.gitlab-ci.yml

stages:
  - build
  - test
  - deploy
  - upload

variables:
  GRADLE_USER_HOME: "${CI_PROJECT_DIR}/.gradle"
  ANDROID_IMAGE: blockstream/green_android

cache:
  - key:
      files:
        - gradle/wrapper/gradle-wrapper.properties
    paths:
      - .gradle/wrapper
      - .gradle/caches

# Defaults applied to all jobs unless overridden
default:
  image: # 5592d41c-20250213165311
    name: blockstream/green_android@sha256:38662be11766c3c07218ae158979deff6d40e001253b4796d1b28454bcf54bb3
    entrypoint: [""]
  tags:
    - ga

#####################################
# Build blockstream/green_android
.prep_dind:
  image: docker:27
  variables:
    DOCKER_HOST: tcp://docker:2375
    DOCKER_TLS_CERTDIR: ""
    DOCKER_BUILDKIT: 1
  services:
    - name: docker:27-dind
      command: ["dockerd", "--host=tcp://0.0.0.0:2375"]
      alias: "docker"
  tags:
    - cloud
  retry:
    max: 2
    when:
      - runner_system_failure
      - unknown_failure
      - stuck_or_timeout_failure

# Pushes two tags - :short_commit_sha and :latest
build_default_image:
  extends: .prep_dind
  stage: .pre
  variables:
    DOCKERFILE: contrib/Dockerfile
    ANDROID_IMAGE_SHA: ${ANDROID_IMAGE}:${CI_COMMIT_SHORT_SHA}
    ANDROID_IMAGE_LATEST: ${ANDROID_IMAGE}:latest
  rules:
    - changes:
      - ${DOCKERFILE}
  script:
    - apk add jq curl
    - docker buildx build
      --push
      -f ${DOCKERFILE}
      --build-arg BUILDKIT_INLINE_CACHE=1
      --cache-from ${ANDROID_IMAGE_LATEST}
      -t ${ANDROID_IMAGE_SHA}
      -t ${ANDROID_IMAGE_LATEST}
      contrib/
    - digest=$(docker inspect ${ANDROID_IMAGE_SHA} | jq -r '.[] | .RepoDigests')
    - echo "Cancelling the rest of the pipeline"
    - echo "Update the default.image version with the new image SHA digest"
    - echo "${digest}"
    - |
      curl -s --request POST --header "PRIVATE-TOKEN: $CI_CANCEL_PIPELINE_TOKEN" \
        "$CI_API_V4_URL/projects/$CI_PROJECT_ID/pipelines/$CI_PIPELINE_ID/cancel"


#####################################
# Build XCFramework

xcframework:
  stage: build
  when: manual
  artifacts:
    name: "green_xcframework-$CI_COMMIT_SHORT_SHA"
    expire_in: 4 days
    when: on_success
    paths:
      - common/build/XCFrameworks/*.zip
  tags:
    - osx
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - ./gradlew assembleXCFramework
    - cd common/build/XCFrameworks
    - zip -r debug.zip debug
    - zip -r release.zip release

#####################################
# Build Signed APKs

production:
  stage: build
  artifacts:
    name: "$CI_PROJECT_NAME-$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
    expire_in: 7 days
    when: on_success
    paths:
      - green/build/outputs/apk/productionGoogle/release/*.apk
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - echo $ANDROID_KEYSTORE_BASE64 | base64 -d > keystore.jks
    - ./gradlew useBlockstreamKeys
    - ./gradlew assembleProductionGoogleRelease

production_fdroid:
  stage: build
  when: manual
  artifacts:
    name: "$CI_PROJECT_NAME-$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
    expire_in: 7 days
    when: on_success
    paths:
      - green/build/outputs/apk/productionFDroid/release/*.apk
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - echo $ANDROID_KEYSTORE_BASE64 | base64 -d > keystore.jks
    - ./prepare_fdroid.sh
    - ./gradlew useBlockstreamKeys
    - ./gradlew assembleProductionFDroidRelease


