build: pin and verify release inputs

Support Alpine/musl and Debian/glibc hosts, lock downloaded and
Gradle artifacts, and verify native and APK security properties.

1 files changed, 71 insertions, 0 deletions

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..edc8c19
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,71 @@
+# Runs the same scripts a developer runs; the pipeline adds no build logic of
+# its own. The toolchain is provisioned by ci/setup-toolchain.sh into
+# $TOOLCHAIN_DIR and cached between runs, because it is a multi-gigabyte
+# download (JDK, Android SDK, NDK, Gradle, Go).
+
+image: debian:13-slim
+
+variables:
+  TOOLCHAIN_DIR: "$CI_PROJECT_DIR/.toolchains"
+  GRADLE_USER_HOME: "$CI_PROJECT_DIR/.gradle"
+  TOOLCHAIN_FLAVOR: "glibc"
+
+# Build only after the tests pass, or a failing pipeline still publishes an APK.
+stages:
+  - test
+  - build
+
+cache:
+  key:
+    # Never let an unprotected branch publish tools consumed by a protected
+    # release branch. Version files still invalidate either cache explicitly.
+    prefix: "toolchain-$TOOLCHAIN_FLAVOR-$CI_COMMIT_REF_PROTECTED"
+    files:
+      - versions
+      - gradle/wrapper/gradle-wrapper.properties
+  paths:
+    - .toolchains/
+    - .gradle/
+
+before_script:
+  - apt-get update -qq
+  - apt-get install -y -qq --no-install-recommends
+      binutils ca-certificates curl gcc git libc6-dev make python3 rsync shellcheck tar unzip xz-utils
+  - sh ci/setup-toolchain.sh
+  - . "$TOOLCHAIN_DIR/env.sh"
+
+test:
+  stage: test
+  script:
+    - sh ci/test.sh
+
+test-musl:
+  stage: test
+  image: alpine:3.24
+  variables:
+    TOOLCHAIN_FLAVOR: "musl"
+  before_script:
+    - apk add --no-cache
+        bash binutils build-base ca-certificates coreutils curl gcompat git libstdc++ make
+        python3 rsync shellcheck tar unzip xz zlib
+    - sh ci/setup-toolchain.sh
+    - . "$TOOLCHAIN_DIR/env.sh"
+  script:
+    - sh ci/test.sh
+    - sh ci/build.sh
+
+build:
+  stage: build
+  script:
+    - sh ci/build.sh
+  artifacts:
+    paths:
+      - app/build/outputs/apk/release/
+    expire_in: 1 week
+
+reproducible:
+  stage: build
+  rules:
+    - if: '$CI_COMMIT_TAG'
+  script:
+    - sh ci/verify-repro.sh