android-ui.yml

name: Android UI Tests

on:
  workflow_run:
    workflows: ["Build"]
    types: [completed]
    branches: ["main", "copilot/**"]

# An emulator run against a superseded commit answers a question nobody is
# still asking, and these are the longest jobs in the pipeline.
concurrency:
  group: ui-tests-${{ github.event.workflow_run.head_branch }}
  cancel-in-progress: true

# Default deny at the workflow level; each job grants itself the minimum it
# needs. A job added later then starts with no token scopes rather than
# silently inheriting whatever the workflow happened to declare.
permissions: {}

jobs:
  ui-tests:
    name: Instrumented UI Tests
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      # Download artifacts from the triggering workflow run.
      actions: read
    timeout-minutes: 60
    # Only run if the build workflow succeeded
    if: ${{ github.event.workflow_run.conclusion == 'success' }}

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
          fetch-depth: 0  # Full git history for version calculation
          fetch-tags: true
          # No step here talks to the remote, and every job runs project
          # build code. The token is not left in `.git/config` for that
          # code to find.
          persist-credentials: false

      - name: Enable KVM group perms
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Set up JDK
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: "21"

      - name: Set up Android SDK
        uses: android-actions/setup-android@v4

      - name: Install Android components
        run: |
          sdkmanager "platform-tools" "platforms;android-37.0" "build-tools;37.0.0"
          sdkmanager "system-images;android-34;google_apis;x86_64"
          sdkmanager "emulator"

      # Bounded input rather than `yes |`, which dies of SIGPIPE once sdkmanager
      # stops reading and would fail this step the moment anyone adds
      # `set -o pipefail` to it.
      - name: Accept Android licenses
        run: printf 'y\n%.0s' {1..100} | sdkmanager --licenses > /dev/null

      # Reuse the native libraries built once by the Build workflow instead of
      # re-running the expensive Android cross-compile here. Only the x86_64 ABI
      # is needed by the emulator, but downloading all ABIs is harmless and keeps
      # the artifact a single shared unit.
      - name: Download shared native libraries
        uses: actions/download-artifact@v8
        with:
          name: letterbox-jnilibs
          path: app/src/main/jniLibs
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

      # The emulator is x86_64, so that is the ABI whose absence would actually
      # break the run. Asserted directly: the previous form ended each check in
      # `find ... | head -1 || (echo ERROR; exit 1)`, and `find` exits 0 when it
      # matches nothing, so the `||` never fired.
      - name: Verify native libraries are present
        run: |
          set -euo pipefail
          missing=0
          for lib in letterbox_core letterbox_proxy; do
            path="app/src/main/jniLibs/x86_64/lib$lib.so"
            if [[ -f "$path" ]]; then
              printf '  ok  %s (%s bytes)\n' "$path" "$(stat -c%s "$path")"
            else
              echo "::error::missing $path"
              missing=1
            fi
          done
          exit "$missing"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v6
        with:
          # Never written from here. This workflow runs in the default branch's
          # context (`github.ref` is `refs/heads/main`) but checks out the
          # triggering run's head, which may be a `copilot/**` branch — so a ref
          # check would call it trusted when it is not. It only ever needs to
          # consume what `build.yml` compiled.
          cache-read-only: true

      - name: Run instrumented UI tests (Gradle Managed Devices)
        run: |
          ./gradlew pixel7Api34StagingDebugAndroidTest \
            --no-daemon \
            -Pandroid.testoptions.manageddevices.emulator.gpu=swiftshader_indirect \
            -Pandroid.experimental.testOptions.managedDevices.setupTimeoutMinutes=30 \
            -Pandroid.experimental.testOptions.managedDevices.maxConcurrentDevices=1

      - name: Collect debug artifacts (always)
        if: always()
        run: |
          mkdir -p artifacts

          # Restart adb server to prevent hangs (best-effort)
          timeout 20s adb kill-server || true
          timeout 20s adb start-server || true

          # Capture device state if any device is still connected (with timeout to prevent hangs)
          timeout 10s adb devices || true
          timeout 30s adb logcat -d > artifacts/logcat.txt 2>&1 || true
          timeout 10s adb exec-out screencap -p > artifacts/final-screen.png 2>&1 || true

          # Collect Gradle test reports
          cp -r app/build/reports artifacts/ 2>/dev/null || true
          cp -r app/build/outputs/androidTest-results artifacts/ 2>/dev/null || true
          cp -r app/build/outputs/managed_device_android_test_additional_output artifacts/ 2>/dev/null || true

          echo "Artifacts collected:"
          ls -la artifacts/ || true

      - name: Upload test artifacts
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: android-ui-test-artifacts
          path: artifacts/
          retention-days: 14