build.yml

name: Build

on:
  push:
  pull_request_target:
    types: [labeled]
  workflow_dispatch:
    inputs:
      backends:
        description: 'Integration test backends, e.g. pcloud,s3-vf7 (empty runs all)'
        required: false
        default: ''

permissions:
  contents: read

jobs:
  build:
    name: Build and test
    runs-on: xcode-27
    env:
      DERIVED_DATA_PATH: 'DerivedData'
      DEVICE: 'iPhone 17'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Disable shallow clone for SonarCloud analysis
          # https://docs.sonarsource.com/sonarqube-cloud/advanced-setup/ci-based-analysis/github-actions-for-sonarcloud
          fetch-depth: 0
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .build
          key: ${{ runner.os }}-spm-${{ hashFiles('**/Package.resolved') }}
          restore-keys: |
            ${{ runner.os }}-spm-
      - name: Select Xcode
        run: |
          sudo xcode-select -s "/Applications/Xcode_$(cat .xcode-version).app"
          xcodebuild -version
      - name: Install SwiftFormat and SwiftLint
        run: |
          brew update
          brew install swiftformat swiftlint
      - name: Run process.sh script
        run: |
          ./Scripts/process.sh
          exit $?
      - name: Build
        run: set -o pipefail && env NSUnbufferedIO=YES xcodebuild clean build-for-testing -scheme 'CryptomatorCloudAccess' -destination "name=$DEVICE" -derivedDataPath $DERIVED_DATA_PATH -enableCodeCoverage YES | xcbeautify
      - name: Test
        run: set -o pipefail && env NSUnbufferedIO=YES xcodebuild test-without-building -xctestrun $(find . -type f -name "*.xctestrun") -destination "name=$DEVICE" -derivedDataPath $DERIVED_DATA_PATH -test-timeouts-enabled YES | xcbeautify
      - name: Generate coverage report
        run: |
          xcresult_path=$(find $DERIVED_DATA_PATH/Logs/Test -name "*.xcresult" | head -n 1)
          bash Scripts/xccov-to-sonarqube-generic.sh "$xcresult_path" > sonarqube-generic-coverage.xml
      - name: SonarCloud Scan
        uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        continue-on-error: true

  integration-tests:
    name: Run integration tests
    runs-on: xcode-27
    needs: build
    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
    timeout-minutes: 120
    permissions:
      contents: read
      actions: read # Required for downloading the still-failing tests of the previous attempt
    env:
      DERIVED_DATA_PATH: 'DerivedData'
      DEVICE: 'iPhone 17'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ env.DERIVED_DATA_PATH }}/SourcePackages
          key: ${{ runner.os }}-integration-spm-${{ hashFiles('**/Package.resolved') }}
          restore-keys: |
            ${{ runner.os }}-integration-spm-
      - name: Select Xcode
        run: |
          sudo xcode-select -s "/Applications/Xcode_$(cat .xcode-version).app"
          xcodebuild -version
      - name: Build
        run: set -o pipefail && env NSUnbufferedIO=YES xcodebuild build-for-testing -scheme 'AllIntegrationTests' -destination "name=$DEVICE" -derivedDataPath $DERIVED_DATA_PATH | xcbeautify
        env:
          BOX_CLIENT_ID: ${{ secrets.BOX_CLIENT_ID }}
          BOX_CLIENT_SECRET: ${{ secrets.BOX_CLIENT_SECRET }}
          BOX_ENTERPRISE_ID: ${{ secrets.BOX_ENTERPRISE_ID }}
          DROPBOX_APP_KEY: ${{ secrets.DROPBOX_APP_KEY }}
          DROPBOX_REFRESH_TOKEN: ${{ secrets.DROPBOX_REFRESH_TOKEN }}
          GOOGLE_DRIVE_CLIENT_ID: ${{ secrets.GOOGLE_DRIVE_CLIENT_ID }}
          GOOGLE_DRIVE_REFRESH_TOKEN: ${{ secrets.GOOGLE_DRIVE_REFRESH_TOKEN }}
          MICROSOFT_GRAPH_CLIENT_ID: ${{ secrets.MICROSOFT_GRAPH_CLIENT_ID }}
          MICROSOFT_GRAPH_REDIRECT_URI_SCHEME: ${{ secrets.MICROSOFT_GRAPH_REDIRECT_URI_SCHEME }}
          MICROSOFT_GRAPH_REFRESH_TOKEN: ${{ secrets.MICROSOFT_GRAPH_REFRESH_TOKEN }}
          PCLOUD_APP_KEY: ${{ secrets.PCLOUD_APP_KEY }}
          PCLOUD_ACCESS_TOKEN: ${{ secrets.PCLOUD_ACCESS_TOKEN }}
          PCLOUD_HTTP_API_HOST_NAME: ${{ secrets.PCLOUD_HTTP_API_HOST_NAME }}
          S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }}
          S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
          S3_URL: ${{ secrets.S3_URL }}
          S3_BUCKET: ${{ secrets.S3_BUCKET }}
          S3_REGION: ${{ secrets.S3_REGION }}
          WEBDAV_BASE_URL: ${{ secrets.WEBDAV_BASE_URL }}
          WEBDAV_USERNAME: ${{ secrets.WEBDAV_USERNAME }}
          WEBDAV_PASSWORD: ${{ secrets.WEBDAV_PASSWORD }}
      - name: Determine previous attempt
        id: previous-attempt
        if: github.run_attempt > 1
        run: echo "number=$(( GITHUB_RUN_ATTEMPT - 1 ))" >> "$GITHUB_OUTPUT"
      - name: Download still-failing tests of previous attempt
        if: github.run_attempt > 1
        continue-on-error: true
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: integration-still-failing-${{ steps.previous-attempt.outputs.number }}
          path: integration-input
          run-id: ${{ github.run_id }}
          github-token: ${{ github.token }}
      - name: Run integration tests
        run: |
          # A missing list means that the previous attempt didn't finish its main pass, and --only rejects an empty one, so either way everything runs.
          if [ -s integration-input/still-failing.txt ]; then
            ./Scripts/run-integration-tests.sh --only integration-input/still-failing.txt
          else
            ./Scripts/run-integration-tests.sh
          fi
        env:
          BACKENDS: ${{ inputs.backends }}
      - name: Upload still-failing tests
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: integration-still-failing-${{ github.run_attempt }}
          path: integration-output/still-failing.txt
          if-no-files-found: ignore

  release:
    name: Deploy and draft a release
    runs-on: macos-latest
    needs: build
    permissions:
      contents: write # Required for drafting the release
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Draft release
        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ github.ref }}
          release_name: ${{ github.ref }}
          body: |
            :construction: Work in Progress
          draft: true
          prerelease: false