callstack__agent-device/.github/workflows/test-app-build-cache.yml

name: Test App Build Cache

# Builds a Release binary of examples/test-app and publishes it as a workflow
# artifact keyed by the Expo fingerprint, so CI e2e jobs install a ready binary
# (via .github/actions/setup-fixture-app) instead of compiling from scratch.
#
# Release, not dev-client: the JS bundle is embedded, so a consuming job needs no
# Metro. Its JS is refreshed on retrieval with @expo/repack-app, so keying on the
# native-only fingerprint is correct -- a JS-only change reuses the same native
# binary. Local development does not use this; it caches on disk via the
# expo-build-disk-cache provider in app.config.js.
#
# Only builds when the fingerprint has no trusted artifact yet. Runs on every
# push to main and every PR so a same-head consumer can wait for a scheduled
# producer (workflow_dispatch cannot reach a workflow that is not yet on main).

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

permissions:
  contents: read
  # Look up whether this fingerprint's artifact already exists across runs.
  actions: read

jobs:
  fingerprint:
    name: Resolve native fingerprint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    outputs:
      matrix: ${{ steps.fingerprint.outputs.matrix }}
      has-work: ${{ steps.fingerprint.outputs.has-work }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup toolchain
        uses: ./.github/actions/setup-node-pnpm
        with:
          cache-dependency-path: examples/test-app/pnpm-lock.yaml

      - name: Setup test app dependencies
        uses: ./.github/actions/setup-test-app-dependencies

      - name: Typecheck test app
        uses: ./.github/actions/run-gate
        with: { gate: test-app-typecheck }

      # image-size has no fixed release for its parser DoS advisories; this gate
      # proves the in-tree pnpm patch still terminates the zero-length vectors.
      - name: Run the image-size parser security test
        uses: ./.github/actions/run-gate
        with: { gate: test-app-security }

      - name: Resolve native fingerprint
        id: fingerprint
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          ARTIFACT_NAME_RESOLVER=".github/actions/setup-fixture-app/resolve-artifact-name.sh"
          IOS_NAME="$(sh "$ARTIFACT_NAME_RESOLVER" ios)"
          ANDROID_NAME="$(sh "$ARTIFACT_NAME_RESOLVER" android)"
          EXPECTED_HEAD_SHA="${{ github.event.pull_request.head.sha || github.sha }}"
          TRUSTED_ARTIFACT=".github/actions/setup-fixture-app/trusted-artifact.mjs"
          IOS_ARTIFACT="$(node "$TRUSTED_ARTIFACT" find "${{ github.repository }}" "$IOS_NAME" "$EXPECTED_HEAD_SHA")"
          ANDROID_ARTIFACT="$(node "$TRUSTED_ARTIFACT" find "${{ github.repository }}" "$ANDROID_NAME" "$EXPECTED_HEAD_SHA")"
          IOS_BUILD=true
          if [ -n "$IOS_ARTIFACT" ] ||
             { [ "${{ github.event_name }}" = "pull_request" ] &&
               [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; }; then
            IOS_BUILD=false
          fi
          ANDROID_BUILD=true
          if [ -n "$ANDROID_ARTIFACT" ]; then
            ANDROID_BUILD=false
          fi
          MATRIX="$(jq -cn \
            --arg iosName "$IOS_NAME" \
            --argjson iosBuild "$IOS_BUILD" \
            --arg androidName "$ANDROID_NAME" \
            --argjson androidBuild "$ANDROID_BUILD" \
            '[
              {
                name: "iOS Release",
                platform: "ios",
                runsOn: (if $iosBuild then "macos-26" else "ubuntu-latest" end),
                artifactName: $iosName,
                build: $iosBuild
              },
              {
                name: "Android Release",
                platform: "android",
                runsOn: "ubuntu-latest",
                artifactName: $androidName,
                build: $androidBuild
              }
            ] | { include: map(select(.build)) }')"
          echo "matrix=$MATRIX" >> "$GITHUB_OUTPUT"
          echo "has-work=$(jq -r '.include | length > 0' <<<"$MATRIX")" >> "$GITHUB_OUTPUT"

  release:
    name: ${{ matrix.name }}
    needs: fingerprint
    if: needs.fingerprint.outputs.has-work == 'true'
    runs-on: ${{ matrix.runsOn }}
    timeout-minutes: 60
    concurrency:
      group: test-app-${{ matrix.artifactName }}-${{ github.event.pull_request.number || github.ref_name }}
      cancel-in-progress: false
    strategy:
      # Independent caches; one platform failing must not withhold the other's.
      fail-fast: false
      matrix: ${{ fromJSON(needs.fingerprint.outputs.matrix) }}
    steps:
      - name: Checkout
        if: matrix.build
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup toolchain
        if: matrix.build
        uses: ./.github/actions/setup-node-pnpm
        with:
          cache-dependency-path: |
            pnpm-lock.yaml
            examples/test-app/pnpm-lock.yaml

      - name: Setup test app dependencies
        if: matrix.build
        uses: ./.github/actions/setup-test-app-dependencies

      # The generated Android project is safe to assemble without an emulator.
      # Keep Gradle's heavy dependency/transforms cache, but never let an
      # untrusted fork PR write it.
      - name: Setup Gradle cache
        if: matrix.platform == 'android' && matrix.build
        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
        with:
          cache-read-only: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}

