ci.yml

name: MAUverce CI

on:
  push:
    branches: ["main"]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  DOTNET_CLI_TELEMETRY_OPTOUT: "1"
  DOTNET_NOLOGO: "1"
  PIP_DISABLE_PIP_VERSION_CHECK: "1"

jobs:
  backend:
    name: Backend tests and static checks
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    defaults:
      run:
        working-directory: mauverse-api
    steps:
      - name: Check out sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: |
            mauverse-api/requirements.txt
            mauverse-api/requirements-dev.txt

      - name: Install dependencies
        run: python -m pip install --requirement requirements-dev.txt

      - name: Verify dependency consistency
        run: python -m pip check

      - name: Run tests
        run: python -m unittest discover -s tests -v

      - name: Run Ruff
        run: ruff check .

      - name: Compile Python sources
        run: python -m compileall -q apps tests main.py

  api-image:
    name: API container smoke test
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - name: Check out sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Build image
        run: docker build --pull --tag mauverce-api:ci mauverse-api

      - name: Verify non-root runtime and health
        shell: bash
        run: |
          docker run --rm --entrypoint python mauverce-api:ci \
            -c "import os; raise SystemExit(0 if os.geteuid() != 0 else 1)"

          container_id="$(docker run --detach \
            --env SCHEDULE_DB_USER=test \
            --env SCHEDULE_DB_PASSWORD=test \
            --env DEBT_DB_USER=test \
            --env DEBT_DB_PASSWORD=test \
            mauverce-api:ci)"

          cleanup() {
            docker logs "$container_id" || true
            docker rm --force "$container_id" >/dev/null 2>&1 || true
          }
          trap cleanup EXIT

          for attempt in {1..30}; do
            running="$(docker inspect --format '{{.State.Running}}' "$container_id")"
            health="$(docker inspect --format '{{.State.Health.Status}}' "$container_id")"
            if [[ "$health" == "healthy" ]]; then
              exit 0
            fi
            if [[ "$running" != "true" || "$health" == "unhealthy" ]]; then
              exit 1
            fi
            sleep 2
          done

          echo "Container did not become healthy within 60 seconds" >&2
          exit 1

  android-release:
    name: Android Release configuration
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    env:
      NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
    defaults:
      run:
        working-directory: mauverse_mobile
    steps:
      - name: Check out sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up .NET SDK from global.json
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          global-json-file: mauverse_mobile/global.json

      - name: Set up JDK
        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
        with:
          distribution: temurin
          java-version: "17"

      - name: Restore NuGet cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ env.NUGET_PACKAGES }}
          key: ${{ runner.os }}-nuget-${{ hashFiles('mauverse_mobile/global.json', 'mauverse_mobile/mau.csproj', 'mauverse_mobile.Tests/mauverse_mobile.Tests.csproj') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      - name: Install MAUI Android workload
        run: dotnet workload install maui-android --skip-manifest-update

      - name: Restore projects
        shell: bash
        run: |
          set -euo pipefail
          dotnet restore mau.sln
          dotnet restore mau.csproj --runtime android-arm64

      - name: Run mobile unit tests
        run: dotnet test ../mauverse_mobile.Tests/mauverse_mobile.Tests.csproj --configuration Release --no-restore --warnaserror

      - name: Build Release configuration
        run: >-
          dotnet build mau.csproj
          --configuration Release
          --framework net10.0-android
          --runtime android-arm64
          --no-restore
          --warnaserror
          -p:ContinuousIntegrationBuild=true
          -maxcpucount:1

      - name: Create unsigned artifact checksums
        shell: bash
        run: |
          mapfile -t artifacts < <(find bin/Release/net10.0-android \
            -type f \( -name '*.aab' -o \( -name '*.apk' ! -name '*-Signed.apk' \) \) \
            -print | sort)
          test "${#artifacts[@]}" -ge 2
          sha256sum "${artifacts[@]}" > bin/Release/net10.0-android/checksums.txt

