mikkeli
0dd0b95afb
Targets runs-on: flutter-android for both jobs. Since that runner is host mode with the toolchain preinstalled, subosito/flutter-action and actions/setup-java are removed — they would have downloaded a second Flutter and JDK over the ones being used, and CI would no longer be building with the toolchain the release was verified against. A Toolchain step fails loudly if flutter or ANDROID_HOME is missing rather than letting a later step fail obscurely. Documents in docs/README.md why the runner cannot be the Gitea host, what host mode trades away, and what each job protects — including why building the release APK is necessary but not sufficient, which is the reason the JNI name guard exists at all. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
69 lines
2.2 KiB
YAML
69 lines
2.2 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [ master ]
|
|
pull_request:
|
|
branches: [ master ]
|
|
|
|
# Both jobs target a self-hosted runner, by capability rather than by hostname.
|
|
# See tool/setup_ci_runner.sh for how that runner is provisioned and why it is
|
|
# not the Gitea host: Flutter cannot build an Android APK on a Linux arm64 host
|
|
# (flutter/flutter#189724), and the Gitea box is aarch64. The runner is
|
|
# registered at android-stuff org scope so any repo in the org can use it.
|
|
#
|
|
# The runner is host-mode, so Flutter, the JDK and the Android SDK/NDK are the
|
|
# machine's own — the same toolchain that produced the verified release, and no
|
|
# multi-hundred-MB download per run. Nothing here installs a toolchain; the
|
|
# Toolchain step fails loudly if one is missing.
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze & Test
|
|
runs-on: flutter-android
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Toolchain
|
|
run: |
|
|
flutter --version
|
|
echo "ANDROID_HOME=${ANDROID_HOME:?not set on this runner}"
|
|
|
|
- name: Get dependencies
|
|
run: flutter pub get
|
|
|
|
- name: Analyze
|
|
run: flutter analyze
|
|
|
|
# Includes test/architecture_test.dart, which fails the build if a layer
|
|
# boundary is crossed.
|
|
- name: Run tests
|
|
run: flutter test
|
|
|
|
release-apk:
|
|
name: Release APK
|
|
runs-on: flutter-android
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Get dependencies
|
|
run: flutter pub get
|
|
|
|
# The debug build does not minify, so it cannot catch an R8 problem. This
|
|
# job exists because a release APK that aborted on every test shipped
|
|
# once while the debug build passed every check.
|
|
- name: Build release APK
|
|
run: flutter build apk --release
|
|
|
|
# Building is not enough on its own: a renamed JNI callback still
|
|
# produces a successful build and a broken APK. This reads R8's mapping
|
|
# and the DEX string pool to confirm the names JNI resolves survived.
|
|
- name: Check JNI names survived minification
|
|
run: ./tool/check_jni_keep_rules.sh
|
|
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: app-release-apk
|
|
path: build/app/outputs/flutter-apk/app-release.apk
|
|
if-no-files-found: error
|