build-android.yml

name: Build Android

on:
  pull_request:
  push:
    branches:
      - "main"
  workflow_dispatch:
    inputs:
      update-android-repo:
        description: "Update Android Repo - Opens a PR updating the SDK in bitwarden/android"
        type: boolean
        default: false

defaults:
  run:
    shell: bash

jobs:
  build:
    name: Build
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        settings:
          - target: aarch64-linux-android
          - target: armv7-linux-androideabi
          - target: x86_64-linux-android
          - target: i686-linux-android
    permissions:
      contents: read

    steps:
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: stable

      - name: Cache cargo registry
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
        with:
          key: ${{ matrix.settings.target }}-cargo

      - name: Install cargo-run-bin
        run: cargo install cargo-run-bin --locked --version 1.7.4

      - name: Check cargo-binstall is not configured
        run: ./scripts/check-no-binstall.sh

      - name: Build
        env:
          TARGET: ${{ matrix.settings.target }}
        run: cargo bin cross build -p bitwarden-uniffi --release --target=${{ matrix.settings.target }}

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: android-${{ matrix.settings.target }}
          path: ./target/${{ matrix.settings.target }}/release/libbitwarden_uniffi.so
          if-no-files-found: error

  combine:
    name: Combine
    runs-on: ubuntu-24.04
    needs: build
    outputs:
      sdk-package-id: ${{ steps.publish.outputs.sdk-package-id }}
      sdk-version: ${{ steps.publish.outputs.sdk-version }}
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repo (PR)
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        if: github.event_name == 'pull_request'
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.ref }}
          persist-credentials: false

      - name: Checkout repo (Push or manual run)
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: stable

      - name: Cache cargo registry
        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
        with:
          key: cargo-combine-cache

      - name: Setup Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: temurin
          java-version: 17

      - name: Download Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

      - name: Move artifacts
        working-directory: crates/bitwarden-uniffi/kotlin/sdk/src/main/jniLibs
        run: |
          mkdir armeabi-v7a arm64-v8a x86 x86_64
          mv /home/runner/work/sdk-internal/sdk-internal/android-armv7-linux-androideabi/libbitwarden_uniffi.so ./armeabi-v7a/libbitwarden_uniffi.so
          mv /home/runner/work/sdk-internal/sdk-internal/android-aarch64-linux-android/libbitwarden_uniffi.so ./arm64-v8a/libbitwarden_uniffi.so
          mv /home/runner/work/sdk-internal/sdk-internal/android-i686-linux-android/libbitwarden_uniffi.so ./x86/libbitwarden_uniffi.so
          mv /home/runner/work/sdk-internal/sdk-internal/android-x86_64-linux-android/libbitwarden_uniffi.so ./x86_64/libbitwarden_uniffi.so

      - name: Generate bindings
        working-directory: crates/bitwarden-uniffi/kotlin
        run: ./build-schemas.sh

      - name: Setup gradle
        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1

      - name: Test build demo app
        working-directory: crates/bitwarden-uniffi/kotlin
        run: |
          ./gradlew build --warning-mode all --stacktrace

      - name: Publish
        id: publish
        run: ./gradlew sdk:publish
        working-directory: crates/bitwarden-uniffi/kotlin
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  check-android-breaking-changes:
    name: Check for Android breaking changes
    if: github.event_name == 'pull_request'
    needs: combine
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    uses: ./.github/workflows/detect-breaking-changes.yml
    secrets:
      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
    with:
      pr_number: ${{ github.event.number }}
      pr_head_sha: ${{ github.event.pull_request.head.sha }}
      pr_head_ref: ${{ github.event.pull_request.head.ref }}
      build_run_id: ${{ github.run_id }}
      client_repo: "bitwarden/android"
      client_label: "android"
      client_workflow: "sdlc-sdk-update.yml"
      artifact_identifier: ${{ needs.combine.outputs.sdk-version }}

  update:
    name: Trigger SDK update in Android repo
    runs-on: ubuntu-24.04
    if: (github.ref == 'refs/heads/main' && github.event_name == 'push') || inputs.update-android-repo
    needs: combine
    permissions:
      id-token: write

    steps:
      - name: Log in to Azure
        uses: bitwarden/gh-actions/azure-login@main
        with:
          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
          client_id: ${{ secrets.AZURE_CLIENT_ID }}

      - name: Get Azure Key Vault secrets
        id: get-kv-secrets
        uses: bitwarden/gh-actions/get-keyvault-secrets@main
        with:
          keyvault: gh-org-bitwarden
          secrets: "BW-GHAPP-ID,BW-GHAPP-KEY"

      - name: Log out from Azure
        uses: bitwarden/gh-actions/azure-logout@main

      - name: Generate GH App token
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
        id: app-token
        with:
          app-id: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-ID }}
          private-key: ${{ steps.get-kv-secrets.outputs.BW-GHAPP-KEY }}
          owner: bitwarden
          repositories: android
          permission-actions: write

      - name: Call SDLC SDK Update workflow in Android repo
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          _SDK_PACKAGE: ${{ needs.combine.outputs.sdk-package-id }}
          _SDK_VERSION: ${{ needs.combine.outputs.sdk-version }}
        run: |
          echo "🚀 Triggering sdlc-sdk-update.yml workflow in bitwarden/android repo..."
          gh workflow run sdlc-sdk-update.yml --repo bitwarden/android --ref main -f run-mode=Update -f sdk-package=$_SDK_PACKAGE -f sdk-version=$_SDK_VERSION