name: Detect Branch
        run: |
          case ${GITHUB_REF##*/} in
            production) echo "NAMESPACE=adoptopenjdk-alt" >> $GITHUB_ENV ;;
            *) echo "NAMESPACE=adoptopenjdk-alt-staging" >> $GITHUB_ENV ;;
          esac

      - name: Build container image and push to Azure
        uses: ./.github/actions/docker-build
        with:
          DOCKER_REPO: adoptopenjdkacr.azurecr.io/azure-${{ env.NAMESPACE }}
          DOCKER_FILE: ./deploy/Dockerfile
          BUILD_ARGS: MAVEN_FLAGS="-Padoptopenjdk,-adoptium"

      - name: Redeploy Kubernetes Updater and Frontend
        uses: ./.github/actions/kubectl-redeploy
        with:
          NAMESPACE: ${{ env.NAMESPACE }}

      # if the branch is production, redeploy the k8s service on digitalocean too
      - name: Login to DigitalOcean
        uses: ./.github/actions/do-login
        with:
          DIGITALOCEAN_ACCESS_TOKEN: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}

      - name: Redeploy Kubernetes Updater and Frontend
        if: startsWith(github.ref, 'refs/heads/production')
        uses: ./.github/actions/kubectl-redeploy
        with:
          NAMESPACE: adoptopenjdk-do


CodeQL

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
name: "CodeQL"

on:
  push:
    branches: [ "main", "production" ]
  pull_request:
    branches: [ "main", "production" ]
  schedule:
    - cron: '26 5 * * 0'

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: java-kotlin
            build-mode: manual
            # Learn more about CodeQL language support at https://git.io/codeql-language-support

    steps:
    - name: Checkout repository
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@23acc5c183826b7a8a97bce3cecc52db901f8251 # v3.25.10
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    - uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
      with:
        java-version: '21'
        distribution: 'temurin'
        cache: 'maven'

    - if: matrix.build-mode == 'manual'
      run: |
        ./mvnw --batch-mode clean install -Padoptium,-adoptopenjdk

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@23acc5c183826b7a8a97bce3cecc52db901f8251 # v3.25.10
      with:
        category: "/language:${{matrix.language}}"


Semgrep Differential Scan

# ********************************************************************************
# Copyright (c) 2024 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made
# available under the terms of the Apache Software License 2.0
# which is available at https://www.apache.org/licenses/LICENSE-2.0.
#
# SPDX-License-Identifier: Apache-2.0
# ********************************************************************************

---
name: Semgrep Differential Scan
on:
  pull_request:

permissions:
  contents: read
  statuses: write

jobs:
  semgrep-diff:
    uses: adoptium/.github/.github/workflows/semgrep_diff.yml@main


JDK 11 CI

name: JDK 11 CI

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 11
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '11'

      - name: Cache local Maven repository
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-

      - name: Build with Maven
        run: mvn verify -Pfull-smt --file pom.xml -s .github/github-settings.xml
        env:
          GITHUB_ACTOR: vorpal-reseacher
          GITHUB_TOKEN: ${{ secrets.ORG_GITHUB_TOKEN }}


JDK 17 CI

name: JDK 17 CI

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '17'

      - name: Cache local Maven repository
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-

      - name: Build with Maven
        run: mvn verify -Pfull-smt --file pom.xml -s .github/github-settings.xml
        env:
          GITHUB_ACTOR: vorpal-reseacher
          GITHUB_TOKEN: ${{ secrets.ORG_GITHUB_TOKEN }}


Java CD

name: Java CD

on:
  release:
    types: [ published ]

jobs:
  publish:

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 1.8
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '8'

      - name: Cache local Maven repository
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-

      - name: Build sources
        id: build
        run: |
          mvn versions:set -DnewVersion=${{ github.event.release.tag_name }}
          mvn package --file pom.xml -s .github/github-settings.xml

      - name: Clean temporary files after the tests
        run: rm -rf test-temp/

      - name: Create zip archive with the release
        run: zip release.zip ./* -r

      - name: Attach zip archive to the release
        id: upload-source-asset
        uses: actions/upload-release-asset@v1.0.1
        env:
          GITHUB_TOKEN: ${{ github.token }}
        with:
          upload_url: ${{ github.event.release.upload_url }}
          asset_path: release.zip
          asset_name: ${{ github.event.repository.name }}-${{ github.event.release.tag_name }}.zip
          asset_content_type: application/zip


JDK 8 CI

name: JDK 8 CI

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 1.8
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '8'

      - name: Cache local Maven repository
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-

