.gitlab-ci.yml

stages:
  - build
  - ios
  - test
  - security
  - deploy
  - upload
  - e2e

include:
  - template: Jobs/SAST.gitlab-ci.yml
  - template: Jobs/Secret-Detection.gitlab-ci.yml
  - template: Jobs/Dependency-Scanning.v2.gitlab-ci.yml

variables:
  GRADLE_USER_HOME: "${CI_PROJECT_DIR}/.gradle"
  GRADLE_OPTS: "-Dorg.gradle.daemon=true -Dorg.gradle.parallel=true"
  FF_USE_FASTZIP: "true"
  ANDROID_IMAGE: blockstream/green_android
  HOMEBREW_NO_AUTO_UPDATE: 1
  SAST_EXCLUDED_PATHS: "spec, test, tests, tmp, vendor, node_modules, .git"
  AST_ENABLE_MR_PIPELINES: "false"

cache:
  - key:
      files:
        - gradle/wrapper/gradle-wrapper.properties
        - gradle/libs.versions.toml
      prefix: "$CI_PROJECT_NAME-$CI_COMMIT_REF_SLUG"
    paths:
      - "$CI_PROJECT_DIR/.gradle/caches"
      - "$CI_PROJECT_DIR/.gradle/wrapper"
    policy: pull-push # Pull at start, push if job succeeds
    when: on_success

# Defaults applied to all jobs unless overridden
default:
  image: # 5592d41c-20250213165311
    name: blockstream/green_android@sha256:260afcc4b8d8defeb7f03981ccea1b0b046c2d4464d3e2fa14731e3399453664
    entrypoint: [""]
  tags:
    - ga

#####################################
# Build blockstream/green_android
.prep_dind:
  image: docker:27
  variables:
    DOCKER_HOST: tcp://docker:2375
    DOCKER_TLS_CERTDIR: ""
    DOCKER_BUILDKIT: 1
  services:
    - name: docker:27-dind
      command: ["dockerd", "--host=tcp://0.0.0.0:2375"]
      alias: "docker"
  tags:
    - cloud
  retry:
    max: 2
    when:
      - runner_system_failure
      - unknown_failure
      - stuck_or_timeout_failure

# Pushes two tags - :short_commit_sha and :latest
build_default_image:
  extends: .prep_dind
  stage: build
  variables:
    DOCKERFILE: contrib/Dockerfile
    ANDROID_IMAGE_SHA: ${ANDROID_IMAGE}:${CI_COMMIT_SHORT_SHA}
    ANDROID_IMAGE_LATEST: ${ANDROID_IMAGE}:latest
  when: manual
  #  rules:
  #    - changes:
  #      - ${DOCKERFILE}
  script:
    - apk add jq curl
    - docker buildx build
      --push
      -f ${DOCKERFILE}
      --build-arg BUILDKIT_INLINE_CACHE=1
      --cache-from ${ANDROID_IMAGE_LATEST}
      -t ${ANDROID_IMAGE_SHA}
      -t ${ANDROID_IMAGE_LATEST}
      contrib/
    - digest=$(docker inspect ${ANDROID_IMAGE_SHA} | jq -r '.[] | .RepoDigests')
    - echo "Cancelling the rest of the pipeline"
    - echo "Update the default.image version with the new image SHA digest"
    - echo "${digest}"
    - |
      curl -s --request POST --header "PRIVATE-TOKEN: $CI_CANCEL_PIPELINE_TOKEN" \
        "$CI_API_V4_URL/projects/$CI_PROJECT_ID/pipelines/$CI_PIPELINE_ID/cancel"

#####################################
# iOS Env
.ios_env:
  image: macos-15-xcode-16
  tags:
    - saas-macos-large-m2pro
  cache:
    - key:
        files:
          - Gemfile.lock
      paths:
        - vendor/bundle
  before_script:
    - npm install -g firebase-tools
    - bundle update --bundler
    - bundle check --path vendor/bundle || bundle install --path vendor/bundle --jobs $(nproc)

