build.yml

name: CI

on:
  push:
    branches:
      - main
    tags:
      - v*
  pull_request:
  workflow_dispatch:

env:
  ORG_GRADLE_PROJECT_TIVI_REVENUECAT_ANDROID_API_KEY: ${{ secrets.REVENUECAT_ANDROID_API_KEY }}
  ORG_GRADLE_PROJECT_TIVI_REVENUECAT_IOS_API_KEY: ${{ secrets.REVENUECAT_IOS_API_KEY }}
  ORG_GRADLE_PROJECT_TIVI_TMDB_API_KEY: ${{ secrets.TMDB_API_KEY }}
  ORG_GRADLE_PROJECT_TIVI_TRAKT_CLIENT_ID: ${{ secrets.TRAKT_CLIENT_ID }}
  ORG_GRADLE_PROJECT_TIVI_TRAKT_CLIENT_SECRET: ${{ secrets.TRAKT_CLIENT_SECRET }}
  ORG_GRADLE_PROJECT_TIVI_RELEASE_KEYSTORE_PWD: ${{ secrets.ORG_GRADLE_PROJECT_TIVI_RELEASE_KEYSTORE_PWD }}
  ORG_GRADLE_PROJECT_TIVI_RELEASE_KEY_PWD: ${{ secrets.ORG_GRADLE_PROJECT_TIVI_RELEASE_KEY_PWD }}
  ORG_GRADLE_PROJECT_REMOTE_BUILD_CACHE_URL: ${{ secrets.REMOTE_BUILD_CACHE_URL }}
  ORG_GRADLE_PROJECT_REMOTE_BUILD_CACHE_USERNAME: ${{ secrets.REMOTE_BUILD_CACHE_USERNAME }}
  ORG_GRADLE_PROJECT_REMOTE_BUILD_CACHE_PASSWORD: ${{ secrets.REMOTE_BUILD_CACHE_PASSWORD }}
  APP_STORE_CONNECT_API_KEY_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
  APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_ISSUER_ID }}
  APP_STORE_CONNECT_API_KEY_KEY: ${{ secrets.APP_STORE_CONNECT_API_KEY_CONTENTS }}
  APP_STORE_CONNECT_API_KEY_IS_KEY_CONTENT_BASE64: true
  MATCH_GIT_BASIC_AUTHORIZATION: ${{ secrets.FASTLANE_MATCH_GH_PAT }}
  MATCH_PASSWORD: ${{ secrets.FASTLANE_MATCH_PASSWORD }}
  TIVI_BUILD_NUMBER: ${{ github.run_number }}
  FASTLANE_XCODEBUILD_SETTINGS_TIMEOUT: 60

jobs:
  android:
    runs-on: ubuntu-latest
    timeout-minutes: 60

    steps:
      - name: Generate build number
        shell: bash
        run: echo "ORG_GRADLE_PROJECT_TIVI_VERSIONCODE=$(( (GITHUB_RUN_NUMBER * 2) + 10000 ))" >> $GITHUB_ENV

      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: 21

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-disabled: true

      - name: Decrypt secrets
        run: ./release/decrypt-secrets.sh
        env:
          ENCRYPT_KEY: ${{ secrets.ENCRYPT_KEY }}

      - name: Build Android App (skipping benchmark variant)
        run: |
          ./gradlew check \
            :android-app:app:assemble \
            :android-app:app:bundle \
            -x assembleNonMinifiedRelease \
            -x bundleNonMinifiedRelease \
            -Pandroidx.baselineprofile.skipgeneration=true

      - name: Clean secrets
        if: always()
        run: ./release/clean-secrets.sh

      - name: Upload build outputs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: android-build-outputs
          path: android-app/app/build/outputs

      - name: Upload reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: android-reports
          path: |
            **/build/reports/*

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: android-test-results
          path: |
            **/build/test-results/*

  desktop:
    runs-on: ubuntu-latest
    timeout-minutes: 60

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

      - name: Validate Gradle Wrapper
        uses: gradle/wrapper-validation-action@v3

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: 21

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-disabled: true

      - name: Build Desktop App
        run: ./gradlew jvmTest :desktop-app:packageDistributionForCurrentOS

