android.yml

name: Android

on:
  push:
    branches: ["master"]
  pull_request:
    branches: ["**"]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  repository-gates:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Check live repository hygiene and structure
        env:
          BASE_REF: ${{ github.event.pull_request.base.sha || github.event.before }}
        run: pwsh -ExecutionPolicy Bypass -File ./scripts/check_repo_hygiene.ps1 -IncludeStructure

      - name: Check live documentation index and authority links
        run: pwsh -ExecutionPolicy Bypass -File ./scripts/check_docs_index.ps1

      - name: Check open-source maintenance and public asset identity
        run: pwsh -ExecutionPolicy Bypass -File ./scripts/check_open_source_readiness.ps1

      - name: Smoke-test repository hygiene rules
        run: pwsh -ExecutionPolicy Bypass -File ./scripts/test_repo_hygiene.ps1

      - name: Smoke-test open-source readiness and release manifests
        run: |
          pwsh -ExecutionPolicy Bypass -File ./scripts/test_check_open_source_readiness.ps1
          pwsh -ExecutionPolicy Bypass -File ./scripts/test_generate_release_manifest.ps1

      - name: Smoke-test project structure rules
        run: pwsh -ExecutionPolicy Bypass -File ./scripts/test_check_project_structure.ps1

      - name: Smoke-test documentation index rules
        run: pwsh -ExecutionPolicy Bypass -File ./scripts/test_check_docs_index.ps1

  unit-tests-and-lint:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up JDK 17
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: temurin
          java-version: "17"
          cache: gradle

      - name: Grant Gradle execute permission
        run: chmod +x ./gradlew

      - name: Run unit tests and lint
        run: >-
          ./gradlew
          --max-workers=2
          "-Dorg.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8"
          :core:assist:test
          :core:ustrf:test
          :core:vision:testDebugUnitTest
          :core:device:testDebugUnitTest
          :core:ui:testDebugUnitTest
          :feature:assist:testDebugUnitTest
          :app:testDebugUnitTest
          :app:lintDebug
          :core:vision:lintDebug
          :core:device:lintDebug
          :core:ui:lintDebug
          :feature:assist:lintDebug

      - name: Ensure generated files are ignored
        shell: pwsh
        run: |
          $status = git status --short
          if ($status) {
            Write-Host "Tracked or unignored files changed during CI:"
            Write-Host $status
            exit 1
          }

  formal-app:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up JDK 17
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: temurin
          java-version: "17"
          cache: gradle

      - name: Grant Gradle execute permission
        run: chmod +x ./gradlew

      - name: Assemble formal App artifacts
        run: >-
          ./gradlew
          --max-workers=2
          "-Dorg.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8"
          :app:assembleDebug
          :app:assembleDebugAndroidTest
          :app:bundleDebug
          :app:mergeReleaseAssets

      - name: Reject legacy TensorFlow Lite runtime dependencies
        shell: pwsh
        run: |
          $gradleArgs = @(
            '--max-workers=2',
            '-Dorg.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8'
          )
          $appDependencies = (& ./gradlew @gradleArgs :app:dependencies --configuration debugRuntimeClasspath) -join "`n"
          if ($LASTEXITCODE -ne 0) {
            throw "Could not inspect the app runtime dependency tree."
          }
          $benchmarkDependencies = (& ./gradlew @gradleArgs :device-benchmark:dependencies --configuration debugRuntimeClasspath) -join "`n"
          if ($LASTEXITCODE -ne 0) {
            throw "Could not inspect the benchmark runtime dependency tree."
          }
          $dependencyTrees = "$appDependencies`n$benchmarkDependencies"
          if ($dependencyTrees -match 'org\.tensorflow:tensorflow-lite') {
            throw "Legacy org.tensorflow:tensorflow-lite dependency detected."
          }

      - name: Verify APK 16KB page-size compatibility
        shell: pwsh
        run: |
          pwsh -ExecutionPolicy Bypass -File ./scripts/verify_apk_16kb.ps1 -ArtifactPath ./app/build/outputs/apk/debug/app-debug.apk -AndroidSdkRoot $env:ANDROID_SDK_ROOT
          $bundletool = Join-Path $env:RUNNER_TEMP 'bundletool-all-1.17.1.jar'
          Invoke-WebRequest -Uri 'https://github.com/google/bundletool/releases/download/1.17.1/bundletool-all-1.17.1.jar' -OutFile $bundletool
          $expectedBundletoolSha256 = '45881EAD13388872D82C4255B195488B7FC33F2CAC5A9A977B0AFC5E92367592'
          $actualBundletoolSha256 = (Get-FileHash -LiteralPath $bundletool -Algorithm SHA256).Hash
          if (-not $actualBundletoolSha256.Equals(
              $expectedBundletoolSha256,
              [System.StringComparison]::OrdinalIgnoreCase
            )) {
            throw "bundletool SHA-256 mismatch. Expected $expectedBundletoolSha256, got $actualBundletoolSha256."
          }
          pwsh -ExecutionPolicy Bypass -File ./scripts/verify_apk_16kb.ps1 -ArtifactPath ./app/build/outputs/bundle/debug/app-debug.aab -BundletoolPath $bundletool

