name: CI

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]
  # Manual trigger. Worth having on a self-hosted runner: when a run fails for
  # reasons outside the repo — the runner was down, a toolchain changed — this
  # re-runs it without an empty commit to force one.
  workflow_dispatch:

# Both jobs target a self-hosted runner, by capability rather than by hostname.
# See tool/setup_ci_runner.sh for how that runner is provisioned and why it is
# not the Gitea host: Flutter cannot build an Android APK on a Linux arm64 host
# (flutter/flutter#189724), and the Gitea box is aarch64. The runner is
# registered at android-stuff org scope so any repo in the org can use it.
#
# The runner is host-mode, so Flutter, the JDK and the Android SDK/NDK are the
# machine's own — the same toolchain that produced the verified release, and no
# multi-hundred-MB download per run. Nothing here installs a toolchain; the
# Toolchain step fails loudly if one is missing.

jobs:
  analyze:
    name: Analyze & Test
    runs-on: flutter-android
    steps:
      - uses: actions/checkout@v4

      - name: Toolchain
        run: |
          flutter --version
          echo "ANDROID_HOME=${ANDROID_HOME:?not set on this runner}"

      - name: Get dependencies
        run: flutter pub get

      - name: Analyze
        run: flutter analyze

      # Includes test/architecture_test.dart, which fails the build if a layer
      # boundary is crossed.
      - name: Run tests
        run: flutter test

  release-apk:
    name: Release APK
    runs-on: flutter-android
    steps:
      - uses: actions/checkout@v4

      - name: Get dependencies
        run: flutter pub get

      # The debug build does not minify, so it cannot catch an R8 problem. This
      # job exists because a release APK that aborted on every test shipped
      # once while the debug build passed every check.
      - name: Build release APK
        run: flutter build apk --release

      # Building is not enough on its own: a renamed JNI callback still
      # produces a successful build and a broken APK. This reads R8's mapping
      # and the DEX string pool to confirm the names JNI resolves survived.
      - name: Check JNI names survived minification
        run: ./tool/check_jni_keep_rules.sh

      - uses: actions/upload-artifact@v4
        with:
          name: app-release-apk
          path: build/app/outputs/flutter-apk/app-release.apk
          if-no-files-found: error