Establish native Linux ARM64 Android CI and verification gates (#94)

android/build.gradle.kts

@@ -1,4 +1,7 @@
+import groovy.json.JsonOutput
 import java.io.File
+import java.security.MessageDigest
+import org.gradle.api.artifacts.component.ModuleComponentIdentifier
 import org.gradle.api.artifacts.ExternalModuleDependency
 import org.gradle.api.artifacts.ProjectDependency
 
@@ -39,8 +42,15 @@ subprojects {
                 listOf("org.eclipse.jgit", "org.bouncycastle", "androidx.room", "com.squareup.retrofit2", "com.squareup.okhttp3").none { group.startsWith(it) }
             }) { "Domain libraries must stay in crates/storage: $group:$name" }
         }
+        val enforceDomain = name.endsWith("RuntimeClasspath") || name.endsWith("CompileClasspath")
         resolutionStrategy.eachDependency {
-            require(!requested.version.orEmpty().contains('+')) { "Dynamic versions are forbidden" }
+            require(requested.version.orEmpty().let { version ->
+                !version.contains('+') && !version.contains("SNAPSHOT") &&
+                    !version.startsWith("latest.") && version.none { it in "[]()," }
+            }) { "Dynamic versions are forbidden" }
+            require(!enforceDomain || listOf("org.eclipse.jgit", "org.bouncycastle", "androidx.room", "com.squareup.retrofit2", "com.squareup.okhttp3", "org.pgpainless", "com.google.mlkit").none {
+                requested.group == it || requested.group.startsWith("$it.")
+            }) { "Transitive domain libraries must stay in crates/storage" }
         }
     }
 }
@@ -79,3 +89,51 @@ tasks.register<Exec>("auditNativePackages") {
         ) + packages.map { it.asFile.absolutePath }
     )
 }
+
+
+// Each project resolves its own configurations under Gradle's project lock.
+subprojects {
+    val owner = project
+    tasks.register("dependencyInventory") {
+        val output = layout.buildDirectory.file("reports/android-dependencies.json")
+        outputs.file(output)
+        outputs.upToDateWhen { false }
+        doLast {
+            val rows = listOf("debugRuntimeClasspath", "releaseRuntimeClasspath", "debugAndroidTestRuntimeClasspath", "debugUnitTestRuntimeClasspath").flatMap { name ->
+                val configuration = owner.configurations.findByName(name)
+                if (configuration == null || !configuration.isCanBeResolved) emptyList() else {
+                    configuration.incoming.artifactView {
+                        componentFilter { it is ModuleComponentIdentifier }
+                    }.artifacts.artifacts.mapNotNull { artifact ->
+                        val id = artifact.id.componentIdentifier as? ModuleComponentIdentifier
+                        id?.let {
+                            mapOf(
+                                "group" to it.group, "name" to it.module, "version" to it.version,
+                                "sha256" to MessageDigest.getInstance("SHA-256").digest(artifact.file.readBytes())
+                                    .joinToString("") { byte -> "%02x".format(byte) },
+                                "scope" to "${owner.path}:$name"
+                            )
+                        }
+                    }
+                }
+            }.sortedWith(compareBy({ it.getValue("scope") }, { it.getValue("group") }, { it.getValue("name") }, { it.getValue("version") }, { it.getValue("sha256") }))
+            output.get().asFile.apply {
+                parentFile.mkdirs()
+                writeText(JsonOutput.prettyPrint(JsonOutput.toJson(rows)) + "\n")
+            }
+        }
+        notCompatibleWithConfigurationCache("Resolves reviewed artifact graphs")
+    }
+}
+
+tasks.register("dependencyInventory") {
+    dependsOn(subprojects.map { "${it.path}:dependencyInventory" })
+}
+
+tasks.register("androidVerification") {
+    dependsOn("checkArchitecture", "dependencyInventory", "auditNativePackages")
+    dependsOn(subprojects.map { "${it.path}:ktlintCheck" })
+    dependsOn(subprojects.map { "${it.path}:lintDebug" })
+    dependsOn(subprojects.map { "${it.path}:testDebugUnitTest" })
+    dependsOn(":app:assembleDebugAndroidTest", ":rust-bridge:assembleDebugAndroidTest", ":platform:assembleDebugAndroidTest")
+}