android-release-artifacts.yml

name: Android Release Artifacts

on:
  workflow_call:
    inputs:
      version:
        description: Version name to be uploaded for AAR release
        required: false
        type: string
        default: ''
      upload_to_maven:
        description: Upload the AAR to Maven Central for manual review
        required: false
        type: boolean
        default: false
      source_ref:
        description: Git ref or SHA to build; defaults to the workflow commit
        required: false
        type: string
        default: ''
      flavor:
        description: Build flavor
        required: false
        type: string
        default: 'xnnpack'
  workflow_dispatch:
    inputs:
      version:
        description: Version name to be uploaded for AAR release
        required: false
        type: string
      upload_to_maven:
        description: Upload the AAR to Maven Central for manual review
        required: false
        type: boolean
      source_ref:
        description: Git ref or SHA to build; defaults to the workflow commit
        required: false
        type: string
      flavor:
        type: choice
        options:
          - "xnnpack"
          - "xnnpack-no-sme2"
          - "vulkan"
          - "qnn"
          - "all"
  schedule:
    - cron: 0 10 * * *

jobs:
  docker-image:
    name: Resolve CI docker image
    uses: ./.github/workflows/_docker-image.yml

  check-if-aar-exists:
    name: check-if-aar-exists
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    outputs:
      aar-exists: ${{ steps.check.outputs.aar-exists }}
      should-skip: ${{ steps.check.outputs.should-skip }}
    steps:
      - name: Check if this RC version is already in S3
        id: check
        shell: bash
        run: |
          VERSION="${{ inputs.version }}"
          FLAVOR="${{ inputs.flavor }}"
          UPLOAD_TO_MAVEN="${{ inputs.upload_to_maven }}"
          if [ -z "$FLAVOR" ]; then
            FLAVOR="xnnpack"
          fi
          if [[ "$UPLOAD_TO_MAVEN" == "true" && -z "$VERSION" ]]; then
            echo "A version is required when publishing to Maven Central"
            exit 1
          fi
          if [ -z "$VERSION" ]; then
            echo "No version name specified. Will create a snapshot AAR"
            echo "aar-exists=false" >> $GITHUB_OUTPUT
            echo "should-skip=false" >> $GITHUB_OUTPUT
            exit 0
          fi
          if curl -I "https://ossci-android.s3.amazonaws.com/executorch/release/${VERSION}-${FLAVOR}/executorch.aar" | grep "200 OK"; then
            echo "AAR already exists at https://ossci-android.s3.amazonaws.com/executorch/release/${VERSION}-${FLAVOR}/executorch.aar"
            echo "aar-exists=true" >> $GITHUB_OUTPUT
            if [[ "$UPLOAD_TO_MAVEN" == "true" ]]; then
              echo "Maven publishing requested. Will rebuild without replacing the S3 artifact"
              echo "should-skip=false" >> $GITHUB_OUTPUT
            else
              echo "Will skip build/upload"
              echo "should-skip=true" >> $GITHUB_OUTPUT
            fi
          else
            echo "aar-exists=false" >> $GITHUB_OUTPUT
            echo "should-skip=false" >> $GITHUB_OUTPUT
          fi

  build-aar:
    name: build-aar
    needs: [docker-image, check-if-aar-exists]
    if: ${{ !github.event.pull_request.head.repo.fork && needs.check-if-aar-exists.outputs.should-skip != 'true' }}
    uses: pytorch/test-infra/.github/workflows/linux_job_v3.yml@main
    secrets: inherit
    permissions:
      id-token: write
      contents: read
    with:
      secrets-env: EXECUTORCH_MAVEN_SIGNING_KEYID EXECUTORCH_MAVEN_SIGNING_PASSWORD EXECUTORCH_MAVEN_CENTRAL_PASSWORD EXECUTORCH_MAVEN_CENTRAL_USERNAME EXECUTORCH_MAVEN_SIGNING_GPG_KEY_CONTENTS
      docker-image: ${{ needs.docker-image.outputs.docker-registry }}/ci-image:executorch-ubuntu-22.04-clang12-android-${{ needs.docker-image.outputs.ci-docker-hash }}
      submodules: 'recursive'
      ref: ${{ inputs.source_ref || github.sha }}
      timeout: 90
      upload-artifact: android-apps
      upload-artifact-to-s3: true
      script: |
        set -eux

        # Use sccache for NDK compiler as well
        export CMAKE_CXX_COMPILER_LAUNCHER=sccache
        export CMAKE_C_COMPILER_LAUNCHER=sccache

        # The Android image already contains the build dependencies and pinned PyTorch.
        CONDA_ENV=$(conda env list --json | jq -r ".envs | .[-1]")
        conda activate "${CONDA_ENV}"
        export ARTIFACTS_DIR_NAME=artifacts-to-be-uploaded

        mkdir -p ~/.gradle
        touch ~/.gradle/gradle.properties
        echo "signing.keyId=${SECRET_EXECUTORCH_MAVEN_SIGNING_KEYID}" >> ~/.gradle/gradle.properties
        echo "signing.password=${SECRET_EXECUTORCH_MAVEN_SIGNING_PASSWORD}" >> ~/.gradle/gradle.properties
        echo "mavenCentralUsername=${SECRET_EXECUTORCH_MAVEN_CENTRAL_USERNAME}" >> ~/.gradle/gradle.properties
        echo "mavenCentralPassword=${SECRET_EXECUTORCH_MAVEN_CENTRAL_PASSWORD}" >> ~/.gradle/gradle.properties
        echo "signing.secretKeyRingFile=/tmp/secring.gpg" >> ~/.gradle/gradle.properties

        echo -n "$SECRET_EXECUTORCH_MAVEN_SIGNING_GPG_KEY_CONTENTS" | base64 -d > /tmp/secring.gpg

