name: Android CI/CD

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4

    - name: Set up JDK 17
      uses: actions/setup-java@v4
      with:
        java-version: '17'
        distribution: 'temurin'
        cache: gradle

    - name: Grant execute permission for gradlew
      run: chmod +x android-app/gradlew

    - name: Build with Gradle
      run: ./gradlew assembleDebug assembleDebugAndroidTest
      working-directory: android-app

    - name: Upload test APKs (shared with smoke-test job)
      uses: actions/upload-artifact@v4
      with:
        name: test-apks
        path: |
          android-app/app/build/outputs/apk/debug/app-debug.apk
          android-app/app/build/outputs/apk/androidTest/debug/app-debug-androidTest.apk

    - name: upload artifact to Firebase App Distribution
      if: github.ref == 'refs/heads/main'
      uses: wzieba/Firebase-Distribution-Github-Action@v1
      with:
        appId: ${{secrets.FIREBASE_APP_ID}}
        serviceCredentialsFileContent: ${{ secrets.CREDENTIAL_FILE_CONTENT }}
        groups: testers
        file: android-app/app/build/outputs/apk/debug/app-debug.apk

    - name: Notify claudomator
      if: always()
      env:
        CLAUDOMATOR_WEBHOOK_URL: ${{ secrets.CLAUDOMATOR_WEBHOOK_URL }}
        CLAUDOMATOR_WEBHOOK_SECRET: ${{ secrets.CLAUDOMATOR_WEBHOOK_SECRET }}
      run: |
        PAYLOAD=$(jq -n \
          --arg action "completed" \
          --arg conclusion "${{ job.status }}" \
          --arg name "${{ github.workflow }}" \
          --arg repo "${{ github.repository }}" \
          --arg sha "${{ github.sha }}" \
          --arg run_id "${{ github.run_id }}" \
          '{action: $action, workflow_run: {conclusion: $conclusion, name: $name, head_sha: $sha, id: ($run_id | tonumber)}, repository: {full_name: $repo}}')
        SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$CLAUDOMATOR_WEBHOOK_SECRET" | awk '{print $2}')
        curl -sf -X POST \
          -H "Content-Type: application/json" \
          -H "X-GitHub-Event: workflow_run" \
          -H "X-Hub-Signature-256: sha256=${SIG}" \
          "${CLAUDOMATOR_WEBHOOK_URL}/api/webhooks/github" \
          -d "$PAYLOAD"

  smoke-test:
    runs-on: ubuntu-latest
    # Run after build succeeds — no point spinning up an emulator for a broken build
    needs: build

    steps:
    - uses: actions/checkout@v4

    - name: Set up JDK 17
      uses: actions/setup-java@v4
      with:
        java-version: '17'
        distribution: 'temurin'
        cache: gradle

    - name: Grant execute permission for gradlew
      run: chmod +x android-app/gradlew

    # Restore pre-built APKs so the emulator job skips the compile step
    - name: Download test APKs
      uses: actions/download-artifact@v4
      with:
        name: test-apks
        path: .   # preserves android-app/app/build/outputs/… directory structure

    - name: Enable KVM (faster emulator)
      run: |
        echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
        sudo udevadm control --reload-rules
        sudo udevadm trigger --name-match=kvm

    # -x assembleDebug -x assembleDebugAndroidTest: skip recompile, use downloaded APKs
    - name: Run smoke tests on emulator
      uses: reactivecircus/android-emulator-runner@v2
      with:
        api-level: 30
        arch: x86_64
        profile: pixel_3a
        script: ./gradlew connectedDebugAndroidTest -x assembleDebug -x assembleDebugAndroidTest
        working-directory: android-app

    - name: Upload test results
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: smoke-test-results
        path: android-app/app/build/outputs/androidTest-results/

    - name: Notify claudomator
      if: always()
      env:
        CLAUDOMATOR_WEBHOOK_URL: ${{ secrets.CLAUDOMATOR_WEBHOOK_URL }}
        CLAUDOMATOR_WEBHOOK_SECRET: ${{ secrets.CLAUDOMATOR_WEBHOOK_SECRET }}
      run: |
        PAYLOAD=$(jq -n \
          --arg action "completed" \
          --arg conclusion "${{ job.status }}" \
          --arg name "${{ github.workflow }} / smoke-test" \
          --arg repo "${{ github.repository }}" \
          --arg sha "${{ github.sha }}" \
          --arg run_id "${{ github.run_id }}" \
          '{action: $action, workflow_run: {conclusion: $conclusion, name: $name, head_sha: $sha, id: ($run_id | tonumber)}, repository: {full_name: $repo}}')
        SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$CLAUDOMATOR_WEBHOOK_SECRET" | awk '{print $2}')
        curl -sf -X POST \
          -H "Content-Type: application/json" \
          -H "X-GitHub-Event: workflow_run" \
          -H "X-Hub-Signature-256: sha256=${SIG}" \
          "${CLAUDOMATOR_WEBHOOK_URL}/api/webhooks/github" \
          -d "$PAYLOAD"