      - name: Upload unsigned CI artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: mauverce-android-release-unsigned
          path: |
            mauverse_mobile/bin/Release/net10.0-android/**/*.apk
            !mauverse_mobile/bin/Release/net10.0-android/**/*-Signed.apk
            mauverse_mobile/bin/Release/net10.0-android/**/*.aab
            mauverse_mobile/bin/Release/net10.0-android/checksums.txt
          if-no-files-found: error
          retention-days: 14
          compression-level: 0

  ios-release-unsigned:
    name: Native SwiftUI iPhone Release (unsigned)
    runs-on: macos-26
    timeout-minutes: 35
    env:
      MAUVERSE_SCHEDULE_TOKEN: ${{ secrets.MAUVERSE_SCHEDULE_TOKEN }}
    steps:
      - name: Check out sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Select Xcode 26.5
        shell: bash
        run: |
          set -euo pipefail
          developer_dir="/Applications/Xcode_26.5.app/Contents/Developer"
          test -d "$developer_dir"
          sudo xcode-select --switch "$developer_dir"

      - name: Install project generator
        run: brew install xcodegen

      - name: Generate native Xcode project
        working-directory: MauverseIOS
        run: xcodegen generate --spec project.yml

      - name: Report Apple toolchain and project
        shell: bash
        run: |
          set -euo pipefail
          xcodebuild -version
          xcrun --sdk iphoneos --show-sdk-version
          xcodegen --version
          xcodebuild -project MauverseIOS/MAUverse.xcodeproj -list

      - name: Build native iPhone application without signing
        shell: bash
        run: |
          set -euo pipefail
          test -n "$MAUVERSE_SCHEDULE_TOKEN"
          xcodebuild \
            -project MauverseIOS/MAUverse.xcodeproj \
            -scheme MAUverse \
            -configuration Release \
            -sdk iphoneos \
            -destination 'generic/platform=iOS' \
            -derivedDataPath "$PWD/build/DerivedData" \
            CODE_SIGNING_ALLOWED=NO \
            CODE_SIGNING_REQUIRED=NO \
            CODE_SIGN_IDENTITY="" \
            DEVELOPMENT_TEAM="" \
            MAUVERSE_SCHEDULE_TOKEN="$MAUVERSE_SCHEDULE_TOKEN" \
            clean build

      - name: Verify and package unsigned application
        shell: bash
        run: |
          set -euo pipefail

          products_dir="build/DerivedData/Build/Products/Release-iphoneos"
          app_path="$(find "$products_dir" -maxdepth 1 -type d -name '*.app' -print -quit)"
          test -n "$app_path"

          if codesign --verify "$app_path" >/dev/null 2>&1; then
            echo "Refusing to upload a signed iOS application." >&2
            exit 1
          fi

          signing_material="$(find "$app_path" \
            \( -type d -name '_CodeSignature' -o -type f -name 'embedded.mobileprovision' \) \
            -print -quit)"
          if [[ -n "$signing_material" ]]; then
            echo "Signing material was found: $signing_material" >&2
            exit 1
          fi

          artifact_dir="build/unsigned-artifact"
          payload_dir="$artifact_dir/Payload"
          mkdir -p "$payload_dir"
          ditto "$app_path" "$payload_dir/$(basename "$app_path")"

          (
            cd "$artifact_dir"
            /usr/bin/zip -qry "../mauverse-native-ios-arm64-unsigned.ipa" Payload
          )

          {
            echo "commit=${GITHUB_SHA}"
            echo "target=native-swiftui"
            echo "runtime=ios-arm64"
            echo "signed=false"
            echo "provisioning_profile=false"
            echo "xcode=$(xcodebuild -version | tr '\n' ' ')"
            echo "iphoneos_sdk=$(xcrun --sdk iphoneos --show-sdk-version)"
          } > "build/build-metadata.txt"

          (
            cd build
            shasum -a 256 mauverse-native-ios-arm64-unsigned.ipa > checksums.txt
          )

      - name: Upload unsigned iPhone artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: mauverse-native-ios-arm64-release-unsigned
          path: |
            build/mauverse-native-ios-arm64-unsigned.ipa
            build/checksums.txt
            build/build-metadata.txt
          if-no-files-found: error
          retention-days: 14
          compression-level: 0