        GRADLE_ARGS=""

        # Update the version name in build.gradle in case of maven publish
        VERSION="${{ inputs.version }}"
        if [ ! -z "$VERSION" ]; then
          GRADLE_ARGS+=" -DexecuTorchVersion=${VERSION}"
        fi

        FLAVOR="${{ inputs.flavor }}"
        if [ -z "$FLAVOR" ]; then
          FLAVOR="xnnpack"
        fi
        GRADLE_ARGS+=" -Dflavor=${FLAVOR}"

        if [[ "$FLAVOR" == "vulkan" || "$FLAVOR" == "all" || -z "$FLAVOR" ]]; then
          curl -O https://sdk.lunarg.com/sdk/download/1.4.321.1/linux/vulkansdk-linux-x86_64-1.4.321.1.tar.xz
          tar xf vulkansdk-linux-x86_64-1.4.321.1.tar.xz -C /tmp
          export PATH="/tmp/1.4.321.1/x86_64/bin:$PATH"
          export EXECUTORCH_BUILD_VULKAN=ON
        fi

        if [[ "$FLAVOR" == "xnnpack-no-sme2" ]]; then
          export XNNPACK_ENABLE_ARM_SME2=OFF
        fi

        if [[ "$FLAVOR" == "qnn" || "$FLAVOR" == "all" ]]; then
          PYTHON_EXECUTABLE=python bash .ci/scripts/setup-qnn-deps.sh
          # build_android_library.sh builds the QNN runtime included in the AAR;
          # the host-only PyQnnManagerAdaptor is not part of this artifact.
          export EXECUTORCH_BUILD_QNN=ON
          source backends/qualcomm/scripts/qnn_config.sh
          export QNN_SDK_ROOT="/tmp/qnn/${QNN_VERSION}"
          export ANDROID_ABIS=arm64-v8a
          GRADLE_ARGS+=" -DqnnVersion=2.50.0"
        fi

        # Build AAR Package
        mkdir aar-out
        export BUILD_AAR_DIR=aar-out
        bash scripts/build_android_library.sh
        mkdir -p "${ARTIFACTS_DIR_NAME}"
        cp aar-out/executorch.aar "${ARTIFACTS_DIR_NAME}/executorch-${FLAVOR}.aar"

        shasum -a 256 "${ARTIFACTS_DIR_NAME}/executorch-${FLAVOR}.aar"

        # Upload a deployment to Maven Central. A release owner reviews and
        # publishes it manually in the Central Portal.
        UPLOAD_TO_MAVEN="${{ inputs.upload_to_maven }}"
        if [[ "$UPLOAD_TO_MAVEN" == "true" ]]; then
          (cd extension/android; ANDROID_HOME="${ANDROID_SDK:-/opt/android/sdk}" ./gradlew --no-daemon --console=plain ${GRADLE_ARGS} :executorch_android:publishToMavenCentral)
          {
            echo "### Maven Central deployment uploaded"
            echo
            echo "Review and publish the deployment in the [Central Portal](https://central.sonatype.com/publishing/deployments)."
          } >> "$GITHUB_STEP_SUMMARY"
        fi

  upload-release-aar:
    name: upload-release-aar
    needs: [check-if-aar-exists, build-aar]
    if: ${{ needs.check-if-aar-exists.outputs.aar-exists != 'true' }}
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    permissions:
      id-token: write
      contents: read
    steps:
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::308535385114:role/gha_executorch_upload-frameworks-android
          aws-region: us-east-1
      - name: Upload AAR RC to AWS S3
        shell: bash
        run: |
          VERSION="${{ inputs.version }}"
          FLAVOR="${{ inputs.flavor }}"
          if [ -z "$VERSION" ]; then
            VERSION="snapshot-$(date +"%Y%m%d")"
          fi
          if [ -z "$FLAVOR" ]; then
            FLAVOR="xnnpack"
          fi
          wget https://gha-artifacts.s3.amazonaws.com/${{ github.repository }}/${{ github.run_id }}/artifacts/executorch-${FLAVOR}.aar
          mv executorch-${FLAVOR}.aar executorch.aar
          shasum -a 256 executorch.aar > executorch.aar.sha256sums

          pip install awscli==1.32.18
          AWS_CMD="aws s3 cp"
          ${AWS_CMD} executorch.aar s3://ossci-android/executorch/release/${VERSION}-${FLAVOR}/executorch.aar --acl public-read
          ${AWS_CMD} executorch.aar.sha256sums s3://ossci-android/executorch/release/${VERSION}-${FLAVOR}/executorch.aar.sha256sums --acl public-read