ci.yml

# Thanks to https://github.com/coil-kt/coil/blob/master/.github/workflows/ci.yml
name: CI

on:
  push:
    tags:
      - '*'
  pull_request:

jobs:
  publish_archives:
    name: Publish Archives
    if: startsWith(github.ref, 'refs/tags/')

    strategy:
      matrix:
        os: [ macos-latest ]

    runs-on: ${{matrix.os}}

    steps:
      - name: Checkout the repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: 'zulu'
          java-version: |
            17
            21

      - name: Copy CI gradle.properties
        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0

      - name: Cache konan
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ~/.konan
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*') }}
          restore-keys: |
            gradle-${{ runner.os }}-

      - name: Publish the macOS artifacts
        if: matrix.os == 'macos-latest'
        env:
          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.NEXUS_USERNAME }}
          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.NEXUS_PASSWORD }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.SIGNING_KEY_ID }}
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_PRIVATE_KEY }}
          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
        run: |
          ./gradlew multiplatform-markdown-renderer:publishAllPublicationsToMavenCentralRepository --no-daemon --no-configure-on-demand --no-parallel
          ./gradlew multiplatform-markdown-renderer-m2:publishAllPublicationsToMavenCentralRepository --no-daemon --no-configure-on-demand --no-parallel
          ./gradlew multiplatform-markdown-renderer-m3:publishAllPublicationsToMavenCentralRepository --no-daemon --no-configure-on-demand --no-parallel
          ./gradlew multiplatform-markdown-renderer-coil2:publishAllPublicationsToMavenCentralRepository --no-daemon --no-configure-on-demand --no-parallel
          ./gradlew multiplatform-markdown-renderer-coil3:publishAllPublicationsToMavenCentralRepository --no-daemon --no-configure-on-demand --no-parallel
          ./gradlew multiplatform-markdown-renderer-code:publishAllPublicationsToMavenCentralRepository --no-daemon --no-configure-on-demand --no-parallel

  build:
    name: Build
    runs-on: macos-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 100

      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: 'zulu'
          java-version: |
            17
            21

      - name: Validate gradle wrapper
        uses: gradle/actions/wrapper-validation@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0

      - name: Copy CI gradle.properties
        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0

      - name: Build Debug
        run: |
          ./gradlew clean || true
          ./gradlew sample:android:assembleDebug --stacktrace

      - name: Run Tests
        run: |
          ./gradlew :sample:android:verifyPaparazzi

      - name: Publish Test Report
        if: false && (failure() || success()) && github.event_name == 'pull_request'
        uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # v6.4.0
        with:
          report_paths: '**/sample/android/build/test-results/testDebugUnitTest/TEST-*.xml'
          github_token: ${{ secrets.GITHUB_TOKEN }}
          fail_on_failure: true
          annotate_only: true
          detailed_summary: true

      - name: Archive Test Report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: "Test-Artifacts"
          path: "sample/android/build/reports/paparazzi/debug/"

      - name: Api Check
        if: github.event_name  == 'pull_request'
        run: ./gradlew apiCheck

      - name: Run Lint
        if: github.event_name == 'pull_request'
        run: ./gradlew lintDebug

      - name: Collect Lint SARIF reports
        if: github.event_name == 'pull_request'
        run: |
          mkdir -p sarif-reports
          find . -name "lint-results-debug.sarif" | while read f; do
            module=$(echo "$f" | sed 's|^\./||' | sed 's|/build/reports/.*||' | sed 's|/|-|g')
            cp "$f" "sarif-reports/${module}-lint.sarif"
          done

      - name: Upload Lint SARIF
        if: always() && github.event_name == 'pull_request'
        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
        with:
          sarif_file: 'sarif-reports'
          category: android-lint

      - name: Prepare Keystore and Local.
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          echo "${{ secrets.KEYSTORE }}" > opensource.jks.asc
          gpg -d --passphrase "${{ secrets.KEYSTORE_PASSPHRASE }}" --batch "opensource.jks.asc" > "sample/android/opensource.jks"

      - name: Build Release App
        if: startsWith(github.ref, 'refs/tags/')
        run: ./gradlew sample:android:assembleRelease sample:android:bundleRelease -P"com.mikepenz.android.signing.enabled"="true" -P"com.mikepenz.android.signing.storeFile"="opensource.jks" -P"com.mikepenz.android.signing.storePassword"="${{ secrets.STORE_PASSWORD }}" -P"com.mikepenz.android.signing.keyAlias"="${{ secrets.KEY_ALIAS }}" -P"com.mikepenz.android.signing.keyPassword"="${{ secrets.KEY_PASSWORD }}"

      - name: Collect artifacts
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          COLLECT_PWD=${PWD}
          mkdir -p "artifacts"
          find . -name "*release.apk" -type f -exec cp {} "artifacts" \;
          find . -name "*release.aab" -type f -exec cp {} "artifacts" \;

      - name: Archive Artifacts
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: "App-Artifacts"
          path: artifacts/*

  release:
    name: Release
    runs-on: ubuntu-latest
    needs: build
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 100

      - name: Download Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: App-Artifacts
          path: artifacts

      - name: Build Changelog
        id: github_release
        uses: mikepenz/release-changelog-builder-action@bcae7115752d4ed746ff92feb666574428a79415 # v6.2.1
        with:
          configuration: ".github/config/configuration.json"
          ignorePreReleases: ${{ !contains(github.ref, '-') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Release
        uses: mikepenz/action-gh-release@2a00e201320fb618d8e705a736286b2e31aa48e2 # v3.0.0
        with:
          body: ${{steps.github_release.outputs.changelog}}
          prerelease: ${{ contains(github.ref, '-rc') || contains(github.ref, '-b') || contains(github.ref, '-a') }}
          files: artifacts/*
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}