Establish native Linux ARM64 Android CI and verification gates (#94)

2026-10-09 00:34:43 +02:00
1 parent 1abd75282e
commit 3436d55cdc
@@ -0,0 +1,124 @@
+name: Android ARM verification
+
+on:
+  push:
+    branches:
+      - main
+      - 'codex/**'
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  code: read
+  actions: write
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_BUILD_JOBS: '1'
+  CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUSTFLAGS: -C link-arg=-fuse-ld=lld
+
+jobs:
+  rust:
+    runs-on: linux-arm64
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      CARGO_INCREMENTAL: '0'
+      CARGO_PROFILE_TEST_DEBUG: line-tables-only
+    steps:
+      - uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install workspace system libraries
+        run: |
+          df -h .
+          df -i .
+          exit 1 # Temporary artifact transport probe; restore final workflow afterward.
+          available=$(df --output=avail -B1 . | tail -n 1)
+          if [ "$available" -lt 17179869184 ]; then
+            echo 'Rust CI needs at least 16 GiB free in its checkout filesystem.' >&2
+            exit 1
+          fi
+          apt-get update
+          apt-get install -y --no-install-recommends python3 lld pkg-config libfontconfig1-dev libasound2-dev libudev-dev libxkbcommon-dev libwayland-dev
+      - name: Install pinned Rust
+        uses: https://github.com/taiki-e/install-action@9534c84618278caac52cb373bb164ed464dbd8af
+        with:
+          tool: rust@1.97.1
+          fallback: none
+      - name: Install formatting and Clippy components
+        run: rustup component add --toolchain 1.97.1 rustfmt clippy
+      - name: Formatting
+        run: cargo +1.97.1 fmt --all -- --check
+      - name: Warnings as errors
+        run: RUSTFLAGS="-D warnings" cargo +1.97.1 check --locked --workspace --all-targets
+      - name: Clippy
+        run: cargo +1.97.1 clippy --locked --workspace --all-targets -- -D warnings
+      - name: Workspace tests including deterministic clocks and secret backends
+        run: |
+          cargo +1.97.1 test --locked --workspace
+          du -sh target
+      - name: Reclaim this checkout's generated build directories
+        if: always()
+        run: python3 .gitea/scripts/android_ci.py clean-ci
+
+      - name: Create public artifact transport fixture
+        if: always()
+        run: |
+          mkdir -p /tmp/ironstorage94-artifact-probe
+          echo '{"purpose":"public artifact transport verification","secret_data":false}' > /tmp/ironstorage94-artifact-probe/probe.json
+      - name: Verify Gitea artifact transport
+        if: always()
+        uses: https://github.com/actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: issue94-artifact-transport-probe
+          path: /tmp/ironstorage94-artifact-probe/
+          if-no-files-found: error
+          retention-days: 1
+
+  android:
+    runs-on: linux-arm64
+    timeout-minutes: 150
+    env:
+      ANDROID_HOME: /opt/ironstorage-android-sdk
+      JAVA_HOME: /usr/lib/jvm/java-25-openjdk-arm64
+      CI: 'true'
+      CARGO_INCREMENTAL: '0'
+      CARGO_PROFILE_DEV_DEBUG: '0'
+      GRADLE_OPTS: -Dorg.gradle.workers.max=1 -Dorg.gradle.jvmargs=-Xmx1g -Dkotlin.daemon.jvm.options=-Xmx512m
+    steps:
+      - uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install native ARM64 Java and build prerequisites
+        run: |
+          df -h .
+          df -i .
+          available=$(df --output=avail -B1 . | tail -n 1)
+          if [ "$available" -lt 25769803776 ]; then
+            echo 'Android CI needs at least 24 GiB free in its checkout filesystem.' >&2
+            exit 1
+          fi
+          apt-get update
+          apt-get install -y --no-install-recommends openjdk-25-jdk python3 ca-certificates curl unzip xz-utils gcc lld pkg-config libfontconfig1-dev
+      - name: Install pinned Rust
+        uses: https://github.com/taiki-e/install-action@9534c84618278caac52cb373bb164ed464dbd8af
+        with:
+          tool: rust@1.97.1
+          fallback: none
+      - name: Install selected Android targets and cargo-ndk
+        run: |
+          rustup target add --toolchain 1.97.1 aarch64-linux-android armv7-linux-androideabi
+          cargo +1.97.1 install cargo-ndk --version 4.1.2 --locked
+      - name: Check build orchestration
+        run: python3 .gitea/scripts/android_ci.py test
+      - name: Install checksummed native Linux ARM64 SDK and NDK tools
+        run: python3 .gitea/scripts/android_ci.py prepare-linux
+      - name: Compile, test, lint and audit unsigned ARM packages
+        run: python3 .gitea/scripts/android_ci.py build
+      - name: Upload reviewed packages, matching symbols, safe test summaries and SBOM
+        uses: https://github.com/actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: android-arm-verification
+          path: android/build/ci-artifacts/
+          if-no-files-found: error
+          retention-days: 14
+      - name: Reclaim this checkout's generated build directories after upload
+        if: always()
+        run: python3 .gitea/scripts/android_ci.py clean-ci