ci.yaml

name: CI/CD

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  FLUTTER_VERSION_FILE: '.github/flutter-version.txt'
  # OSM tile server acknowledgment (proves we've read the usage policy)
  # See: https://operations.osmfoundation.org/policies/tiles/
  DART_DEFINES: '--dart-define=flutter.flutter_map.unblockOSM=Our tile servers are not.'

jobs:
  # Producer job: runs build_runner ONCE and publishes the generated sources as
  # an artifact. Everything else (analyze, test, builds) gates on this ~3 min
  # job instead of the full analyze job, so flutter analyze + format run in
  # PARALLEL with the test shards and builds rather than as a serial prefix.
  codegen:
    name: Code Generation
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Install dependencies
        run: flutter pub get

      - name: Run code generation
        run: dart run build_runner build --delete-conflicting-outputs

      # Share the generated sources (Drift/json_serializable/riverpod/freezed
      # outputs) so downstream jobs can skip the ~3 min build_runner bootstrap.
      # Mocks (*.mocks.dart) are committed, so only the gitignored *.g.dart /
      # *.freezed.dart files need to travel. We tar from the workspace root so
      # the lib/ and test/ path prefixes are preserved exactly (upload-artifact
      # would otherwise collapse paths to their least-common-ancestor dir).
      - name: Package generated code
        run: |
          mapfile -d '' files < <(find lib test -type f \( -name '*.g.dart' -o -name '*.freezed.dart' \) -print0)
          echo "Packaging ${#files[@]} generated files"
          if [ "${#files[@]}" -eq 0 ]; then echo "::error::no generated files to package"; exit 1; fi
          printf '%s\0' "${files[@]}" | tar --null -T - -czf generated-code.tar.gz

      - name: Upload generated code
        uses: actions/upload-artifact@v7
        with:
          name: generated-code
          path: generated-code.tar.gz
          if-no-files-found: error
          retention-days: 1

  analyze:
    name: Analyze & Format
    needs: codegen
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Install dependencies
        run: flutter pub get

      - name: Download generated code
        uses: actions/download-artifact@v8
        with:
          name: generated-code

      - name: Unpack generated code
        run: tar -xzf generated-code.tar.gz

      - name: Analyze code
        run: flutter analyze --fatal-infos

      - name: Check formatting
        run: dart format --set-exit-if-changed .

  test:
    name: Test (shard ${{ matrix.shard }})
    needs: codegen
    runs-on: ubuntu-latest
    strategy:
      # Don't cancel the other shards when one fails - we want the full picture.
      fail-fast: false
      matrix:
        # 0-based shard indices; keep TOTAL_SHARDS below in sync with the count.
        shard: [0, 1, 2, 3]
    env:
      TOTAL_SHARDS: 4
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Install dependencies
        run: flutter pub get

      - name: Download generated code
        uses: actions/download-artifact@v8
        with:
          name: generated-code

      - name: Unpack generated code
        run: tar -xzf generated-code.tar.gz

      - name: Run tests
        # flutter test's built-in --total-shards shards by test CASE, so every
        # shard still LOADS ~all test files and pays the dominant per-file cost
        # (isolate + Flutter binding + Drift setup, and ~3.6x amplified by
        # --coverage, which dumps the VM hit-map per suite). That barely divides
        # wall-clock. We instead shard by FILE so each job loads a disjoint
        # subset, which divides the per-file cost. Codecov merges the partial
        # coverage reports via the per-shard flag below.
        run: |
          total=$(find test -name '*_test.dart' | wc -l)
          # (NR-1) so the modulus is 0-based like matrix.shard: shard i owns
          # file indices i, i+N, i+2N, ... (shard 0 -> first file). Plain NR
          # (1-based) would map shard 0 to every Nth file and leave it empty
          # for suites smaller than N.
          mapfile -t files < <(find test -name '*_test.dart' | sort \
            | awk "(NR-1) % ${TOTAL_SHARDS} == ${{ matrix.shard }}")
          echo "Shard ${{ matrix.shard }}/${TOTAL_SHARDS}: ${#files[@]} of ${total} test files"
          # Guard: with no paths, `flutter test` runs the ENTIRE suite. An empty
          # shard (more shards than files) would silently re-run everything and
          # defeat sharding, so skip it and emit an empty lcov so the Codecov
          # step still has a file to upload.
          if [ "${#files[@]}" -eq 0 ]; then
            echo "No test files assigned to this shard; skipping."
            mkdir -p coverage && : > coverage/lcov.info
            exit 0
          fi
          flutter test --coverage --exclude-tags performance "${files[@]}"

      - name: Upload coverage
        uses: codecov/codecov-action@v7
        if: always()
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: coverage/lcov.info
          # Per-shard flag so Codecov merges the partial reports for this commit.
          flags: shard-${{ matrix.shard }}
          fail_ci_if_error: false  # Enable after configuring repo on codecov.io

  integration-test:
    name: Integration Test (macOS)
    needs: codegen
    runs-on: macos-14
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - name: Setup Xcode
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: 'latest-stable'

