ci.yml

name: CI
on:
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - 'app/**'
      - 'gradle/**'
      - '*.gradle*'
      - 'gradle.properties'
      - '.github/workflows/ci.yml'
  pull_request:
    branches: [main]
    paths:
      - 'app/**'
      - 'gradle/**'
      - '*.gradle*'
      - 'gradle.properties'
      - '.github/workflows/ci.yml'

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      # The release keystore password sat in a tracked CLAUDE.md, in this
      # PUBLIC repo, from 2026-05-25 to 2026-08-06. GitGuardian ran on every PR
      # throughout and passed: it looks for high-entropy tokens, and what was
      # committed was a short memorable phrase in a sentence. This checks for
      # the shape a HUMAN writes instead, which is the half a scanner misses.
      # Needs no JDK, so it runs before the expensive setup.
      - name: No credentials in tracked files
        run: ./scripts/check-no-committed-credentials.sh

      - uses: actions/setup-java@v6.0.0
        with:
          distribution: temurin
          java-version: 17
      - uses: gradle/actions/setup-gradle@v6
      - uses: android-actions/setup-android@v4
      - run: ./gradlew jacocoTestReport

      # The icon goldens (CashPilot-android-vxb). Roborazzi renders Compose on
      # the JVM through Robolectric, so this needs no emulator and no device.
      #
      # verify, never record: a CI job that RE-RECORDS makes every change agree
      # with itself, which is the one outcome a visual gate must never produce.
      - name: Verify icon goldens
        run: ./gradlew verifyRoborazziDebug

      # The diffs are the whole point when this fails -- a red check saying
      # "an image changed" with no image is not actionable.
      - name: Upload golden diffs
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: roborazzi-diffs
          path: app/build/outputs/roborazzi/
          if-no-files-found: ignore
      - uses: codecov/codecov-action@v7
        if: github.event_name == 'push'
        with:
          files: app/build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml
          fail_ci_if_error: false