mdo/.github/workflows/ci.yml at main · maphew/mdo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  check:
    name: Format, lint, test, and package
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        # actions/checkout v5
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd

      - name: Install Rust
        # dtolnay/rust-toolchain stable
        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
        with:
          components: clippy, rustfmt

      - name: Cache Rust build artifacts
        # Swatinem/rust-cache v2
        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae

      - name: Install cargo-audit
        # taiki-e/install-action v2
        uses: taiki-e/install-action@2ca9b94c269419b7b0c711c09d0b21c4e1d51145
        with:
          tool: cargo-audit

      - name: Audit Rust dependencies
        run: cargo audit --deny warnings

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Run Clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

      - name: Run tests
        run: cargo test --all-targets --all-features --locked

      - name: Run Python tests
        run: python3 -m unittest discover -s tests -p 'test_*.py'

      - name: Verify crate package
        run: cargo package --locked

  windows-check:
    name: Windows build and test
    runs-on: windows-latest

    steps:
      - name: Checkout
        # actions/checkout v5
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd

      - name: Install Rust
        # dtolnay/rust-toolchain stable
        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30

      - name: Cache Rust build artifacts
        # Swatinem/rust-cache v2
        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae

      # Building the test binaries exercises every cfg(windows) code path
      # (including cfg(test) modules), and running them covers registry
      # command construction, wrapper argument forwarding/error propagation,
      # and setup-launcher argument construction with pure, seam-based unit
      # tests that never touch the real registry or spawn a real terminal.
      - name: Run Windows tests
        run: cargo test --all-targets --all-features --locked

  android-check:
    name: Build Android packages
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        # actions/checkout v5
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd

      - name: Validate Gradle wrapper
        # gradle/actions/wrapper-validation v4.4.4
        uses: gradle/actions/wrapper-validation@da187c8e6ffbd3802e00f2477aa5a822b25f2dda

      - name: Install JDK 17
        # actions/setup-java v4
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9
        with:
          distribution: temurin
          java-version: "17"

      - name: Install Android SDK tools
        # android-actions/setup-android v3
        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407

      - name: Install Android platform and NDK
        run: sdkmanager "platforms;android-36" "build-tools;36.0.0" "ndk;28.2.13676358"

      - name: Install Rust Android target
        # dtolnay/rust-toolchain stable
        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
        with:
          targets: aarch64-linux-android

      - name: Install cargo-ndk
        # taiki-e/install-action v2
        uses: taiki-e/install-action@2ca9b94c269419b7b0c711c09d0b21c4e1d51145
        with:
          tool: cargo-ndk

      - name: Build debug APK and unsigned release packages
        working-directory: android
        run: ./gradlew assembleDebug assembleRelease bundleRelease lintDebug lintRelease --stacktrace

      - name: Exercise release signing with a disposable key
        working-directory: android
        env:
          MDO_ANDROID_KEYSTORE: ${{ runner.temp }}/mdo-ci-signing.jks
          MDO_ANDROID_KEYSTORE_PASSWORD: android-test
          MDO_ANDROID_KEY_ALIAS: mdo-ci
          MDO_ANDROID_KEY_PASSWORD: android-test
        run: |
          keytool -genkeypair -noprompt \
            -keystore "${MDO_ANDROID_KEYSTORE}" \
            -storepass "${MDO_ANDROID_KEYSTORE_PASSWORD}" \
            -alias "${MDO_ANDROID_KEY_ALIAS}" \
            -keypass "${MDO_ANDROID_KEY_PASSWORD}" \
            -keyalg RSA -keysize 2048 -validity 1 \
            -dname "CN=mdo CI,O=mdo,C=US"
          ./gradlew --no-daemon assembleRelease bundleRelease --stacktrace
          "${ANDROID_HOME}/build-tools/36.0.0/apksigner" verify --verbose app/build/outputs/apk/release/app-release.apk
          # Android upload keys are self-signed, which jarsigner -strict
          # rejects. Plain -verify exits 0 even for an unsigned jar, so
          # assert the "jar verified" verdict explicitly.
          jarsigner -verify app/build/outputs/bundle/release/app-release.aab | tee /dev/stderr | grep -q '^jar verified'

      - name: Upload debug APK
        # actions/upload-artifact v7.0.1
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: mdo-android-arm64-debug
          path: android/app/build/outputs/apk/debug/app-debug.apk
          if-no-files-found: error
          retention-days: 14