#####################################
# Build iOS

iosFirebaseAppDistribution:
  extends: .ios_env
  stage: ios
  when: manual
  script:
    - 'MESSAGE="Merge Request: !${CI_MERGE_REQUEST_IID} - ${CI_MERGE_REQUEST_TITLE}\\nBranch: ${CI_MERGE_REQUEST_SOURCE_BRANCH_NAME}\\nCommit: ${CI_COMMIT_SHA}"'
    - bundle exec fastlane ios FirebaseAppDistribution message:"${MESSAGE}"

#####################################
# Build XCFramework
xcframework_common:
  stage: build
  when: manual
  artifacts:
    name: "green_xcframework-$CI_COMMIT_SHORT_SHA"
    expire_in: 4 days
    when: on_success
    paths:
      - common/build/XCFrameworks/*.zip
  tags:
    - osx
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - ./gradlew common:assembleXCFramework
    - cd common/build/XCFrameworks
    - zip -r debug.zip debug
    - zip -r release.zip release

#####################################
# Build Signed APKs

production:
  stage: build
  tags:
    - cloud
  retry:
    max: 2
    when:
      - runner_system_failure
      - unknown_failure
      - stuck_or_timeout_failure
  artifacts:
    name: "$CI_PROJECT_NAME-$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
    expire_in: 7 days
    when: on_success
    paths:
      - androidApp/build/outputs/apk/productionGoogle/release/*.apk
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - echo $ANDROID_KEYSTORE_BASE64 | base64 -d > keystore.jks
    - ./gradlew useBlockstreamKeys
    - ./gradlew printLwkVersion
    - ./gradlew assembleProductionGoogleRelease

production_fdroid:
  stage: build
  when: manual
  artifacts:
    name: "$CI_PROJECT_NAME-$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
    expire_in: 7 days
    when: on_success
    paths:
      - androidApp/build/outputs/apk/productionFDroid/release/*.apk
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - echo $ANDROID_KEYSTORE_BASE64 | base64 -d > keystore.jks
    #    - ./prepare_fdroid.sh
    - ./gradlew assembleProductionFDroidRelease

development:
  stage: build
  tags:
    - cloud
  retry:
    max: 2
    when:
      - runner_system_failure
      - unknown_failure
      - stuck_or_timeout_failure
  when: manual
  artifacts:
    name: "$CI_PROJECT_NAME-$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
    expire_in: 7 days
    when: on_success
    paths:
      - androidApp/build/outputs/apk/development/release/*.apk
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - echo $ANDROID_KEYSTORE_BASE64 | base64 -d > keystore.jks
    - ./gradlew useBlockstreamKeys
    - ./gradlew printLwkVersion
    - ./gradlew assembleDevelopmentRelease

production_debug:
  stage: build
  when: manual
  cache:
    policy: pull
  artifacts:
    name: "$CI_PROJECT_NAME-$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
    expire_in: 7 days
    when: on_success
    paths:
      - androidApp/build/outputs/apk/productionGoogle/debug/*.apk
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - echo $ANDROID_KEYSTORE_BASE64 | base64 -d > keystore.jks
    - ./gradlew useBlockstreamKeys
    - ./gradlew assembleProductionGoogleDebug

gdk_commit:
  stage: build
  artifacts:
    name: "$CI_PROJECT_NAME-$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA-gdk-$GDK_COMMIT"
    expire_in: 7 days
    when: on_success
    paths:
      - androidApp/build/outputs/apk/development/debug/*.apk
  when: manual
  cache:
    policy: pull
  variables:
    GDK_COMMIT: master
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - echo $ANDROID_KEYSTORE_BASE64 | base64 -d > keystore.jks
    - echo "GDK_COMMIT=$GDK_COMMIT"
    - ./gdk/fetch_android_binaries.sh -c $GDK_COMMIT
    - ./gradlew useBlockstreamKeys
    - ./gradlew assembleDevelopmentDebug

