name: Android ARM verification

on:
  push:
    branches:
      - main
      - 'codex/**'
  pull_request:
  workflow_dispatch:

permissions:
  code: read
  actions: write

env:
  CARGO_TERM_COLOR: always
  CARGO_BUILD_JOBS: '1'
  CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUSTFLAGS: -C link-arg=-fuse-ld=lld

jobs:
  rust:
    runs-on: linux-arm64
    timeout-minutes: 90
    steps:
      - uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install workspace system libraries
        run: |
          apt-get update
          apt-get install -y --no-install-recommends lld pkg-config libfontconfig1-dev libasound2-dev libudev-dev libxkbcommon-dev libwayland-dev
      - name: Install pinned Rust
        uses: https://github.com/taiki-e/install-action@9534c84618278caac52cb373bb164ed464dbd8af
        with:
          tool: rust@1.97.1
          fallback: none
      - name: Install formatting and Clippy components
        run: rustup component add --toolchain 1.97.1 rustfmt clippy
      - name: Formatting
        run: cargo +1.97.1 fmt --all -- --check
      - name: Warnings as errors
        run: RUSTFLAGS="-D warnings" cargo +1.97.1 check --locked --workspace --all-targets
      - name: Clippy
        run: cargo +1.97.1 clippy --locked --workspace --all-targets -- -D warnings
      - name: Workspace tests including deterministic clocks and secret backends
        run: cargo +1.97.1 test --locked --workspace

  android:
    runs-on: linux-arm64
    timeout-minutes: 90
    env:
      ANDROID_HOME: /opt/ironstorage-android-sdk
      JAVA_HOME: /usr/lib/jvm/java-25-openjdk-arm64
      GRADLE_OPTS: -Dorg.gradle.workers.max=1 -Dorg.gradle.jvmargs=-Xmx1g -Dkotlin.daemon.jvm.options=-Xmx512m
    steps:
      - uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install native ARM64 Java and build prerequisites
        run: |
          apt-get update
          apt-get install -y --no-install-recommends openjdk-25-jdk python3 ca-certificates curl unzip xz-utils gcc lld pkg-config libfontconfig1-dev
      - name: Install pinned Rust
        uses: https://github.com/taiki-e/install-action@9534c84618278caac52cb373bb164ed464dbd8af
        with:
          tool: rust@1.97.1
          fallback: none
      - name: Install selected Android targets and cargo-ndk
        run: |
          rustup target add --toolchain 1.97.1 aarch64-linux-android armv7-linux-androideabi
          cargo +1.97.1 install cargo-ndk --version 4.1.2 --locked
      - name: Check build orchestration
        run: python3 .gitea/scripts/android_ci.py test
      - name: Install checksummed native Linux ARM64 SDK and NDK tools
        run: python3 .gitea/scripts/android_ci.py prepare-linux
      - name: Compile, test, lint and audit unsigned ARM packages
        run: python3 .gitea/scripts/android_ci.py build
      - name: Upload reviewed packages, matching symbols, safe test summaries and SBOM
        uses: https://github.com/actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: android-arm-verification
          path: android/build/ci-artifacts/
          if-no-files-found: error
          retention-days: 14