ci.yaml

## Why do we specify bundler-cache: false?
##
## Ideally we should turn this on.
## But this flag runs bundle install and cache, which does not suit our use case here.
## See https://github.com/ruby/setup-ruby?tab=readme-ov-file#caching-bundle-install-automatically

name: CI

on:
  push:
    branches:
    - '*'
    - '!gh-pages'
  pull_request:
    branches:
    - '*'
    - '!gh-pages'

jobs:
  test:
    runs-on: macos-14
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version-file: "./.tool-versions"
    - uses: ruby/setup-ruby@v1
      with:
        bundler-cache: false
    - run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
    - run: bundle install
    - run: npm ci
    - run: npm ci
      working-directory: ./website
    - run: npm audit
      if: ${{ !cancelled() }}
    - run: npm audit
      working-directory: ./website
      if: ${{ !cancelled() }}
    - run: npm run format
      if: ${{ !cancelled() }}
    - run: npm run lint
      if: ${{ !cancelled() }}
    - run: npm run typecheck
      if: ${{ !cancelled() }}
    - run: npm run test
      if: ${{ !cancelled() }}
    - run: npm run verify
      if: ${{ !cancelled() }}
    - run: npm run bundle
      if: ${{ !cancelled() }}
    - run: make docs
      if: ${{ !cancelled() }}

  webapp-image:
    runs-on: ubuntu-24.04
    needs: test
    steps:
    - uses: actions/checkout@v4
    - run: make build-image
    - uses: docker/login-action@v3
      if: ${{ github.repository == 'authgear/authgear-sdk-js' && github.event_name == 'push' }}
      with:
        registry: quay.io
        username: ${{ secrets.QUAY_USERNAME }}
        password: ${{ secrets.QUAY_ROBOT_TOKEN }}
    - run: make push-image
      if: ${{ github.repository == 'authgear/authgear-sdk-js' && github.event_name == 'push' }}

  # react_native_ios cannot be built on simulator due to WeChat SDK

  test_react_native_android:
    # When we change the runner image, the available Android build tools versions will also change.
    # We need to update build.gradle too.
    # See https://github.com/actions/runner-images/blob/main/images/macos/macos-14-arm64-Readme.md
    runs-on: macos-14
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version-file: "./.tool-versions"
    - run: make sdk-build
    - run: make react-native-npm-ci
    - run: make react-native-build-unsigned-apk

  test_capacitor_ios:
    runs-on: macos-14
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version-file: "./.tool-versions"
    - uses: ruby/setup-ruby@v1
      with:
        bundler-cache: false
    - run: bundle install
    - run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
    - run: make sdk-build
    - run: make capacitor-npm-ci
    - run: make capacitor-build-js
    - run: make capacitor-build-ios-simulator

  test_capacitor_android:
    runs-on: macos-14
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version-file: "./.tool-versions"
    - run: make sdk-build
    - run: make capacitor-npm-ci
    - run: make capacitor-build-js
    - run: make capacitor-build-unsigned-apk

  react_native_ios:
    if: ${{ github.repository == 'authgear/authgear-sdk-js' }}
    needs: test
    # When we change the runner image, the ruby version will change too.
    # We need to update .tool-versions to make them the same.
    # See https://github.com/actions/runner-images/blob/main/images/macos/macos-14-arm64-Readme.md
    runs-on: macos-14
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version-file: "./.tool-versions"
    - uses: ruby/setup-ruby@v1
      with:
        bundler-cache: false
    - run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
    - run: make sdk-build
    - run: make react-native-npm-ci
    - run: make react-native-bundle-install
    - run: make react-native-pod-install
    - name: Install the Apple certificate and provisioning profile
      env:
        IOS_CERTIFICATE_BASE64: ${{ secrets.REACT_NATIVE_IOS_CERTIFICATE_BASE64 }}
        IOS_PROVISIONING_PROFILE_BASE64: ${{ secrets.REACT_NATIVE_IOS_PROVISIONING_PROFILE_BASE64 }}
      run: |
        CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
        PP_PATH=$RUNNER_TEMP/build_pp.mobileprovision
        KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

        echo -n "$IOS_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
        echo -n "$IOS_PROVISIONING_PROFILE_BASE64" | base64 --decode -o $PP_PATH

        security create-keychain -p "" $KEYCHAIN_PATH
        security set-keychain-settings $KEYCHAIN_PATH
        security unlock-keychain -p "" $KEYCHAIN_PATH

        security import $CERTIFICATE_PATH -P "" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
        security list-keychain -d user -s $KEYCHAIN_PATH

        mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
        cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles
    - name: Install App Store Connect API key
      env:
        IOS_API_KEY_BASE64: ${{ secrets.IOS_API_KEY_BASE64 }}
        IOS_API_KEY_ID: ${{ secrets.IOS_API_KEY_ID }}
      run: |
        API_KEY_PATH=$RUNNER_TEMP/AuthKey_${IOS_API_KEY_ID}.p8
        echo -n "$IOS_API_KEY_BASE64" | base64 --decode -o $API_KEY_PATH
    - run: make react-native-set-CFBundleVersion
    - name: Run xcodebuild archive
      run: |
        export REACT_NATIVE_ARCHIVE_PATH="$RUNNER_TEMP/reactNativeExample.xcarchive"
        make react-native-archive
    - name: Run xcodebuild -exportArchive
      run: |
        export REACT_NATIVE_ARCHIVE_PATH="$RUNNER_TEMP/reactNativeExample.xcarchive"
        export REACT_NATIVE_EXPORT_PATH="$RUNNER_TEMP/reactNativeExample.export"
        make react-native-export-archive
    - name: Validate .ipa
      env:
        API_ISSUER: ${{ secrets.IOS_API_KEY_ISSUER }}
        API_KEY: ${{ secrets.IOS_API_KEY_ID }}
      run: |
        export API_PRIVATE_KEYS_DIR="$RUNNER_TEMP"
        export IPA_PATH="$RUNNER_TEMP/reactNativeExample.export/reactNativeExample.ipa"
        make validate-app
    - name: Upload to TestFlight
      if: ${{ github.ref == 'refs/heads/master' }}
      env:
        API_ISSUER: ${{ secrets.IOS_API_KEY_ISSUER }}
        API_KEY: ${{ secrets.IOS_API_KEY_ID }}
      run: |
        export API_PRIVATE_KEYS_DIR="$RUNNER_TEMP"
        export IPA_PATH="$RUNNER_TEMP/reactNativeExample.export/reactNativeExample.ipa"
        make upload-app
    - name: Clean up keychain and provisioning profile
      if: ${{ always() }}
      run: |
        security delete-keychain $RUNNER_TEMP/app-signing.keychain-db
        rm ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.mobileprovision

  react_native_android:
    if: ${{ github.repository == 'authgear/authgear-sdk-js' }}
    needs: test
    # When we change the runner image, the available Android build tools versions will also change.
    # We need to update build.gradle too.
    # See https://github.com/actions/runner-images/blob/main/images/macos/macos-14-arm64-Readme.md
    runs-on: macos-14
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version-file: "./.tool-versions"
    - uses: ruby/setup-ruby@v1
      with:
        bundler-cache: false
    - run: make sdk-build
    - run: make react-native-npm-ci
    - run: make react-native-set-versionCode
    - run: make react-native-build-unsigned-apk
    - name: Install keystore
      env:
        ANDROID_KEYSTORE_BASE64: ${{ secrets.REACT_NATIVE_ANDROID_KEYSTORE_BASE64 }}
      run: |
        KEYSTORE_PATH=$RUNNER_TEMP/keystore.jks
        echo -n "$ANDROID_KEYSTORE_BASE64" | base64 --decode -o $KEYSTORE_PATH
    - run: make react-native-zipalign
    - name: Run apksigner
      env:
        ANDROID_KEYSTORE_PASSWORD: ${{ secrets.REACT_NATIVE_ANDROID_KEYSTORE_PASSWORD }}
        ANDROID_KEY_ALIAS: ${{ secrets.REACT_NATIVE_ANDROID_KEY_ALIAS }}
        ANDROID_KEY_PASSWORD: ${{ secrets.REACT_NATIVE_ANDROID_KEY_PASSWORD }}
      run: |
        export ANDROID_KEYSTORE_PATH="$RUNNER_TEMP/keystore.jks"
        make react-native-apksigner
    - name: Distribute to App Center
      if: ${{ github.ref == 'refs/heads/master' }}
      env:
        APPCENTER_ACCESS_TOKEN: ${{ secrets.REACT_NATIVE_ANDROID_APPCENTER_ACCESS_TOKEN }}
      run: appcenter distribute release --debug --silent --file ./example/reactnative/android/app/build/outputs/apk/release/app-release-signed.apk --group "Collaborators" --app "Oursky/Authgear-demo-RN-Android" --release-notes "no release notes"

  capacitor_ios:
    if: ${{ github.repository == 'authgear/authgear-sdk-js' }}
    needs: test
    runs-on: macos-14
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version-file: "./.tool-versions"
    - uses: ruby/setup-ruby@v1
      with:
        bundler-cache: false
    - run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
    - run: make sdk-build
    - run: make capacitor-npm-ci
    - run: make capacitor-npm-audit
    - run: make capacitor-build-js
    - name: Install the Apple certificate and provisioning profile
      env:
        IOS_CERTIFICATE_BASE64: ${{ secrets.CAPACITOR_IOS_CERTIFICATE_BASE64 }}
        IOS_PROVISIONING_PROFILE_BASE64: ${{ secrets.CAPACITOR_IOS_PROVISIONING_PROFILE_BASE64 }}
      run: |
        CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
        PP_PATH=$RUNNER_TEMP/build_pp.mobileprovision
        KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