      - name: Build with Maven
        run: mvn verify -Pfull-smt --file pom.xml -s .github/github-settings.xml
        env:
          GITHUB_ACTOR: vorpal-reseacher
          GITHUB_TOKEN: ${{ secrets.ORG_GITHUB_TOKEN }}


🔧 Build main branch and PRs

name: 🔧 Build main branch and PRs

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
    types: [opened, synchronize, reopened]

jobs:
  build:

    runs-on: macos-latest

    steps:
    - uses: actions/checkout@v4
    - name: set up JDK 17
      uses: actions/setup-java@v4
      with:
        java-version: '17'
        distribution: 'adopt'
        cache: gradle
    - name: Cache SonarCloud packages
      uses: actions/cache@v4
      with:
        path: ~/.sonar/cache
        key: ${{ runner.os }}-sonar
        restore-keys: ${{ runner.os }}-sonar
    - name: Cache Gradle packages
      uses: actions/cache@v4
      with:
        path: ~/.gradle/caches
        key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
        restore-keys: ${{ runner.os }}-gradle
    - name: Grant execute permission for gradlew
      run: chmod +x gradlew
    - name: Create local properties
      run: touch local.properties
    - name: Copy mock google services
      run: cp mock-google-services.json app/google-services.json
    - name: Setup Android SDK
      uses: android-actions/setup-android@v3
    - name: Build with Gradle
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        MAPBOX_DOWNLOADS_TOKEN: ${{ secrets.MAPBOX_DOWNLOADS_TOKEN }}
      run: ./gradlew test assembleDebug # sonarqube
#    - name: run tests
#      uses: reactivecircus/android-emulator-runner@v2
#      with:
#        api-level: 30
#        arch: x86
#        script: ./gradlew connectedCheck
    - name: Archive apk
      uses: actions/upload-artifact@v4
      with:
        name: apk
        path: |
          app/build/outputs/apk/debug


🚀 Build release

name: 🚀 Build release

on:
  push:
    tags:
      - v**

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4
    - name: set up JDK 17
      uses: actions/setup-java@v4
      with:
        java-version: '17'
        distribution: 'adopt'
        cache: gradle

    - name: Set up ruby env
      uses: ruby/setup-ruby@v1
      with:
        ruby-version: 2.7.2
        bundler-cache: true

    - name: Decode Service Account Key JSON File
      uses: timheuer/base64-to-file@v1
      id: service_account_json_file
      with:
        fileName: "serviceAccount.json"
        encodedString: ${{ secrets.GOOGLE_JSON }}

    - name: Grant execute permission for gradlew
      run: chmod +x gradlew

    - name: Create local properties
      run: touch local.properties

    - name: Decode Keystore
      env:
        ENCODED_STRING: ${{ secrets.KEYSTORE }}
      run: |
        mkdir app/keystore
        echo $ENCODED_STRING | base64 -di > app/keystore/keystore.jks
    - name: Decode Google Services json
      env:
        ENCODED_STRING: ${{ secrets.GOOGLE_SERVICES }}
      run: |
        echo $ENCODED_STRING | base64 -di > app/google-services.json

    - name: Setup Android SDK
      uses: android-actions/setup-android@v3

    - name: Build & deploy Android release
      run: bundle exec fastlane android deploy
      env:
        BUGSNAG_API_KEY: ${{ secrets.BUGSNAG_API_KEY }}
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        KEYSTORE_PASS: ${{ secrets.KEYSTORE_PASS }}
        KEYSTORE_ALIAS: ${{ secrets.KEYSTORE_ALIAS }}
        MAPBOX_DOWNLOADS_TOKEN: ${{ secrets.MAPBOX_DOWNLOADS_TOKEN }}
        MAPBOX_API_KEY: ${{ secrets.MAPBOX_API_KEY }}
        MAPS_API_KEY: ${{ secrets.MAPS_API_KEY }}
        MAPLIBRE_API_KEY: ${{ secrets.MAPLIBRE_API_KEY }}
        ANDROID_JSON_KEY_FILE: ${{ steps.service_account_json_file.outputs.filePath }}

#    - name: Build with Gradle
#      run: ./gradlew app:bundleRelease
#      env:
#        KEYSTORE_PASS: ${{ secrets.KEYSTORE_PASS }}
#        KEYSTORE_ALIAS: ${{ secrets.KEYSTORE_ALIAS }}
#        MAPBOX_DOWNLOADS_TOKEN: ${{ secrets.MAPBOX_DOWNLOADS_TOKEN }}
#
    - name: Archive extra files
      uses: actions/upload-artifact@v3
      if: always()
      with:
        name: bundle
        path: |
          app/build/outputs/mapping/release/missing_rules.txt
          app/build/outputs/mapping/**