build-android.yml

# Builds the Logseq Android app as a signed release APK and uploads it as a
# workflow artifact for download. Modeled on logseq/logseq's build-android.yml;
# the Play upload steps are intentionally left out for now.

name: Build-Android

on:
  workflow_dispatch:
    inputs:
      git-ref:
        description: "Release Git Ref (Which branch or tag to build?)"
        required: true
        default: "main"

env:
  JAVA_VERSION: '21'
  LOGSEQ_ANDROID_ABI: arm64-v8a

jobs:
  build-apk:
    runs-on: ubuntu-latest
    timeout-minutes: 120
    env:
      LOGSEQ_OPAM_SWITCH: ${{ github.workspace }}
      GIT_TERMINAL_PROMPT: "0"
      GIT_CONFIG_COUNT: 3
      GIT_CONFIG_KEY_0: url.https://github.com/.insteadOf
      GIT_CONFIG_VALUE_0: "git@github.com:"
      GIT_CONFIG_KEY_1: url.https://github.com/.insteadOf
      GIT_CONFIG_VALUE_1: "ssh://git@github.com/"
      GIT_CONFIG_KEY_2: url.https://github.com/.insteadOf
      GIT_CONFIG_VALUE_2: "git+ssh://git@github.com/"
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.git-ref }}

      - name: System dependencies
        run: sudo apt-get install -y libsqlite3-dev libffi-dev pkg-config

      - name: Setup Java JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: ${{ env.JAVA_VERSION }}

      - name: Restore opam root
        id: opam-root
        uses: actions/cache/restore@v4
        with:
          path: ~/.opam
          key: opam-root-${{ runner.os }}-ocaml-5.5

      - name: Restore opam switch
        id: opam-switch
        uses: actions/cache/restore@v4
        with:
          path: _opam
          key: opam-switch-${{ runner.os }}-ocaml-5.5-${{ hashFiles('logseq.opam.locked', 'logseq.opam', '.github/workflows/ci.yml') }}

      # See ci.yml: on a dual cache hit only the opam binary is needed.
      - name: Install opam binary
        if: steps.opam-root.outputs.cache-hit == 'true' && steps.opam-switch.outputs.cache-hit == 'true'
        run: |
          mkdir -p ~/.local/bin
          curl -fsSL https://github.com/ocaml/opam/releases/download/2.6.0/opam-2.6.0-x86_64-linux -o ~/.local/bin/opam
          chmod +x ~/.local/bin/opam
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
          eval $(opam env)
          opam --version && ocaml -version

      - uses: ocaml/setup-ocaml@v3
        if: steps.opam-root.outputs.cache-hit != 'true' || steps.opam-switch.outputs.cache-hit != 'true'
        with:
          ocaml-compiler: "5.5"
          opam-pin: false

      - name: Save opam root
        if: steps.opam-root.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: ~/.opam
          key: opam-root-${{ runner.os }}-ocaml-5.5

      - name: Install opam dependencies
        if: steps.opam-switch.outputs.cache-hit != 'true'
        run: |
          eval $(opam env)
          opam pin add -n -y melange-edn-core git+https://github.com/logseq/melange-edn.git#main
          opam pin add -n -y melange-edn-native git+https://github.com/logseq/melange-edn.git#main
          opam pin add -n -y melange-transit-core git+https://github.com/logseq/melange-transit.git#main
          opam pin add -n -y melange-transit-native git+https://github.com/logseq/melange-transit.git#main
          opam install . --deps-only --yes --with-test --assume-depexts
          # Drop installed copies of lockfile-vendored packages (see ci.yml).
          comm -12 \
            <(grep -oE '"[a-zA-Z0-9_.-]+" \{= "[^"]*" & \?vendor\}' logseq.opam.locked | cut -d'"' -f2 | sort) \
            <(opam list --installed --short | sort) \
            | xargs -r opam remove -y
          opam install -y melange.7.0.1-55
          opam install -y opam-monorepo.0.3.6

      - name: Save opam switch
        if: steps.opam-switch.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: _opam
          key: opam-switch-${{ runner.os }}-ocaml-5.5-${{ hashFiles('logseq.opam.locked', 'logseq.opam', '.github/workflows/ci.yml') }}

      # Share ci.yml's duniverse cache key so a CI-populated cache is reused.
      - name: Restore duniverse
        id: duniverse
        uses: actions/cache/restore@v4
        with:
          path: duniverse
          key: duniverse-${{ hashFiles('logseq.opam.locked', 'logseq.opam', '.github/workflows/ci.yml') }}

