build.yml

name: build androidplot

# Documentation-only changes cannot affect the build, so they don't run it (and a docs-only
# merge to master publishes no snapshot or beta). Everything else runs the full workflow.
on:
  push:
    branches: [master]
    paths-ignore:
      - 'docs/**'
      - '**.md'
      - '.github/ISSUE_TEMPLATE.md'
      - '_config.yml'
  pull_request:
    paths-ignore:
      - 'docs/**'
      - '**.md'
      - '.github/ISSUE_TEMPLATE.md'
      - '_config.yml'

permissions:
  contents: read

# Cancel superseded runs on the same branch to save runner minutes.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0 # the demoapp version code is derived from the commit count

      - name: Set Up JDK 21
        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
        with:
          distribution: 'temurin'
          java-version: '21'

      # Caches Gradle distributions and dependencies between runs. Only master
      # writes to the cache so feature branches don't evict useful entries.
      - name: Set Up Gradle
        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
        with:
          cache-read-only: ${{ github.ref != 'refs/heads/master' }}

      - name: Build and Test
        run: ./gradlew testDebugUnitTest jacocoTestDebugUnitTestReport lint :androidplot-core:assembleRelease

      # Signing secrets are unavailable to pull requests from forks, so only
      # build the signed demoapp when they are present.
      - name: Check for Signing Secrets
        id: signing
        env:
          KEYSTORE_B64: ${{ secrets.DEMOAPP_KEYSTORE }}
        run: echo "available=${{ env.KEYSTORE_B64 != '' }}" >> "$GITHUB_OUTPUT"

      - name: Build Signed Demoapp
        if: steps.signing.outputs.available == 'true'
        env:
          ENCODED: ${{ secrets.DEMOAPP_KEYSTORE }}
          KEYSTORE: keystore.jks
          KEY_ALIAS: Key0
          KEYSTORE_PASSWORD: ${{ secrets.DEMOAPP_KEYSTORE_PASSWORD }}
          KEY_PASSWORD: ${{ secrets.DEMOAPP_KEY_PASSWORD }}
        run: |
          printf '%s' "$ENCODED" | base64 -d > "${GITHUB_WORKSPACE}/demoapp/keystore.jks"
          ./gradlew :demoapp:assembleRelease

      - name: Build Unsigned Demoapp
        if: steps.signing.outputs.available != 'true'
        run: ./gradlew :demoapp:assembleDebug

      # Requires a CODECOV_TOKEN secret (tokenless uploads are rejected for
      # protected branches). Upload failures are surfaced on the step but do
      # not fail the job.
      - name: Upload Code Coverage
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        continue-on-error: true
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: androidplot-core/build/jacoco/jacoco.xml
          fail_ci_if_error: true

      - name: Upload Test and Lint Reports
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: Reports
          path: |
            **/build/reports/tests/
            **/build/reports/lint-results-*.html
          retention-days: 14
          if-no-files-found: ignore

      - name: Upload Core Library AAR
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: Core Library
          path: androidplot-core/build/outputs/aar/*.aar
          retention-days: 30

      # Publishes the demoapp to the Play open testing (beta) track on every merge to master
      # that touches the library or demoapp source.  Version codes rise with the commit count,
      # so each upload is accepted; Play reviews each one before testers see it.
      - name: Check for Demoapp Changes
        id: demoapp
        if: github.ref_name == 'master'
        run: |
          if git diff --quiet HEAD^ HEAD -- androidplot-core/src/main demoapp/src/main demoapp/build.gradle build.gradle; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish Demoapp to Google Play (beta)
        if: github.ref_name == 'master' && steps.demoapp.outputs.changed == 'true'
        env:
          KEYSTORE: keystore.jks
          KEY_ALIAS: Key0
          KEYSTORE_PASSWORD: ${{ secrets.DEMOAPP_KEYSTORE_PASSWORD }}
          KEY_PASSWORD: ${{ secrets.DEMOAPP_KEY_PASSWORD }}
          PUBLISHER_ACCT_JSON_FILE: publisher.json
          PLAY_JSON: ${{ secrets.PLAY_PUBLISHER_JSON }}
        run: |
          printf '%s' "$PLAY_JSON" > "${GITHUB_WORKSPACE}/demoapp/publisher.json"
          ./gradlew :demoapp:publishReleaseApk --track beta

      - name: Upload Demoapp APK
        if: github.ref_name == 'master'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: Demoapp APK
          path: demoapp/build/outputs/apk/release/*.apk
          retention-days: 30

      # Publishes <version>-SNAPSHOT of the core library so unreleased changes
      # can be consumed by Maven coordinates from the Central snapshots repo.
      - name: Publish Snapshot to Maven Central
        if: github.ref_name == 'master'
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
          SIGNING_PASSWORD: ${{ secrets.GPG_SIGNING_PASSWORD }}
        run: ./gradlew :androidplot-core:publish -Psnapshot