        echo -n "$IOS_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
        echo -n "$IOS_PROVISIONING_PROFILE_BASE64" | base64 --decode -o $PP_PATH

        security create-keychain -p "" $KEYCHAIN_PATH
        security set-keychain-settings $KEYCHAIN_PATH
        security unlock-keychain -p "" $KEYCHAIN_PATH

        security import $CERTIFICATE_PATH -P "" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
        security list-keychain -d user -s $KEYCHAIN_PATH

        mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
        cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles
    - name: Install App Store Connect API key
      env:
        IOS_API_KEY_BASE64: ${{ secrets.IOS_API_KEY_BASE64 }}
        IOS_API_KEY_ID: ${{ secrets.IOS_API_KEY_ID }}
      run: |
        API_KEY_PATH=$RUNNER_TEMP/AuthKey_${IOS_API_KEY_ID}.p8
        echo -n "$IOS_API_KEY_BASE64" | base64 --decode -o $API_KEY_PATH
    - run: make capacitor-set-CFBundleVersion
    - name: Run xcodebuild archive
      run: |
        export CAPACITOR_ARCHIVE_PATH="$RUNNER_TEMP/App.xcarchive"
        make capacitor-archive
    - name: Run xcodebuild -exportArchive
      run: |
        export CAPACITOR_ARCHIVE_PATH="$RUNNER_TEMP/App.xcarchive"
        export CAPACITOR_EXPORT_PATH="$RUNNER_TEMP/App.export"
        make capacitor-exportArchive
    - name: Validate .ipa
      env:
        API_ISSUER: ${{ secrets.IOS_API_KEY_ISSUER }}
        API_KEY: ${{ secrets.IOS_API_KEY_ID }}
      run: |
        export API_PRIVATE_KEYS_DIR="$RUNNER_TEMP"
        export IPA_PATH="$RUNNER_TEMP/App.export/App.ipa"
        make validate-app
    - name: Upload to TestFlight
      if: ${{ github.ref == 'refs/heads/master' }}
      env:
        API_ISSUER: ${{ secrets.IOS_API_KEY_ISSUER }}
        API_KEY: ${{ secrets.IOS_API_KEY_ID }}
      run: |
        export API_PRIVATE_KEYS_DIR="$RUNNER_TEMP"
        export IPA_PATH="$RUNNER_TEMP/App.export/App.ipa"
        make upload-app
    - name: Clean up keychain and provisioning profile
      if: ${{ always() }}
      run: |
        security delete-keychain $RUNNER_TEMP/app-signing.keychain-db
        rm ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.mobileprovision

  capacitor_android:
    if: ${{ github.repository == 'authgear/authgear-sdk-js' }}
    needs: test
    runs-on: macos-14
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version-file: "./.tool-versions"
    - uses: ruby/setup-ruby@v1
      with:
        bundler-cache: false
    - run: npm install -g appcenter-cli
    - run: make sdk-build
    - run: make capacitor-npm-ci
    - run: make capacitor-npm-audit
    - run: make capacitor-build-js
    - run: make capacitor-set-versionCode
    - run: make capacitor-build-unsigned-apk
    - name: Install keystore
      env:
        ANDROID_KEYSTORE_BASE64: ${{ secrets.CAPACITOR_ANDROID_KEYSTORE_BASE64 }}
      run: |
        KEYSTORE_PATH=$RUNNER_TEMP/keystore.jks
        echo -n "$ANDROID_KEYSTORE_BASE64" | base64 --decode -o $KEYSTORE_PATH
    - run: make capacitor-zipalign
    - name: Run apksigner
      env:
        ANDROID_KEYSTORE_PASSWORD: ${{ secrets.CAPACITOR_ANDROID_KEYSTORE_PASSWORD }}
        ANDROID_KEY_ALIAS: ${{ secrets.CAPACITOR_ANDROID_KEY_ALIAS }}
        ANDROID_KEY_PASSWORD: ${{ secrets.CAPACITOR_ANDROID_KEY_PASSWORD }}
      run: |
        export ANDROID_KEYSTORE_PATH="$RUNNER_TEMP/keystore.jks"
        make capacitor-apksigner
    - name: Distribute to App Center
      if: ${{ github.ref == 'refs/heads/master' }}
      env:
        APPCENTER_ACCESS_TOKEN: ${{ secrets.CAPACITOR_ANDROID_APPCENTER_ACCESS_TOKEN }}
      run: appcenter distribute release --debug --silent --file ./example/capacitor/android/app/build/outputs/apk/release/app-release-signed.apk --group "Collaborators" --app "Oursky/Authgear-Demo-Capacitor-Android" --release-notes "no release notes"