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Disable code signing for CI
        run: |
          echo 'CODE_SIGNING_ALLOWED = NO' >> macos/Runner/Configs/Debug.xcconfig
          echo 'CODE_SIGNING_REQUIRED = NO' >> macos/Runner/Configs/Debug.xcconfig
          echo 'CODE_SIGN_IDENTITY = ' >> macos/Runner/Configs/Debug.xcconfig

      - name: Install dependencies
        run: flutter pub get

      - name: Download generated code
        uses: actions/download-artifact@v8
        with:
          name: generated-code

      - name: Unpack generated code
        run: tar -xzf generated-code.tar.gz

      - name: Run integration tests
        run: |
          flutter test integration_test/ \
            -d macos \
            --dart-define=SCREENSHOT_MODE=false

  build-ios:
    name: Build iOS
    needs: codegen
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - name: Setup Xcode
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: 'latest-stable'

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Cache CocoaPods
        uses: actions/cache@v5
        with:
          path: |
            ios/Pods
            ~/.cocoapods
          key: pods-ios-${{ runner.os }}-${{ hashFiles('ios/Podfile.lock') }}
          restore-keys: |
            pods-ios-${{ runner.os }}-

      - name: Install dependencies
        run: flutter pub get

      - name: Download generated code
        uses: actions/download-artifact@v8
        with:
          name: generated-code

      - name: Unpack generated code
        run: tar -xzf generated-code.tar.gz

      - name: Update CocoaPods repo
        run: pod repo update

      - name: Clean native asset build state
        run: |
          rm -rf build/native_assets
          rm -rf .dart_tool/flutter_build

      - name: Build iOS
        run: flutter build ios --release --no-codesign "${{ env.DART_DEFINES }}" -v

      - name: Upload iOS artifact
        uses: actions/upload-artifact@v7
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        with:
          name: ios-build
          path: build/ios/iphoneos/Runner.app
          retention-days: 7

  build-macos:
    name: Build macOS
    needs: codegen
    runs-on: macos-14
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - name: Setup Xcode
        uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: 'latest-stable'

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Cache CocoaPods
        uses: actions/cache@v5
        with:
          path: |
            macos/Pods
            ~/.cocoapods
          key: pods-macos-${{ runner.os }}-${{ hashFiles('macos/Podfile.lock') }}
          restore-keys: |
            pods-macos-${{ runner.os }}-

      - name: Cache Xcode DerivedData
        uses: actions/cache@v5
        with:
          path: |
            ~/Library/Developer/Xcode/DerivedData
          key: deriveddata-${{ runner.os }}-${{ hashFiles('macos/Podfile.lock') }}
          restore-keys: |
            deriveddata-${{ runner.os }}-

      - name: Install dependencies
        run: flutter pub get

      - name: Download generated code
        uses: actions/download-artifact@v8
        with:
          name: generated-code

      - name: Unpack generated code
        run: tar -xzf generated-code.tar.gz

      - name: Update CocoaPods repo
        run: pod repo update

      - name: Clean native asset build state
        run: |
          rm -rf build/native_assets
          rm -rf .dart_tool/flutter_build

      - name: Build macOS (no-sandbox for distribution)
        run: |
          # Configure ad-hoc signing for CI (no developer certificate available)
          # Must modify project.pbxproj directly - xcconfig can't override target-level settings
          sed -i '' \
            -e 's/CODE_SIGN_IDENTITY = ".*"/CODE_SIGN_IDENTITY = "-"/g' \
            -e 's/DEVELOPMENT_TEAM = .*;/DEVELOPMENT_TEAM = "";/g' \
            -e 's/PROVISIONING_PROFILE_SPECIFIER = ".*"/PROVISIONING_PROFILE_SPECIFIER = ""/g' \
            -e 's/"CODE_SIGN_IDENTITY\[sdk=macosx\*\]" = ".*"/"CODE_SIGN_IDENTITY[sdk=macosx*]" = "-"/g' \
            macos/Runner.xcodeproj/project.pbxproj

          # Build with Flutter
          flutter build macos --release "${{ env.DART_DEFINES }}"

          # Re-sign with ad-hoc signature and no-sandbox entitlements
          codesign --force --deep --sign - \
            --entitlements macos/Runner/ReleaseNoSandbox.entitlements \
            build/macos/Build/Products/Release/submersion.app

      - name: Upload macOS artifact
        uses: actions/upload-artifact@v7
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        with:
          name: macos-build
          path: build/macos/Build/Products/Release/submersion.app
          retention-days: 7

  build-android:
    name: Build Android
    needs: codegen
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '21'

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Cache Gradle
        uses: actions/cache@v5
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            gradle-${{ runner.os }}-

