android-app-reproducible.yml

---
name: Android - Reprodubile
on:
  workflow_dispatch:
    inputs:
      override_container_image:
        description: Override container image
        type: string
        required: false
  push:
    branches: [wip-reproducible-action]
jobs:
  prepare:
    name: Prepare
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Use custom container image if specified
        if: ${{ github.event.inputs.override_container_image != '' }}
        run: echo "inner_container_image=${{ github.event.inputs.override_container_image }}"
          >> $GITHUB_ENV

      - name: Use default container image and resolve digest
        if: ${{ github.event.inputs.override_container_image == '' }}
        run: |
          echo "inner_container_image=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
    outputs:
      container_image: ${{ env.inner_container_image }}

  build:
    name: Reproducible build
    needs: [prepare]
    runs-on: ubuntu-latest
    timeout-minutes: 60
    container:
      image: ${{ needs.prepare.outputs.container_image }}
    strategy:
      fail-fast: true
      matrix:
        include:
          - iteration: a
            type: nativeful
            command: ./build-apk.sh --fdroid
            path: dist

          - iteration: b
            type: nativeful
            command: ./build-apk.sh --fdroid
            path: dist

          - iteration: a
            type: nativeless
            command: ./android/gradlew -p android clean assembleOssProdFdroid
            path: android/app/build/outputs/apk/ossProd/fdroid

          - iteration: b
            type: nativeless
            command: ./android/gradlew -p android clean assembleOssProdFdroid
            path: android/app/build/outputs/apk/ossProd/fdroid
    steps:
      - name: Fix HOME path
        run: echo "HOME=/root" >> $GITHUB_ENV

      - name: Fix git dir
        run: git config --global --add safe.directory $(pwd)

      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: true

      - name: Build (${{ matrix.type }}-${{ matrix.iteration }})
        run: bash -c "${{ matrix.command }}"

      - name: Upload (${{ matrix.type }}-${{ matrix.iteration }})
        uses: actions/upload-artifact@v4
        with:
          name: apk-${{ matrix.type }}-${{ matrix.iteration }}
          path: ${{ matrix.path }}
          if-no-files-found: error
          retention-days: 7

  verify-builds:
    name: Verify builds
    needs: [build]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: true
      matrix:
        include:
          - type: nativeful
            path: dist
          - type: nativeless
            path: dist
    steps:
      - name: Install diffoscope
        run: apt-get install diffoscope

      - uses: actions/download-artifact@v4
        with:
          pattern: apk-${{ matrix.type }}-*
          path: apks
          merge-multiple: true

      - name: Fix git dir
        run: find apks

      - name: print checksums
        run: find apks -name "*.apk" | xargs sha256sum

      - name: Run diffoscope
        run: diffoscope apks/*