#####################################
# Build Unsigned APK

build_google_play:
  stage: build
  tags:
    - cloud
  retry:
    max: 2
    when:
      - runner_system_failure
      - unknown_failure
      - stuck_or_timeout_failure
  when: manual
  artifacts:
    name: "$CI_PROJECT_NAME-$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
    expire_in: 1 hour
    when: on_success
    paths:
      - androidApp/build/outputs/apk/productionGoogle/release/*.apk
      - androidApp/build/outputs/mapping/*/mapping.txt
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - ./gradlew useBlockstreamKeys
    - ./gradlew assembleProductionGoogleRelease

build_osx:
  stage: build
  when: manual
  tags:
    - osx
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - ./gradlew useBlockstreamKeys
    - ./gradlew assembleProductionGoogleRelease

#####################################
# Test

unit_tests:
  stage: test
  tags:
    - cloud
  retry:
    max: 2
    when:
      - runner_system_failure
      - unknown_failure
      - stuck_or_timeout_failure
  cache:
    policy: pull
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  needs: []
  script:
    - cd $CI_PROJECT_DIR
    - ./gradlew useBlockstreamKeys
    #    - ./gradlew lintProductionGoogleRelease
    - ./gradlew test

#####################################
# SECURITY

sast:
  stage: security

secret_detection:
  stage: security

dependency-scanning:
  stage: security

#####################################
# Sign production build

sign_google_play:
  tags:
    - garelease
  stage: deploy
  cache: []
  artifacts:
    name: "$CI_PROJECT_NAME-$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
    expire_in: 30 days
    paths:
      - androidApp/build/outputs/*
    when: on_success
  script:
    - cd $CI_PROJECT_DIR/androidApp/build/outputs/apk/productionGoogle/release/
    - /opt/process_release
  needs:
    - build_google_play

#####################################
# Upload to GCS bucket
.gcp_prep:
  stage: upload
  image: blockstream/gcloud-docker:27.3-504.0.1
  cache: []
  tags:
    - k8s # Simple, non-resource intensive jobs

.gcp_auth_inline:
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://gl.blockstream.io
  variables:
    POOL_ID: gitlab-2f4bb583
    PROVIDER_ID: gitlab
    SERVICE_ACCOUNT_EMAIL: green-android-builds-uploader@green-backend.iam.gserviceaccount.com
  before_script:
    - echo ${GITLAB_OIDC_TOKEN} > .ci_job_jwt_file
    - gcloud iam workload-identity-pools create-cred-config "projects/697214616889/locations/global/workloadIdentityPools/${POOL_ID}/providers/${PROVIDER_ID}"
      --service-account="${SERVICE_ACCOUNT_EMAIL}"
      --output-file=.gcp_temp_cred.json
      --credential-source-file=.ci_job_jwt_file
    - gcloud auth login --cred-file=.gcp_temp_cred.json --update-adc

gcp_push_production:
  extends:
    - .gcp_prep
    - .gcp_auth_inline
  when: manual
  allow_failure: true
  needs:
    - job: production
      optional: true
  variables:
    GCS_BUCKET: green-android-builds
    APK_NAME: $CI_PROJECT_NAME-$CI_COMMIT_SHA
  script:
    - echo "Uploading gs://$GCS_BUCKET/$APK_NAME"
    - gsutil -m cp -r $CI_PROJECT_DIR/androidApp/build/outputs/apk/productionGoogle/release/*.apk gs://$GCS_BUCKET/$APK_NAME.apk
    - echo "https://storage.googleapis.com/$GCS_BUCKET/$APK_NAME.apk"

gcp_push_development:
  extends:
    - .gcp_prep
    - .gcp_auth_inline
  needs:
    - job: development
      optional: true
  variables:
    GCS_BUCKET: green-android-builds
    APK_NAME: $CI_PROJECT_NAME-$CI_COMMIT_SHA-development
  script:
    - echo "Uploading gs://$GCS_BUCKET/$APK_NAME"
    - gsutil -m cp -r $CI_PROJECT_DIR/androidApp/build/outputs/apk/development/release/*.apk gs://$GCS_BUCKET/$APK_NAME.apk
    - echo "https://storage.googleapis.com/$GCS_BUCKET/$APK_NAME.apk"

gcp_push_gdk_commit:
  extends:
    - .gcp_prep
    - .gcp_auth_inline
  needs:
    - job: gdk_commit
      optional: true
  variables:
    GCS_BUCKET: green-android-builds
    APK_NAME: $CI_PROJECT_NAME-$CI_COMMIT_SHA-gdk
  script:
    - echo "Uploading gs://$GCS_BUCKET/$APK_NAME"
    - gsutil -m cp -r $CI_PROJECT_DIR/androidApp/build/outputs/apk/productionGoogle/release/*.apk gs://$GCS_BUCKET/$APK_NAME.apk
    - echo "https://storage.googleapis.com/$GCS_BUCKET/$APK_NAME.apk"

