mirror of
https://github.com/austinried/subtracks.git
synced 2026-11-10 23:21:59 +01:00
austinried
af3741a549
Extract checkout, nix, signing and the Gradle run into a reusable build workflow used by CI, the next build and the release build job. The build job holds only the signing secrets; the publish job is the only one with a write token and the Play credential. The Play service account is now written to a 0600 file and passed via --json_key instead of on argv.
48 lines
1.5 KiB
YAML
48 lines
1.5 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build:
|
|
permissions:
|
|
contents: read
|
|
uses: ./.github/workflows/build.yml
|
|
with:
|
|
gradle-args: ":app:ktlintCheck :app:lintDebug :app:testDebugUnitTest --no-configuration-cache --console=plain --no-daemon"
|
|
|
|
integration:
|
|
runs-on: ubuntu-26.04
|
|
timeout-minutes: 90
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
GRADLE_OPTS: -Dorg.gradle.daemon=false
|
|
NIX_CONFIG: experimental-features = nix-command flakes
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
- uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
|
|
- uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
|
|
with:
|
|
primary-key: nix-v2-${{ hashFiles('flake.lock', '**/*.nix') }}
|
|
restore-prefixes-first-match: nix-v2-
|
|
gc-max-store-size-linux: 6G
|
|
- uses: actions/cache@v6
|
|
with:
|
|
path: ~/.gradle/caches
|
|
key: gradle-${{ hashFiles('**/*.gradle*', '**/gradle.properties', 'gradle/libs.versions.toml', 'gradle/wrapper/gradle-wrapper.properties') }}
|
|
restore-keys: gradle-
|
|
- uses: actions/cache@v6
|
|
with:
|
|
path: .integration/music
|
|
key: integration-music-v1
|
|
- run: nix develop .#integration --command nu tools/integration-test.nu
|