development:
  stage: build
  when: manual
  artifacts:
    name: "$CI_PROJECT_NAME-$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
    expire_in: 7 days
    when: on_success
    paths:
      - green/build/outputs/apk/development/release/*.apk
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - echo $ANDROID_KEYSTORE_BASE64 | base64 -d > keystore.jks
    - ./gradlew useBlockstreamKeys
    - ./gradlew assembleDevelopmentRelease

production_debug:
  stage: build
  when: manual
  cache:
    policy: pull
  artifacts:
    name: "$CI_PROJECT_NAME-$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
    expire_in: 7 days
    when: on_success
    paths:
      - green/build/outputs/apk/productionGoogle/debug/*.apk
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - echo $ANDROID_KEYSTORE_BASE64 | base64 -d > keystore.jks
    - ./gradlew useBlockstreamKeys
    - ./gradlew assembleProductionGoogleDebug

gdk_commit:
  stage: build
  artifacts:
    name: "$CI_PROJECT_NAME-$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA-gdk-$GDK_COMMIT"
    expire_in: 7 days
    when: on_success
    paths:
      - green/build/outputs/apk/development/debug/*.apk
  when: manual
  cache:
    policy: pull
  variables:
    GDK_COMMIT: master
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - echo $ANDROID_KEYSTORE_BASE64 | base64 -d > keystore.jks
    - echo "GDK_COMMIT=$GDK_COMMIT"
    - ./gdk/fetch_android_binaries.sh -c $GDK_COMMIT
    - ./gradlew useBlockstreamKeys
    - ./gradlew assembleDevelopmentDebug

#####################################
# Build Unsigned APK

build_google_play:
  stage: build
  when: manual
  cache:
    policy: pull
  artifacts:
    name: "$CI_PROJECT_NAME-$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
    expire_in: 1 hour
    when: on_success
    paths:
      - green/build/outputs/apk/productionGoogle/release/*.apk
      - green/build/outputs/mapping/*/mapping.txt
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - ./gradlew lintProductionGoogleRelease
    - ./gradlew useBlockstreamKeys
    - ./gradlew assembleProductionGoogleRelease

build_osx:
  stage: build
  when: manual
  tags:
    - osx
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - ./gradlew useBlockstreamKeys
    - ./gradlew assembleProductionGoogleRelease

#####################################
# Test

unit_tests:
  stage: test
  cache:
    policy: pull
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - ./gradlew useBlockstreamKeys
#    - ./gradlew lintProductionGoogleRelease
    - ./gradlew test

#####################################
# Sign production build

sign_google_play:
  tags:
    - garelease
  stage: deploy
  cache: []
  artifacts:
    name: "$CI_PROJECT_NAME-$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
    expire_in: 30 days
    paths:
      - green/build/outputs/*
    when: on_success
  script:
    - cd $CI_PROJECT_DIR/green/build/outputs/apk/productionGoogle/release/
    - /opt/process_release
  needs:
    - build_google_play

#####################################
# Upload to GCS bucket
.gcp_prep:
  stage: upload
  image: blockstream/gcloud-docker:502.0.0-27.3
  cache: []
  tags:
    - k8s # Simple, non-resource intensive jobs

gcp_auth:
  extends: .gcp_prep
  when: manual
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://gl.blockstream.io
  variables:
    POOL_ID: gitlab-2f4bb583
    PROVIDER_ID: gitlab
    SERVICE_ACCOUNT_EMAIL: green-android-builds-uploader@green-backend.iam.gserviceaccount.com
  script:
    - echo ${GITLAB_OIDC_TOKEN} > .ci_job_jwt_file
    - gcloud iam workload-identity-pools create-cred-config "projects/697214616889/locations/global/workloadIdentityPools/${POOL_ID}/providers/${PROVIDER_ID}"
      --service-account="${SERVICE_ACCOUNT_EMAIL}"
      --output-file=.gcp_temp_cred.json
      --credential-source-file=.ci_job_jwt_file
  artifacts:
    paths:
      - .gcp_temp_cred.json
      - .ci_job_jwt_file
    expire_in: 1h

