ci.yml

name: CI

on:
  push:
    branches: [main]
  workflow_dispatch:
  schedule:
    - cron: '17,47 * * * *'

permissions:
  contents: read

concurrency:
  group: zhuobrowser-ci-${{ github.ref }}
  cancel-in-progress: true

env:
  PATH: /Users/liang/Library/Huawei/CommandLineTools/current/bin:/Users/liang/.nvm/versions/node/v24.19.0/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin
  HVIGOR_BIN: /Users/liang/Library/Huawei/CommandLineTools/current/bin/hvigorw
  HARMONY_SIGNING_SOURCE: /Users/liang/.config/zhuobrowser/signing.json

jobs:
  inspect:
    name: Check canonical signing inputs
    runs-on: [self-hosted, macOS, ARM64, harmonyos, zhuobrowser]
    outputs:
      changed: ${{ steps.inputs.outputs.changed }}
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - id: inputs
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
        run: |
          set -euo pipefail
          changed=true
          if [[ "$EVENT_NAME" == schedule ]]; then
            changed="$(node scripts/mobile_cicd/signing-source.mjs changed)"
          fi
          echo "changed=$changed" >> "$GITHUB_OUTPUT"

  quality:
    needs: inspect
    if: needs.inspect.outputs.changed == 'true'
    name: Validate shared contracts
    runs-on: [self-hosted, macOS, ARM64, harmonyos, zhuobrowser]
    timeout-minutes: 30
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0

      - name: Verify trusted runner
        run: |
          set -euo pipefail
          test "$(uname -m)" = "arm64"
          command -v node
          command -v actionlint
          df -Pk . | awk 'NR == 2 { if ($4 < 4194304) { print "At least 4 GiB free disk is required."; exit 1 } }'

      - name: Validate CI/CD contracts
        run: |
          set -euo pipefail
          actionlint -color
          python3 scripts/mobile_cicd/check_ci_cost_contract.py
          node --test scripts/mobile_cicd/*.test.mjs
          for script in scripts/mobile_cicd/*.sh; do bash -n "$script"; done
          git log -1 --check --format=

      - name: Run browser regression tests
        run: |
          set -euo pipefail
          node --test scripts/*.test.mjs
          node --test core/test/*.test.mjs
          node core/src/export-js.mjs --check
          node core/src/export-content-rules.mjs --check

      - name: Validate mobile distribution Worker
        working-directory: cloudflare/mobile-distribution
        run: |
          set -euo pipefail
          npm ci
          npm run typecheck
          npm test
          npm run verify:worker

  ios:
    needs: [inspect, quality]
    if: needs.inspect.outputs.changed == 'true'
    name: Test and build iOS app
    runs-on: [self-hosted, macOS, ARM64, harmonyos, zhuobrowser]
    timeout-minutes: 45
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Verify iOS toolchain
        run: |
          set -euo pipefail
          command -v xcodegen
          xcodebuild -version
          xcrun simctl list devices available | grep -q 'iPhone 17 Pro Max'

      - name: Verify shared resources are synchronized
        run: |
          set -euo pipefail
          ios/Scripts/sync-core.sh
          git diff --exit-code -- ios/ZhuoBrowser/Resources

      - name: Generate project and run iOS tests
        working-directory: ios
        run: |
          set -euo pipefail
          xcodegen generate --spec project.yml
          caffeinate -dimsu xcodebuild test \
            -project ZhuoBrowser.xcodeproj \
            -scheme ZhuoBrowser \
            -destination 'platform=iOS Simulator,name=iPhone 17 Pro Max,OS=latest'

  android:
    needs: [inspect, quality]
    if: needs.inspect.outputs.changed == 'true'
    name: Test and build Android app
    runs-on: [self-hosted, macOS, ARM64, harmonyos, zhuobrowser]
    timeout-minutes: 45
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Verify Android toolchain
        run: |
          set -euo pipefail
          command -v java
          test -n "${ANDROID_HOME:-}"
          test -d "$ANDROID_HOME/platforms/android-35"
          java -version

      - name: Verify shared resources are synchronized
        run: |
          set -euo pipefail
          android/Scripts/sync-core.sh
          git diff --exit-code -- android/app/src/main/assets

      - name: Run Android checks and build debug APK
        working-directory: android
        run: |
          set -euo pipefail
          caffeinate -dimsu ./gradlew --no-daemon \
            :app:lintDebug \
            :app:testDebugUnitTest \
            :app:assembleDebug

  harmony:
    needs: [inspect, quality]
    if: needs.inspect.outputs.changed == 'true'
    name: Test and build HarmonyOS app
    runs-on: [self-hosted, macOS, ARM64, harmonyos, zhuobrowser]
    timeout-minutes: 60
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0

      - name: Verify HarmonyOS toolchain and signing source
        run: |
          set -euo pipefail
          test -x "$HVIGOR_BIN"
          command -v ohpm
          test -f "$HARMONY_SIGNING_SOURCE"
          test "$(stat -f '%OLp' "$HARMONY_SIGNING_SOURCE")" = "600"
          "$HVIGOR_BIN" --version
          ohpm --version

      - name: Run tests and build release HAP
        env:
          RUN_HARMONY_TESTS: "1"
        run: |
          caffeinate -dimsu scripts/mobile_cicd/build_harmony_artifacts.sh "$RUNNER_TEMP/zhuobrowser-harmony-ci"