      - name: Install dependencies
        run: flutter pub get

      - name: Download generated code
        uses: actions/download-artifact@v8
        with:
          name: generated-code

      - name: Unpack generated code
        run: tar -xzf generated-code.tar.gz

      - name: Build Android APK
        run: flutter build apk --release "${{ env.DART_DEFINES }}" -v

      # Guards against issue #318: a 4 KB-aligned native lib (liblibdc_jni.so)
      # silently shipped and crashed the app on Android 15+ 16 KB-page devices.
      # Fails the build if any 64-bit native library is not 16 KB-aligned.
      - name: Verify 16 KB native library alignment
        run: python3 scripts/check_16kb_alignment.py build/app/outputs/flutter-apk/app-release.apk

      - name: Upload Android artifact
        uses: actions/upload-artifact@v7
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        with:
          name: android-apk
          path: build/app/outputs/flutter-apk/app-release.apk
          retention-days: 7

  build-linux:
    name: Build Linux
    needs: codegen
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~/.pub-cache
            ${{ github.workspace }}/.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Install Linux dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            clang \
            cmake \
            ninja-build \
            pkg-config \
            libgtk-3-dev \
            liblzma-dev \
            libstdc++-12-dev \
            libsecret-1-dev

      - name: Install dependencies
        run: flutter pub get

      - name: Download generated code
        uses: actions/download-artifact@v8
        with:
          name: generated-code

      - name: Unpack generated code
        run: tar -xzf generated-code.tar.gz

      - name: Build Linux
        run: flutter build linux --release "${{ env.DART_DEFINES }}" -v

      - name: Upload Linux artifact
        uses: actions/upload-artifact@v7
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        with:
          name: linux-build
          path: build/linux/x64/release/bundle
          retention-days: 7

  build-windows:
    name: Build Windows
    needs: codegen
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: true

      - name: Read Flutter version
        id: flutter-ver
        # Windows runners default to PowerShell, where the bash-style
        # $(...) command substitution and $GITHUB_OUTPUT do not work. Without
        # this the version output is empty and subosito installs the latest
        # stable Flutter instead of the pinned version. See flutter-version.txt.
        shell: bash
        run: echo "version=$(cat ${{ env.FLUTTER_VERSION_FILE }})" >> "$GITHUB_OUTPUT"

      - uses: subosito/flutter-action@v2
        id: setup-flutter
        with:
          flutter-version: ${{ steps.flutter-ver.outputs.version }}
          channel: 'stable'

      - name: Cache Flutter SDK
        uses: actions/cache@v5
        with:
          path: ${{ steps.setup-flutter.outputs.CACHE-PATH }}
          key: ${{ steps.setup-flutter.outputs.CACHE-KEY }}

      - name: Cache pub dependencies
        uses: actions/cache@v5
        with:
          path: |
            ~\.pub-cache
            ${{ github.workspace }}\.dart_tool
          key: pub-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            pub-${{ runner.os }}-

      - name: Cache NuGet packages
        uses: actions/cache@v5
        with:
          path: |
            C:\Users\runneradmin\.nuget\packages
          key: nuget-${{ runner.os }}-${{ hashFiles('**/pubspec.lock') }}
          restore-keys: |
            nuget-${{ runner.os }}-

      - name: Install dependencies
        run: flutter pub get

      - name: Download generated code
        uses: actions/download-artifact@v8
        with:
          name: generated-code

      - name: Unpack generated code
        run: tar -xzf generated-code.tar.gz

      - name: Build Windows
        run: flutter build windows --release "${{ env.DART_DEFINES }}" -v

      - name: Upload Windows artifact
        uses: actions/upload-artifact@v7
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        with:
          name: windows-build
          path: build\windows\x64\runner\Release
          retention-days: 7

  # Single aggregation gate. Because the build jobs now run in parallel with the
  # test shards (needs: codegen, not needs: test), a green build no longer
  # implies tests passed. This job is the one to mark "required" in branch
  # protection - it fails if ANY needed job failed or was cancelled. Skipped
  # jobs (e.g. integration-test on push) are treated as acceptable.
  # NOTE: codegen MUST be listed here - if it fails, every downstream job is
  # SKIPPED, and skipped is treated as acceptable below, so without codegen in
  # the needs list a codegen failure would report a false green.
  ci-success:
    name: CI Success
    if: always()
    needs:
      - codegen
      - analyze
      - test
      - integration-test
      - build-ios
      - build-macos
      - build-android
      - build-linux
      - build-windows
    runs-on: ubuntu-latest
    steps:
      - name: Verify all required jobs succeeded
        run: |
          results="${{ join(needs.*.result, ' ') }}"
          echo "Upstream job results: $results"
          for r in $results; do
            if [ "$r" != "success" ] && [ "$r" != "skipped" ]; then
              echo "::error::A required job did not succeed (result=$r)"
              exit 1
            fi
          done
          echo "All required jobs passed."