ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

# Least-privilege by default. Third-party actions are pinned by commit SHA (supply-chain hardening).
permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  workflow-lint:
    name: actionlint + shellcheck
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      # actionlint lints all workflow YAML and, via its bundled shellcheck, the inline `run:` shell in
      # every workflow. The image is pinned by digest (supply-chain hardening); -color for readable
      # output. A lint error fails this job (and thus CI).
      - name: actionlint
        uses: docker://rhysd/actionlint:1.7.7@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9
        with:
          args: -color

      # Lint any standalone shell scripts in the repo (inline workflow shell is already covered by
      # actionlint's shellcheck integration above). shellcheck is preinstalled on ubuntu-latest.
      - name: shellcheck standalone shell scripts
        run: |
          set -euo pipefail
          mapfile -t scripts < <(git ls-files '*.sh' '*.bash')
          if [ "${#scripts[@]}" -eq 0 ]; then
            echo "No standalone shell scripts to lint."
            exit 0
          fi
          shellcheck "${scripts[@]}"

  build:
    name: Lint, test, assemble (debug)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Set up JDK 17
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@5e2ebd065dc2488b7a6ad670704656cbbe1e8f60 # v6.1.1

      - name: Make gradlew executable
        run: chmod +x ./gradlew

      # compileSdk 37 (Android 16) is new enough that the runner image may not preinstall its
      # platform. Accept licenses and install it explicitly so the build does not depend on which
      # SDK packages happen to be baked into ubuntu-latest. Build-tools are left to AGP's auto-
      # download (licenses are accepted above), matching what it resolves locally.
      - name: Install Android SDK platform 37
        run: |
          sdkmanager="${ANDROID_SDK_ROOT:-$ANDROID_HOME}/cmdline-tools/latest/bin/sdkmanager"
          yes | "$sdkmanager" --licenses >/dev/null 2>&1 || true
          "$sdkmanager" "platforms;android-37.0"

      - name: ktlint, Android Lint, unit tests, debug assembly
        run: ./gradlew ktlintCheck lint test assembleDebug --stacktrace
# Release signing, APK/SHA256SUMS publishing, F-Droid metadata and release-please live in
# release.yml / release-please.yml. This workflow proves the project builds + tests green and lints
# all workflow YAML and shell (actionlint + shellcheck).