      - name: Pull vendored dependencies
        if: steps.duniverse.outputs.cache-hit != 'true'
        run: |
          set -e
          eval $(opam env)
          git config --global url."https://github.com/".insteadOf "git@github.com:"
          git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
          git config --global url."https://github.com/".insteadOf "git+ssh://git@github.com/"
          for attempt in 1 2 3; do
            opam exec -- opam-monorepo pull && break
            [ "$attempt" -lt 3 ] || exit 1
            echo "opam-monorepo pull failed (attempt $attempt); retrying" >&2
            sleep 10
          done
          for pin in $(grep -oE 'logseq/[A-Za-z0-9_-]+\.git#[A-Za-z0-9._/-]+' logseq.opam | sort -u); do
            url="${pin%%#*}"; sha="${pin##*#}"; name="$(basename "$url" .git)"
            if [ -d "duniverse/$name" ]; then
              continue
            fi
            git clone --quiet "https://github.com/$url" "duniverse/$name"
            if ! git -C "duniverse/$name" checkout --quiet "$sha"; then
              git -C "duniverse/$name" fetch --quiet "https://github.com/$url" "$sha"
              git -C "duniverse/$name" checkout --quiet FETCH_HEAD
            fi
          done

      - name: Save duniverse
        if: steps.duniverse.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: duniverse
          key: duniverse-${{ hashFiles('logseq.opam.locked', 'logseq.opam', '.github/workflows/ci.yml') }}

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3.2.2
        with:
          packages: platform-tools

      - name: Accept Android SDK licenses
        run: yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses || true

      - name: Restore Android OCaml toolchain
        id: android-toolchain
        uses: actions/cache/restore@v4
        with:
          path: |
            _build/android-toolchain
            _build/android-dependency-sources
            _build/android-sqlite-host
          key: android-toolchain-${{ runner.os }}-arm64-v8a-5.5.0-${{ hashFiles('scripts/bootstrap-android-ocaml.sh', 'scripts/build-mobile-libffi.sh') }}

      - name: Restore Android native build cache
        # CMake intermediate objects under .cxx survive source-unchanged
        # rebuilds; the sha key falls back to the previous commit's tree.
        uses: actions/cache/restore@v4
        with:
          path: |
            android/app/.cxx
            android/app/build/intermediates
          key: android-native-${{ runner.os }}-${{ github.sha }}
          restore-keys: |
            android-native-${{ runner.os }}-

      - name: Build Android release APK
        # assembleRelease depends on buildAndroidNativeCore, which runs
        # scripts/build-android-native.sh for $LOGSEQ_ANDROID_ABI; the Kotlin
        # :lui module resolves to duniverse/lui/platform/android/lui.
        run: |
          eval $(opam env)
          export LOGSEQ_OPAM_SWITCH="$(opam switch show)"
          export DUNE="$(command -v dune)"
          ./gradlew :app:assembleRelease
        working-directory: android

      - name: Save Android OCaml toolchain
        if: always() && steps.android-toolchain.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: |
            _build/android-toolchain
            _build/android-dependency-sources
            _build/android-sqlite-host
          key: android-toolchain-${{ runner.os }}-arm64-v8a-5.5.0-${{ hashFiles('scripts/bootstrap-android-ocaml.sh', 'scripts/build-mobile-libffi.sh') }}

      - name: Save Android native build cache
        if: always()
        uses: actions/cache/save@v4
        with:
          path: |
            android/app/.cxx
            android/app/build/intermediates
          key: android-native-${{ runner.os }}-${{ github.sha }}

      - name: Sign Android APK
        run: |
          echo ${{ secrets.ANDROID_KEYSTORE }} | base64 -d > keystore.jks
          $ANDROID_SDK_ROOT/build-tools/34.0.0/apksigner sign \
            --ks keystore.jks --ks-pass "pass:${{ secrets.ANDROID_KEYSTORE_PASSWORD }}" \
            --in app/build/outputs/apk/release/app-release-unsigned.apk \
            --out app-signed.apk
        working-directory: android

      - name: Rename APK
        run: |
          mkdir builds
          mv android/app-signed.apk "./builds/Logseq-android-${GITHUB_SHA::7}.apk"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: logseq-android-builds
          path: builds