gcp_push_production:
  extends: .gcp_prep
  needs: ["gcp_auth", "production"]
  variables:
    GCS_BUCKET: green-android-builds
    APK_NAME: $CI_PROJECT_NAME-$CI_COMMIT_SHA
  before_script:
    - gcloud auth login --cred-file=.gcp_temp_cred.json --update-adc
  script:
    - apk add libqrencode
    - echo "Uploading gs://$GCS_BUCKET/$APK_NAME"
    - gsutil -m cp -r $CI_PROJECT_DIR/green/build/outputs/apk/productionGoogle/release/*.apk gs://$GCS_BUCKET/$APK_NAME.apk
    - echo "https://storage.googleapis.com/$GCS_BUCKET/$APK_NAME.apk"
    - qrencode -t UTF8 "https://storage.googleapis.com/$GCS_BUCKET/$APK_NAME.apk"

gcp_push_development:
  extends: .gcp_prep
  needs: ["gcp_auth", "development"]
  variables:
    GCS_BUCKET: green-android-builds
    APK_NAME: $CI_PROJECT_NAME-$CI_COMMIT_SHA-development
  before_script:
    - gcloud auth login --cred-file=.gcp_temp_cred.json --update-adc
  script:
    - apk add libqrencode
    - echo "Uploading gs://$GCS_BUCKET/$APK_NAME"
    - gsutil -m cp -r $CI_PROJECT_DIR/green/build/outputs/apk/development/release/*.apk gs://$GCS_BUCKET/$APK_NAME.apk
    - echo "https://storage.googleapis.com/$GCS_BUCKET/$APK_NAME.apk"
    - qrencode -t UTF8 "https://storage.googleapis.com/$GCS_BUCKET/$APK_NAME.apk"

gcp_push_gdk_commit:
  extends: .gcp_prep
  needs: ["gcp_auth", "gdk_commit"]
  variables:
    GCS_BUCKET: green-android-builds
    APK_NAME: $CI_PROJECT_NAME-$CI_COMMIT_SHA-gdk
  before_script:
    - gcloud auth login --cred-file=.gcp_temp_cred.json --update-adc
  script:
    - apk add libqrencode
    - echo "Uploading gs://$GCS_BUCKET/$APK_NAME"
    - gsutil -m cp -r $CI_PROJECT_DIR/green/build/outputs/apk/productionGoogle/release/*.apk gs://$GCS_BUCKET/$APK_NAME.apk
    - echo "https://storage.googleapis.com/$GCS_BUCKET/$APK_NAME.apk"
    - qrencode -t UTF8 "https://storage.googleapis.com/$GCS_BUCKET/$APK_NAME.apk"

gcp_push_xcframework:
  extends: .gcp_prep
  needs: ["gcp_auth", "xcframework"]
  variables:
    GCS_BUCKET: green-android-builds
    XCFRAMEWORK_NAME: green_xcframework-$CI_COMMIT_SHA
  before_script:
    - gcloud auth login --cred-file=.gcp_temp_cred.json --update-adc
  script:
    - apk add libqrencode
    - echo "Uploading gs://$GCS_BUCKET/${XCFRAMEWORK_NAME}_debug.zip"
    - gsutil -m cp -r $CI_PROJECT_DIR/common/build/XCFrameworks/release.zip gs://$GCS_BUCKET/${XCFRAMEWORK_NAME}_debug.zip
    - echo "https://storage.googleapis.com/$GCS_BUCKET/${XCFRAMEWORK_NAME}_debug.zip"
    - echo "Uploading gs://$GCS_BUCKET/${XCFRAMEWORK_NAME}_release.zip"
    - gsutil -m cp -r $CI_PROJECT_DIR/common/build/XCFrameworks/release.zip gs://$GCS_BUCKET/${XCFRAMEWORK_NAME}_release.zip
    - echo "https://storage.googleapis.com/$GCS_BUCKET/${XCFRAMEWORK_NAME}_release.zip"