# Runs the same scripts a developer runs; the pipeline adds no build logic of
# its own. The toolchain is provisioned by ci/setup-toolchain.sh into
# $TOOLCHAIN_DIR and cached between runs, because it is a multi-gigabyte
# download (JDK, Android SDK, NDK, Gradle, Go).

image: debian:13-slim

variables:
  TOOLCHAIN_DIR: "$CI_PROJECT_DIR/.toolchains"
  GRADLE_USER_HOME: "$CI_PROJECT_DIR/.gradle"
  TOOLCHAIN_FLAVOR: "glibc"

# Build only after the tests pass, or a failing pipeline still publishes an APK.
stages:
  - test
  - build

cache:
  key:
    # Never let an unprotected branch publish tools consumed by a protected
    # release branch. Version files still invalidate either cache explicitly.
    prefix: "toolchain-$TOOLCHAIN_FLAVOR-$CI_COMMIT_REF_PROTECTED"
    files:
      - versions
      - gradle/wrapper/gradle-wrapper.properties
  paths:
    - .toolchains/
    - .gradle/

before_script:
  - apt-get update -qq
  - apt-get install -y -qq --no-install-recommends
      binutils ca-certificates curl gcc git libc6-dev make python3 rsync shellcheck tar unzip xz-utils
  - sh ci/setup-toolchain.sh
  - . "$TOOLCHAIN_DIR/env.sh"

test:
  stage: test
  script:
    - sh ci/test.sh

test-musl:
  stage: test
  image: alpine:3.24
  variables:
    TOOLCHAIN_FLAVOR: "musl"
  before_script:
    - apk add --no-cache
        bash binutils build-base ca-certificates coreutils curl gcompat git libstdc++ make
        python3 rsync shellcheck tar unzip xz zlib
    - sh ci/setup-toolchain.sh
    - . "$TOOLCHAIN_DIR/env.sh"
  script:
    - sh ci/test.sh
    - sh ci/build.sh

build:
  stage: build
  script:
    - sh ci/build.sh
  artifacts:
    paths:
      - app/build/outputs/apk/release/
    expire_in: 1 week

reproducible:
  stage: build
  rules:
    - if: '$CI_COMMIT_TAG'
  script:
    - sh ci/verify-repro.sh