      # `--device generic` builds for the simulator without booting one or
      # installing. Release embeds the bundle (no Metro) and links a universal
      # x86_64+arm64 slice, so the artifact runs on any developer's simulator.
      # Fork PRs cannot safely publish this binary; their iOS workflow builds the
      # same Release app inline on a cache miss, so compiling it here would double
      # the macOS cost without adding signal.
      - name: Build the iOS Release app
        if: |
          matrix.platform == 'ios' &&
          matrix.build &&
          (github.event_name != 'pull_request' ||
           github.event.pull_request.head.repo.full_name == github.repository)
        run: |
          set -euo pipefail
          pnpm --dir examples/test-app exec expo run:ios \
            --configuration Release \
            --device generic \
            --no-bundler \
            --output "${{ github.workspace }}/.tmp/test-app-build"

      # Deliberately no `set -o pipefail`: `yes` is killed by SIGPIPE once
      # sdkmanager stops reading, and pipefail would report that 141 as the
      # step's own failure.
      - name: Install Android SDK packages
        if: matrix.platform == 'android' && matrix.build
        run: |
          SDK_ROOT="${ANDROID_HOME:-${ANDROID_SDK_ROOT:-/usr/local/lib/android/sdk}}"
          SDKMANAGER="$SDK_ROOT/cmdline-tools/latest/bin/sdkmanager"
          if [ ! -x "$SDKMANAGER" ]; then
            SDKMANAGER="$SDK_ROOT/cmdline-tools/bin/sdkmanager"
          fi
          if [ ! -x "$SDKMANAGER" ]; then
            echo "sdkmanager not found under $SDK_ROOT" >&2
            exit 1
          fi
          yes | "$SDKMANAGER" --licenses >/dev/null
          "$SDKMANAGER" "platforms;android-36" "build-tools;36.0.0"

      # CNG's generated Android project exposes the ordinary Gradle Release task;
      # it builds and packages every ABI without device resolution. Installation
      # and launch are deliberately proven by the Android consumer instead.
      - name: Build the Android Release apk
        if: matrix.platform == 'android' && matrix.build
        run: |
          set -euo pipefail
          pnpm --dir examples/test-app exec expo prebuild --platform android --no-install
          # expo prebuild's generated gradle.properties has no trailing newline, so a bare
          # `echo >>` corrupts its last line (e.g. `expo.inlineModules.watchedDirectories=[]org.gradle.jvmargs=...`),
          # which fails Gradle's JSON.parse of that property at configure time. Lead with a newline.
          printf '\n%s\n' 'org.gradle.jvmargs=-Xmx4g' >> examples/test-app/android/gradle.properties
          (
            cd examples/test-app/android
            ./gradlew :app:assembleRelease
          )
          mkdir -p "${{ github.workspace }}/.tmp/test-app-build"
          cp examples/test-app/android/app/build/outputs/apk/release/app-release.apk \
            "${{ github.workspace }}/.tmp/test-app-build/app-release.apk"

      - name: Stage the binary for upload
        id: stage
        if: |
          matrix.build &&
          (matrix.platform == 'android' ||
           github.event_name != 'pull_request' ||
           github.event.pull_request.head.repo.full_name == github.repository)
        run: |
          set -euo pipefail
          SRC="${{ github.workspace }}/.tmp/test-app-build"
          BINARY="$(find "$SRC" -maxdepth 1 \( -name '*.app' -o -name '*.apk' \) | head -1)"
          if [ -z "$BINARY" ]; then
            echo "::error::Build produced no .app or .apk under $SRC."
            exit 1
          fi
          # An APK must span both the maintainer's arm64 and CI's x86_64; a
          # regression here (e.g. an unexpected abiFilter) is otherwise silent.
          if [ "${{ matrix.platform }}" = "android" ] && ! unzip -l "$BINARY" | grep -q "lib/arm64-v8a/"; then
            echo "::error::Release APK has no arm64-v8a libraries."
            exit 1
          fi
          # Tar the binary: artifact zips drop the executable bit, which would
          # leave an installed .app unable to launch.
          mkdir -p .tmp/test-app-artifact
          tar -czf .tmp/test-app-artifact/binary.tar.gz -C "$SRC" "$(basename "$BINARY")"
          echo "publishing ${{ matrix.artifactName }} ($(du -h .tmp/test-app-artifact/binary.tar.gz | cut -f1))"

      # Fork PRs run with a read-only token but can still upload artifacts, and a
      # consumer serves whatever it finds by name -- so a fork could publish a
      # tampered binary that CI then executes. Only branches in this repo publish.
      # Android still builds on forks; iOS gets equivalent build/install signal
      # from the smoke workflow's inline cache-miss fallback.
      - name: Publish to the build cache
        if: |
          matrix.build &&
          (github.event_name != 'pull_request' ||
           github.event.pull_request.head.repo.full_name == github.repository)
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: ${{ matrix.artifactName }}
          include-hidden-files: true
          path: .tmp/test-app-artifact/binary.tar.gz
          if-no-files-found: error
          compression-level: 0 # already gzipped