name: mobile Android screenshots

on:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: mobile-android-screenshots-${{ github.ref }}
  cancel-in-progress: true

jobs:
  screenshots:
    name: Capture Android UI
    runs-on: [self-hosted, evoo-ci, Linux]
    timeout-minutes: 45
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: rakazo
          POSTGRES_PASSWORD: rakazo
          POSTGRES_DB: rakazo
        ports:
          - 5433:5432
        options: >-
          --health-cmd "pg_isready -U rakazo"
          --health-interval 3s
          --health-timeout 5s
          --health-retries 20
    env:
      CI: "1"
      DATABASE_URL: postgres://rakazo:rakazo@127.0.0.1:5433/rakazo
      EXPO_PUBLIC_API_URL: http://10.0.2.2:3110

    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
        with:
          persist-credentials: false

      # Runner-host caches only: never GitHub's cache or artifact storage.
      - name: Restore screenshot APK
        id: screenshot-apk
        env:
          APK_KEY: ${{ hashFiles('pnpm-lock.yaml', 'package.json', 'pnpm-workspace.yaml', 'turbo.json', 'tsconfig*.json', '.github/workflows/mobile-android-screenshots.yml', 'apps/mobile/package.json', 'apps/mobile/app.json', 'apps/mobile/app.config.ts', 'apps/mobile/metro.config.js', 'apps/mobile/metro-resolver.js', 'apps/mobile/assets/**', 'apps/mobile/app/**', 'apps/mobile/components/**', 'apps/mobile/lib/**', 'apps/mobile/modules/**', 'apps/mobile/plugins/**', 'packages/chat-ui/**', 'packages/contracts/**', 'packages/core/**', 'packages/ui-tokens/**') }}
        run: |
          set -euo pipefail
          cache="$HOME/.cache/evoo-ci/mobile-android-apk"
          echo "path=$cache/v2-$APK_KEY.apk" >> "$GITHUB_OUTPUT"
          if [[ -f "$cache/v2-$APK_KEY.apk" ]]; then
            mkdir -p apps/mobile/android/app/build/outputs/apk/release
            cp "$cache/v2-$APK_KEY.apk" apps/mobile/android/app/build/outputs/apk/release/app-release.apk
            echo "cache-hit=true" >> "$GITHUB_OUTPUT"
          fi

      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 22
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
        with:
          distribution: temurin
          java-version: 17

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install pinned Maestro CLI
        run: |
          set -euo pipefail
          if [[ -f "$HOME/.maestro/.installed-2.6.1-3440825f" ]]; then
            exit 0
          fi
          maestro_tmp=$(mktemp -d)
          trap 'rm -rf "$maestro_tmp"' EXIT
          base_url=https://github.com/mobile-dev-inc/maestro/releases/download/cli-2.6.1
          curl --fail --silent --show-error --location \
            "$base_url/maestro.zip" \
            --output "$maestro_tmp/maestro.zip"
          curl --fail --silent --show-error --location \
            "$base_url/checksums_sha256.txt" \
            --output "$maestro_tmp/checksums_sha256.txt"
          # Pin the expected digest in-repo so a swapped checksums file alone cannot pass.
          echo "3440825f514f537c6a96bcf5de995780c2a4a7f83a43208fdc95d4f1fecfad3b  maestro.zip" |
            (cd "$maestro_tmp" && sha256sum --check --strict -)
          (cd "$maestro_tmp" && sha256sum --check --strict checksums_sha256.txt)
          unzip -q "$maestro_tmp/maestro.zip" -d "$maestro_tmp"
          rm -rf "$HOME/.maestro"
          mkdir -p "$HOME/.maestro"
          cp -R "$maestro_tmp/maestro/." "$HOME/.maestro/"
          touch "$HOME/.maestro/.installed-2.6.1-3440825f"

      - name: Configure Maestro CLI
        run: |
          "$HOME/.maestro/bin/maestro" --version
          echo "$HOME/.maestro/bin" >> "$GITHUB_PATH"

      - name: Generate Android project
        if: steps.screenshot-apk.outputs.cache-hit != 'true'
        run: |
          pnpm --filter @rakazo/mobile exec expo prebuild --platform android --no-install
          sed -i 's/<application /<application android:usesCleartextTraffic="true" /' \
            apps/mobile/android/app/src/main/AndroidManifest.xml
          sed -i 's/MaxMetaspaceSize=512m/MaxMetaspaceSize=1g/' \
            apps/mobile/android/gradle.properties

      - name: Build screenshot APK
        if: steps.screenshot-apk.outputs.cache-hit != 'true'
        working-directory: apps/mobile/android
        run: ./gradlew app:packageRelease -PreactNativeArchitectures=x86_64 --no-daemon

      - name: Save screenshot APK
        if: steps.screenshot-apk.outputs.cache-hit != 'true'
        env:
          APK_CACHE: ${{ steps.screenshot-apk.outputs.path }}
        run: |
          set -euo pipefail
          mkdir -p "$(dirname "$APK_CACHE")"
          find "$(dirname "$APK_CACHE")" -name '*.apk' -mtime +14 -delete
          cp apps/mobile/android/app/build/outputs/apk/release/app-release.apk "$APK_CACHE.partial"
          mv "$APK_CACHE.partial" "$APK_CACHE"

      - name: Enable KVM
        run: |
          echo 'KERNEL=="kvm",GROUP="kvm",MODE="0666",OPTIONS+="static_node=kvm"' |
            sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Capture screenshots
        uses: reactivecircus/android-emulator-runner@c9c93e6ba9c4194322e114c40970d5983d9a07cc # v2.38.0
        with:
          api-level: 34
          target: google_apis
          arch: x86_64
          profile: pixel_6
          cores: 2
          ram-size: 4096M
          disable-animations: true
          emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
          script: bash .github/scripts/capture-mobile-android-screenshots.sh

      - name: Publish screenshot gallery
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: ${{ vars.S3_REGION }}
          AWS_EC2_METADATA_DISABLED: "true"
          S3_BUCKET: ${{ vars.S3_BUCKET }}
          S3_ENDPOINT: ${{ vars.S3_ENDPOINT }}
          PLAYWRIGHT_PUBLIC_BASE_URL: ${{ vars.PLAYWRIGHT_PUBLIC_BASE_URL }}
          MOBILE_RUN_ATTEMPT: ${{ github.run_attempt }}
          MOBILE_RUN_ID: ${{ github.run_id }}
          MOBILE_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          MOBILE_SHA: ${{ github.sha }}
        run: bash scripts/publish-mobile-screenshot-gallery.sh