ci.yml

name: CI
on:
  pull_request:
concurrency:
  # Limit concurrency to 1 for PRs. 'main' concurrency isn't limited.
  group: ${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

env:
  CI: true
  JAVA_VERSION: 17

jobs:
  flipcash-tests:
    name: Run Flipcash Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      # Cheap supply-chain guard: fails the run if gradle/wrapper/gradle-wrapper.jar
      # is not a byte-for-byte match for a jar published by Gradle.
      - name: Validate Gradle wrapper
        uses: gradle/actions/wrapper-validation@v4

      - name: Setup Java env
        uses: actions/setup-java@v3
        with:
          java-version: '21'
          distribution: 'corretto'
          cache: 'gradle'

      - name: Gradle build cache
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches/build-cache-1
            .gradle/configuration-cache
          key: gradle-build-cache-${{ hashFiles('**/*.gradle.kts', 'gradle.properties') }}
          restore-keys: |
            gradle-build-cache-

      - name: Setup Ruby env
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: 2.7.2
          bundler-cache: true

      # GitHub does not expose regular Actions secrets to `pull_request` runs opened by
      # Dependabot (it reads from a separate Dependabot secret store) or by forks, so every
      # `secrets.*` below resolves to an empty string on those runs. This lane only builds and
      # runs unit tests + lint — it never talks to Firebase, Bugsnag, Mixpanel or Coinbase — so
      # it falls back to a committed placeholder config instead of failing. That keeps dependency
      # PRs honestly red or green on the bump itself rather than uniformly red on missing config.
      #
      # If a future job in this workflow ever needs the *real* values on Dependabot PRs, add them
      # under Settings -> Secrets and variables -> Dependabot (repo admin required); the names are
      # the same ones referenced here.
      - name: Provision google-services.json
        env:
          FLIPCASH2_GOOGLE_SERVICES: ${{ secrets.FLIPCASH2_GOOGLE_SERVICES }}
        run: |
          set -euo pipefail
          dest=apps/flipcash/app/src/google-services.json
          mkdir -p "$(dirname "$dest")"
          if [ -n "${FLIPCASH2_GOOGLE_SERVICES:-}" ]; then
            printf '%s' "$FLIPCASH2_GOOGLE_SERVICES" | base64 --decode > "$dest"
            echo "Wrote google-services.json from the FLIPCASH2_GOOGLE_SERVICES secret."
          else
            cp .github/ci/google-services.placeholder.json "$dest"
            echo "::notice title=Using placeholder Firebase config::Repository secrets are not available on this run (Dependabot or fork PR). Copied .github/ci/google-services.placeholder.json instead; unit tests and lint do not need real Firebase credentials."
          fi

      # The secrets Gradle plugin copies every entry in local.properties into BuildConfig
      # verbatim, so an *empty* value emits `public static final String X = ;` and the app fails
      # to compile — writing empty strings is not a safe fallback. Each key therefore gets a
      # zero-filled placeholder when its secret is unavailable (Dependabot / fork PRs); nothing
      # in this lane calls out to Bugsnag, Mixpanel or Coinbase.
      #
      # Values are passed through the environment rather than interpolated into the script so a
      # secret containing a quote or backtick cannot break (or escape) the shell. The quoting of
      # each line is kept exactly as it was, since BUGSNAG_API_KEY is also read verbatim into a
      # manifest placeholder.
      - name: Write local.properties
        env:
          BUGSNAG_API_KEY: ${{ secrets.FLIPCASH_BUGSNAG_API_KEY }}
          GOOGLE_CLOUD_PROJECT_NUMBER: ${{ secrets.GOOGLE_CLOUD_PROJECT_NUMBER }}
          MIXPANEL_API_KEY: ${{ secrets.FLIPCASH_MIXPANEL_API_KEY }}
          COINBASE_ONRAMP_API_KEY: ${{ secrets.COINBASE_ONRAMP_API_KEY }}
        run: |
          set -euo pipefail
          # Substitute an obviously-fake value for any key whose secret came through empty.
          placeheld=""
          for spec in \
            "BUGSNAG_API_KEY=00000000000000000000000000000000" \
            "GOOGLE_CLOUD_PROJECT_NUMBER=000000000000" \
            "MIXPANEL_API_KEY=00000000000000000000000000000000" \
            "COINBASE_ONRAMP_API_KEY=00000000-0000-0000-0000-000000000000"
          do
            name=${spec%%=*}
            if [ -z "${!name:-}" ]; then
              printf -v "$name" '%s' "${spec#*=}"
              placeheld="$placeheld $name"
            fi
          done
          {
            echo "BUGSNAG_API_KEY=\"$BUGSNAG_API_KEY\""
            echo "GOOGLE_CLOUD_PROJECT_NUMBER=$GOOGLE_CLOUD_PROJECT_NUMBER"
            echo "MIXPANEL_API_KEY=\"$MIXPANEL_API_KEY\""
            echo "COINBASE_ONRAMP_API_KEY=$COINBASE_ONRAMP_API_KEY"
          } > ./local.properties
          [ -z "$placeheld" ] || echo "::notice title=Using placeholder API keys::Secrets are not available on this run (Dependabot or fork PR); zero-filled placeholders used for:$placeheld"

      - name: Run Flipcash tests
        run: bundle exec fastlane android flipcash_tests
        env:
          SKIP_COVERAGE: "true"

  # TODO(cross-platform-vectors): wire instrumented vector tests once this CI has emulator support.
  #
  # Three androidTest suites require a device/emulator (JNI or Android-framework deps):
  #   - :libs:encryption:ed25519  connectedAndroidTest  (JNI + android.util.Base64)
  #   - :libs:encryption:mnemonic connectedAndroidTest  (wordlist in res/raw + JNI ed25519)
  #   - :libs:currency-math       connectedAndroidTest  (loads .bin tables from assets)
  #
  # To add: create a new job (e.g. `vector-instrumented-tests`) with:
  #   runs-on: ubuntu-latest          # or macos-latest (faster KVM on Linux)
  #   steps:
  #     - uses: actions/checkout@v4
  #     - uses: actions/setup-java@v3 (java-version: '21', distribution: 'corretto')
  #     - uses: reactivecircus/android-emulator-runner@v2
  #       with:
  #         api-level: 35             # matches compileSdk in build-logic convention plugins
  #         arch: x86_64
  #         script: >
  #           ./gradlew
  #             :libs:encryption:ed25519:connectedAndroidTest
  #             :libs:encryption:mnemonic:connectedAndroidTest
  #             :libs:currency-math:connectedAndroidTest
  #           --no-daemon
  #
  # The host-JVM vector suites (base58, solana_message, compact_message) are already covered by
  # the flipcash-tests job above via `flipcashTestDebug` → :libs:encryption:base58 and
  # :services:opencode are now in unitTestPaths (see settings.gradle.kts).