      - name: Upload build outputs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: desktop-build-binaries
          path: desktop-app/build/compose/binaries

      - name: Upload reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: desktop-reports
          path: |
            **/build/reports/*

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: desktop-test-results
          path: |
            **/build/test-results/*

  ios-qa-app:
    runs-on: macos-14
    timeout-minutes: 60

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: 21

      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - run: brew install swiftlint

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-disabled: true

      - uses: actions/cache@v4
        with:
          path: ios-app/Tivi/Pods
          key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock') }}
          restore-keys: |
            ${{ runner.os }}-pods-

      - name: Decrypt secrets
        run: ./release/decrypt-secrets.sh
        env:
          ENCRYPT_KEY: ${{ secrets.ENCRYPT_KEY }}

      - name: Run Fastlane Lint lane
        run: bundle exec fastlane ios lint

      - name: Build iOS application
        run: bundle exec fastlane ios build_qa

      - name: Upload build outputs
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@v4
        with:
          name: ios-qa-build-outputs
          path: |
            *.ipa
            *.dSYM.zip

      - name: Upload build logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ios-qa-logs
          path: |
            **/fastlane-buildlog

  ios-prod-app:
    runs-on: macos-14
    timeout-minutes: 60

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: 21

      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - run: brew install swiftlint

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-disabled: true

      - uses: actions/cache@v4
        with:
          path: ios-app/Tivi/Pods
          key: ${{ runner.os }}-pods-${{ hashFiles('**/Podfile.lock') }}
          restore-keys: |
            ${{ runner.os }}-pods-

      - name: Decrypt secrets
        run: ./release/decrypt-secrets.sh
        env:
          ENCRYPT_KEY: ${{ secrets.ENCRYPT_KEY }}

      - name: Build iOS application
        run: bundle exec fastlane ios build_prod

      - name: Upload build outputs
        if: always()
        continue-on-error: true
        uses: actions/upload-artifact@v4
        with:
          name: ios-prod-build-outputs
          path: |
            *.ipa
            *.dSYM.zip

      - name: Upload build logs
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ios-prod-logs
          path: |
            **/fastlane-buildlog

  ios-test:
    runs-on: macos-14
    timeout-minutes: 60

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

      - name: set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: 21

      - uses: gradle/actions/setup-gradle@v4
        with:
          cache-disabled: true

      # Set Xcode version
      - run: sudo xcodes select

      - name: iOS tests
        # Disable CC due to https://github.com/google/ksp/issues/1463
        run: ./gradlew iosSimulatorArm64Test --no-configuration-cache

      - name: Upload reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ios-reports
          path: |
            **/build/reports/*

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ios-test-results
          path: |
            **/build/test-results/*

  publish-testflight:
    if: github.ref == 'refs/heads/main'
    needs: [ios-qa-app, ios-prod-app, ios-test]
    runs-on: macos-latest
    timeout-minutes: 20

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - name: Decrypt secrets
        run: ./release/decrypt-secrets.sh
        env:
          ENCRYPT_KEY: ${{ secrets.ENCRYPT_KEY }}

      - uses: actions/download-artifact@v4
        with:
          name: ios-qa-build-outputs

      - name: Publish QA to TestFlight
        run: bundle exec fastlane ios publish_qa

      - name: Delete QA IPA
        run: |
          rm *.ipa
          rm *.dSYM.zip

      - uses: actions/download-artifact@v4
        with:
          name: ios-prod-build-outputs

      - name: Publish prod to TestFlight
        run: bundle exec fastlane ios publish_prod

  publish-playstore:
    if: github.ref == 'refs/heads/main'
    needs: [android]
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - name: Decrypt secrets
        run: ./release/decrypt-secrets.sh
        env:
          ENCRYPT_KEY: ${{ secrets.ENCRYPT_KEY }}

      - uses: actions/download-artifact@v4
        with:
          name: android-build-outputs
          path: android-app/app/build/outputs

      - name: Publish QA to Google Play
        run: bundle exec fastlane android publish_qa

      - name: Publish prod to Google Play
        run: bundle exec fastlane android publish_prod