      - name: Verify replay assets stay out of release
        shell: pwsh
        run: |
          $releaseAssets = './app/build/intermediates/assets/release/mergeReleaseAssets'
          if (Test-Path (Join-Path $releaseAssets 'replay')) {
            throw 'Debug-only replay assets leaked into the release asset set.'
          }

      - name: Ensure generated files are ignored
        shell: pwsh
        run: |
          $status = git status --short
          if ($status) {
            Write-Host "Tracked or unignored files changed during CI:"
            Write-Host $status
            exit 1
          }

  ustrf:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up JDK 17
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: temurin
          java-version: "17"
          cache: gradle

      - name: Grant Gradle execute permission
        run: chmod +x ./gradlew

      - name: Assemble USTRF artifacts
        run: >-
          ./gradlew
          --max-workers=2
          "-Dorg.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8"
          :app:assembleUstrfExperiment
          :ustrf-shadow-benchmark:assembleDebug
          :ustrf-shadow-benchmark:compileDebugAndroidTestKotlin

      - name: Ensure generated files are ignored
        shell: pwsh
        run: |
          $status = git status --short
          if ($status) {
            Write-Host "Tracked or unignored files changed during CI:"
            Write-Host $status
            exit 1
          }

  npu-benchmark:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up JDK 17
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          distribution: temurin
          java-version: "17"
          cache: gradle

      - name: Grant Gradle execute permission
        run: chmod +x ./gradlew

      - name: Assemble NPU candidate
        run: >-
          ./gradlew
          --max-workers=2
          "-Dorg.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8"
          :npu-candidate:assembleDebug

      - name: Assemble device benchmark
        run: >-
          ./gradlew
          --max-workers=2
          "-Dorg.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8"
          :device-benchmark:assembleDebug

      - name: Ensure generated files are ignored
        shell: pwsh
        run: |
          $status = git status --short
          if ($status) {
            Write-Host "Tracked or unignored files changed during CI:"
            Write-Host $status
            exit 1
          }

  research-contracts-and-models:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up Python for model checks
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"

      - name: Run dependency-free research contract tests
        run: python scripts/run_research_contract_tests.py

      - name: Install TFLite inspection runtime
        shell: pwsh
        run: |
          # Locked to the Python 3.12 Linux wheels used by this ubuntu-latest job.
          $requirements = @'
          ai-edge-litert==2.1.5 --hash=sha256:f1c6d8db4382890881baeb8ed13c0802ada022e0b104b0db8fccf31353899ee0
          backports.strenum==1.2.8 --hash=sha256:fc297cb26971f7d5e15a478a06a78575197f81daea47975771b1aae996dcccf4
          colorama==0.4.6 --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
          flatbuffers==25.12.19 --hash=sha256:7634f50c427838bb021c2d66a3d1168e9d199b0607e6329399f04846d42e20b4
          numpy==2.1.3 --hash=sha256:2312b2aa89e1f43ecea6da6ea9a810d06aae08321609d8dc0d0eda6d946a541b
          protobuf==5.29.6 --hash=sha256:e3387f44798ac1106af0233c04fb8abf543772ff241169946f698b3a9a3d3ab9
          tqdm==4.67.3 --hash=sha256:ee1e4c0e59148062281c49d80b25b67771a127c85fc9676d3be5f243206826bf
          typing-extensions==4.15.0 --hash=sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548
          '@
          $requirementsPath = Join-Path $env:RUNNER_TEMP 'tflite-inspection-requirements.txt'
          [System.IO.File]::WriteAllText(
            $requirementsPath,
            $requirements + [Environment]::NewLine,
            [System.Text.UTF8Encoding]::new($false)
          )
          python -m pip install --disable-pip-version-check --only-binary=:all: --require-hashes -r $requirementsPath

      - name: Check TFLite model assets
        run: python scripts/inspect_tflite.py

      - name: Ensure generated files are ignored
        shell: pwsh
        run: |
          $status = git status --short
          if ($status) {
            Write-Host "Tracked or unignored files changed during CI:"
            Write-Host $status
            exit 1
          }