#####################################
# E2E Tests - Base Templates

.e2e:build:
  stage: build
  tags:
    - cloud
  retry:
    max: 2
    when:
      - runner_system_failure
      - unknown_failure
      - stuck_or_timeout_failure
  artifacts:
    name: "$CI_PROJECT_NAME-e2e-$CI_COMMIT_SHORT_SHA"
    expire_in: 1 day
    when: on_success
    paths:
      - androidApp/build/outputs/apk/development/release/*.apk
  variables:
    GIT_SUBMODULE_STRATEGY: recursive
  script:
    - cd $CI_PROJECT_DIR
    - echo $ANDROID_KEYSTORE_BASE64 | base64 -d > keystore.jks
    - ./gradlew useBlockstreamKeys
    - ./gradlew assembleDevelopmentRelease

.e2e:upload:
  extends: .gcp_auth_inline
  stage: e2e
  image: blockstream/gcloud-docker:27.3-504.0.1
  tags:
    - k8s
  variables:
    GCS_BUCKET: green-android-builds
  script:
    - echo "Uploading gs://$GCS_BUCKET/$APK_NAME.apk"
    - gsutil -m cp -r $CI_PROJECT_DIR/androidApp/build/outputs/apk/development/release/*.apk gs://$GCS_BUCKET/$APK_NAME.apk
    - echo "https://storage.googleapis.com/$GCS_BUCKET/$APK_NAME.apk"

#####################################
# E2E Tests - Nightly (Scheduled)

e2e:nightly:build:
  extends: .e2e:build
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"

e2e:nightly:upload:
  extends: .e2e:upload
  variables:
    APK_NAME: $CI_PROJECT_NAME-$CI_COMMIT_SHA-nightly
  needs:
    - e2e:nightly:build
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"

e2e:nightly:trigger:
  stage: e2e
  needs:
    - e2e:nightly:upload
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
  trigger:
    project: blockstream/green/maestro-blockstream
  variables:
    UPSTREAM_APK_URL: "https://storage.googleapis.com/green-android-builds/${CI_PROJECT_NAME}-${CI_COMMIT_SHA}-nightly.apk"
    UPSTREAM_APP_ID: "com.greenaddress.greenbits_android_wallet.dev"
    UPSTREAM_COMMIT_SHA: $CI_COMMIT_SHA
    UPSTREAM_MODE: "full"
    UPSTREAM_TYPE: "nightly"

#####################################
# E2E Tests - Release (Tag)

e2e:release:build:
  extends: .e2e:build
  rules:
    - if: $CI_COMMIT_TAG =~ /^release_\d+\.\d+\.\d+/

e2e:release:upload:
  extends: .e2e:upload
  variables:
    APK_NAME: $CI_PROJECT_NAME-$CI_COMMIT_TAG
  needs:
    - e2e:release:build
  rules:
    - if: $CI_COMMIT_TAG =~ /^release_\d+\.\d+\.\d+/

e2e:release:trigger:
  stage: e2e
  needs:
    - e2e:release:upload
  rules:
    - if: $CI_COMMIT_TAG =~ /^release_\d+\.\d+\.\d+/
  trigger:
    project: blockstream/green/maestro-blockstream
  variables:
    UPSTREAM_APK_URL: "https://storage.googleapis.com/green-android-builds/${CI_PROJECT_NAME}-${CI_COMMIT_TAG}.apk"
    UPSTREAM_APP_ID: "com.greenaddress.greenbits_android_wallet.dev"
    UPSTREAM_COMMIT_SHA: $CI_COMMIT_SHA
    UPSTREAM_COMMIT_TAG: $CI_COMMIT_TAG
    UPSTREAM_MODE: "full"
    UPSTREAM_TYPE: "release"