first init

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build and test
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    defaults:
+      run:
+        working-directory: android-app
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 21
+
+      - uses: gradle/actions/setup-gradle@v5
+
+      - name: Unit tests
+        run: ./gradlew testFossDebugUnitTest testGmsDebugUnitTest
+
+      - name: Assemble debug APKs
+        run: ./gradlew assembleFossDebug assembleGmsDebug
+
+      - name: Upload test reports
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-reports
+          path: android-app/app/build/reports/tests/
+          retention-days: 7
+
+      - name: Upload debug APKs
+        uses: actions/upload-artifact@v4
+        with:
+          name: debug-apks
+          path: android-app/app/build/outputs/apk/*/debug/*.apk
+          retention-days: 7

.github/workflows/release.yml

@@ -0,0 +1,87 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: Build and publish release
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    defaults:
+      run:
+        working-directory: android-app
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Check tag matches app version
+        id: version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          app_version=$(sed -n 's/.*ClientVersion\.validate("\([^"]*\)").*/\1/p' app/build.gradle.kts)
+          if [ "$tag" != "$app_version" ]; then
+            echo "::error::Tag $GITHUB_REF_NAME does not match versionName $app_version in app/build.gradle.kts"
+            exit 1
+          fi
+          echo "name=$app_version" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 21
+
+      - uses: gradle/actions/setup-gradle@v5
+        with:
+          cache-read-only: true
+
+      - name: Restore signing keystore
+        env:
+          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
+        run: |
+          if [ -z "$KEYSTORE_BASE64" ]; then
+            echo "::error::KEYSTORE_BASE64 secret is not set"
+            exit 1
+          fi
+          echo "$KEYSTORE_BASE64" | base64 --decode > "$RUNNER_TEMP/release.jks"
+          echo "HHO_KEYSTORE_FILE=$RUNNER_TEMP/release.jks" >> "$GITHUB_ENV"
+
+      - name: Unit tests
+        run: ./gradlew testFossDebugUnitTest testGmsDebugUnitTest
+
+      - name: Assemble release APKs
+        env:
+          HHO_KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          HHO_KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          HHO_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+        run: ./gradlew assembleFossRelease assembleGmsRelease
+
+      - name: Collect artifacts
+        env:
+          VERSION: ${{ steps.version.outputs.name }}
+        run: |
+          mkdir -p dist
+          for flavor in foss gms; do
+            cp "app/build/outputs/apk/$flavor/release/app-$flavor-release.apk" "dist/hho-$VERSION-$flavor.apk"
+          done
+          cd dist
+          sha256sum *.apk > SHA256SUMS
+
+      - name: Remove keystore
+        if: always()
+        run: rm -f "$RUNNER_TEMP/release.jks"
+
+      - name: Publish GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          name: ${{ steps.version.outputs.name }}
+          generate_release_notes: true
+          fail_on_unmatched_files: true
+          files: |
+            android-app/dist/*.apk
+            android-app/dist/SHA256SUMS