feat(crypto): Add support for verification violation warnings #10805
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: APK Build | |
| on: | |
| pull_request: { } | |
| push: | |
| branches: [ main, develop ] | |
| # Enrich gradle.properties for CI/CD | |
| env: | |
| GRADLE_OPTS: -Dorg.gradle.jvmargs="-Xmx3072m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:MaxMetaspaceSize=1g" -Dkotlin.daemon.jvm.options="-Xmx2560m" -Dkotlin.incremental=false | |
| CI_GRADLE_ARG_PROPERTIES: --stacktrace -PpreDexEnable=false --max-workers 2 --no-daemon | |
| jobs: | |
| debug: | |
| name: Build debug APKs (${{ matrix.target }}) | |
| runs-on: ubuntu-latest | |
| if: github.ref != 'refs/heads/main' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: [ Gplay, Fdroid ] | |
| # Allow all jobs on develop. Just one per PR. | |
| concurrency: | |
| group: ${{ github.ref == 'refs/heads/develop' && format('integration-tests-develop-{0}-{1}', matrix.target, github.sha) || format('build-debug-{0}-{1}', matrix.target, github.ref) }} | |
| cancel-in-progress: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| # https://github.com/actions/checkout/issues/881 | |
| ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} | |
| - name: Use JDK 17 | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'temurin' # See 'Supported distributions' for available options | |
| java-version: '17' | |
| - name: Configure gradle | |
| uses: gradle/actions/setup-gradle@v3 | |
| with: | |
| cache-read-only: ${{ github.ref != 'refs/heads/develop' }} | |
| - name: Assemble ${{ matrix.target }} debug apk | |
| run: ./gradlew assemble${{ matrix.target }}Debug $CI_GRADLE_ARG_PROPERTIES | |
| - name: Upload ${{ matrix.target }} debug APKs | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: vector-${{ matrix.target }}-debug | |
| path: | | |
| vector-app/build/outputs/apk/*/debug/*.apk | |
| release: | |
| name: Build unsigned GPlay APKs | |
| runs-on: ubuntu-latest | |
| concurrency: | |
| group: ${{ github.ref == 'refs/head/main' && format('build-release-apk-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('build-release-apk-develop-{0}', github.sha) || format('build-debug-{0}', github.ref) }} | |
| cancel-in-progress: ${{ github.ref != 'refs/head/main' }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| # https://github.com/actions/checkout/issues/881 | |
| ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }} | |
| - name: Use JDK 17 | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'temurin' # See 'Supported distributions' for available options | |
| java-version: '17' | |
| - name: Configure gradle | |
| uses: gradle/actions/setup-gradle@v3 | |
| with: | |
| cache-read-only: ${{ github.ref != 'refs/heads/develop' }} | |
| - name: Assemble GPlay unsigned apk | |
| run: ./gradlew clean assembleGplayRelease $CI_GRADLE_ARG_PROPERTIES | |
| - name: Upload Gplay unsigned APKs | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: vector-gplay-release-unsigned | |
| path: | | |
| vector-app/build/outputs/apk/*/release/*.apk | |
| exodus: | |
| runs-on: ubuntu-latest | |
| needs: release | |
| steps: | |
| - name: Obtain apk from artifact | |
| id: download | |
| uses: actions/download-artifact@v3 | |
| with: | |
| name: vector-gplay-release-unsigned | |
| - name: Show apks in artifact | |
| run: ls -R ${{steps.download.outputs.download-path}} | |
| - name: Execute exodus-standalone | |
| uses: docker://exodusprivacy/exodus-standalone:latest | |
| with: | |
| # Don't fail when finding trackers so they can be reported later | |
| args: /github/workspace/gplay/release/vector-gplay-universal-release-unsigned.apk -j -o /github/workspace/exodus.json -e 0 | |
| - name: Upload exodus json report | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: exodus.json | |
| path: | | |
| exodus.json | |
| - name: Check for trackers | |
| env: | |
| SENTRY_ID: 447 | |
| # Should only contain a Sentry item | |
| run: | | |
| TRACKER_IDS=$(jq ".trackers[] | .id" exodus.json) | |
| [ $TRACKER_IDS = ${{ env.SENTRY_ID }} ] || { echo '::error static analysis identified user tracking library' ; exit 1; } |