android-build.yml

name: Android App CI

permissions:
  contents: read

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

jobs:
  build-android:
    runs-on: ubuntu-latest-8-cores
    steps:
      - uses: actions/checkout@v4

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '21'

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3

      - name: Setup Bun
        uses: oven-sh/setup-bun@v1
        with:
          bun-version: 1.2.2

      - name: Cache Bun dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.bun/install/cache
            frontend/node_modules
          key: ${{ runner.os }}-bun-${{ hashFiles('frontend/bun.lockb') }}
          restore-keys: |
            ${{ runner.os }}-bun-

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android,i686-linux-android

      - name: Setup Android NDK
        uses: nttld/setup-ndk@v1.5.0
        id: setup-ndk
        with:
          ndk-version: r27c
          add-to-path: true
          local-cache: true

      - name: Cache Gradle
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('frontend/src-tauri/gen/android/**/*.gradle*', 'frontend/src-tauri/gen/android/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Install sccache
        run: |
          SCCACHE_VERSION=0.8.2
          SCCACHE_URL="https://github.com/mozilla/sccache/releases/download/v${SCCACHE_VERSION}/sccache-v${SCCACHE_VERSION}-x86_64-unknown-linux-musl.tar.gz"
          curl -L "$SCCACHE_URL" | tar xz
          sudo mv sccache-v${SCCACHE_VERSION}-x86_64-unknown-linux-musl/sccache /usr/local/bin/
          chmod +x /usr/local/bin/sccache
          sccache --version

      - name: Cache sccache
        uses: actions/cache@v4
        with:
          path: ~/.cache/sccache
          key: ${{ runner.os }}-sccache-android-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-sccache-android-
            ${{ runner.os }}-sccache-

      - name: Cache Cargo bin (Tauri CLI)
        uses: actions/cache@v4
        with:
          path: ~/.cargo/bin/
          key: ${{ runner.os }}-cargo-bin-tauri-cli-2.9.2
          restore-keys: |
            ${{ runner.os }}-cargo-bin-tauri-cli-
            ${{ runner.os }}-cargo-bin-

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libssl-dev

      - name: Install frontend dependencies
        working-directory: ./frontend
        run: bun install

      - name: Install Tauri CLI
        run: |
          if ! command -v cargo-tauri &> /dev/null; then
            cargo install tauri-cli --version "2.9.2" --locked
          else
            echo "Tauri CLI already installed"
          fi
        env:
          CARGO_CFG_TARGET_OS: linux

      - name: Setup Android signing
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          cd frontend/src-tauri/gen/android
          echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > $RUNNER_TEMP/keystore.jks
          echo "keyAlias=$ANDROID_KEY_ALIAS" > keystore.properties
          echo "password=$ANDROID_KEY_PASSWORD" >> keystore.properties
          echo "storeFile=$RUNNER_TEMP/keystore.jks" >> keystore.properties

      - name: Generate tauri.properties (Workaround for Tauri 2.9.x bug)
        run: |
          # Workaround for Tauri 2.9.x not generating tauri.properties correctly
          # See: https://github.com/tauri-apps/tauri/issues/YOUR_ISSUE_NUMBER
          VERSION=$(jq -r '.version' frontend/src-tauri/tauri.conf.json)
          VERSION_CODE=$(jq -r '.bundle.android.versionCode' frontend/src-tauri/tauri.conf.json)
          
          mkdir -p frontend/src-tauri/gen/android/app
          cat > frontend/src-tauri/gen/android/app/tauri.properties << EOF
          // THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
          tauri.android.versionName=$VERSION
          tauri.android.versionCode=$VERSION_CODE
          EOF
          
          echo "Generated tauri.properties with version $VERSION and versionCode $VERSION_CODE"

      - name: Configure sccache
        run: |
          {
            echo "RUSTC_WRAPPER=sccache"
            echo "SCCACHE_DIR=$HOME/.cache/sccache"
            echo "SCCACHE_CACHE_SIZE=2G"
          } >> "$GITHUB_ENV"

      - name: Create cargo config for 16KB page size support
        run: |
          # Android 15+ requires 16KB page size alignment for native libraries
          # https://developer.android.com/guide/practices/page-sizes
          mkdir -p frontend/src-tauri/.cargo
          cat > frontend/src-tauri/.cargo/config.toml << 'EOF'
          [target.aarch64-linux-android]
          rustflags = ["-C", "link-arg=-Wl,-z,max-page-size=16384"]

          [target.armv7-linux-androideabi]
          rustflags = ["-C", "link-arg=-Wl,-z,max-page-size=16384"]

          [target.i686-linux-android]
          rustflags = ["-C", "link-arg=-Wl,-z,max-page-size=16384"]

          [target.x86_64-linux-android]
          rustflags = ["-C", "link-arg=-Wl,-z,max-page-size=16384"]
          EOF

      - name: Build Tauri Android App (Signed Release)
        working-directory: ./frontend
        run: |
          export ANDROID_HOME=$ANDROID_SDK_ROOT
          export NDK_HOME=${{ steps.setup-ndk.outputs.ndk-path }}

          # Set up Android NDK toolchain paths
          export PATH=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin:$PATH

          # Set up cross-compilation environment variables for each target
          export AR_aarch64_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-ar
          export CC_aarch64_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android24-clang
          export CXX_aarch64_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android24-clang++
          export RANLIB_aarch64_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-ranlib

          export AR_armv7_linux_androideabi=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-ar
          export CC_armv7_linux_androideabi=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/armv7a-linux-androideabi24-clang
          export CXX_armv7_linux_androideabi=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/armv7a-linux-androideabi24-clang++
          export RANLIB_armv7_linux_androideabi=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-ranlib

          export AR_x86_64_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-ar
          export CC_x86_64_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/x86_64-linux-android24-clang
          export CXX_x86_64_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/x86_64-linux-android24-clang++
          export RANLIB_x86_64_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-ranlib

          export AR_i686_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-ar
          export CC_i686_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/i686-linux-android24-clang
          export CXX_i686_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/i686-linux-android24-clang++
          export RANLIB_i686_linux_android=$NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-ranlib

          # Create symlinks for ranlib that OpenSSL expects
          sudo ln -sf $NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-ranlib /usr/local/bin/aarch64-linux-android-ranlib
          sudo ln -sf $NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-ranlib /usr/local/bin/armv7a-linux-androideabi-ranlib
          sudo ln -sf $NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-ranlib /usr/local/bin/x86_64-linux-android-ranlib
          sudo ln -sf $NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-ranlib /usr/local/bin/i686-linux-android-ranlib

          cargo tauri android build
        env:
          VITE_OPEN_SECRET_API_URL: ${{ github.event_name == 'pull_request' && 'https://enclave.secretgpt.ai' || 'https://enclave.trymaple.ai' }}
          VITE_MAPLE_BILLING_API_URL: ${{ github.event_name == 'pull_request' && 'https://billing-dev.opensecret.cloud' || 'https://billing.opensecret.cloud' }}
          VITE_CLIENT_ID: ba5a14b5-d915-47b1-b7b1-afda52bc5fc6

      - name: Show sccache stats
        run: sccache --show-stats

      - name: Upload Android APK
        uses: actions/upload-artifact@v4
        with:
          name: maple-android-apk
          path: |
            frontend/src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release.apk
          retention-days: 5

      - name: Upload Android AAB
        uses: actions/upload-artifact@v4
        with:
          name: maple-android-aab
          path: |
            frontend/src-tauri/gen/android/app/build/outputs/bundle/universalRelease/app-universal-release.aab
          retention-days: 5