Add Android CI job

Author: mhsmith

.github/actions/build-android/action.yml

@@ -0,0 +1,49 @@
+# This is coded as an action rather than a workflow so the release-tools
+# repository can load it from a dynamically-chosen commit. Cross-repository
+# workflow calls must have a Git reference hard-coded in the calling workflow,
+# but actions can be run dynamically from the runner's filesystem.
+
+name: Build and test (Android)
+description: Build and test (Android)
+
+inputs:
+  triplet:
+    description: Host triplet
+    required: true
+
+runs:
+  using: composite
+
+  steps:
+    # Build Python, and package it into a release artifact.
+    - run: ./Android/android.py build ${{ inputs.triplet }}
+    - run: ./Android/android.py package ${{ inputs.triplet }}
+    - uses: actions/upload-artifact@v4
+      with:
+        name: android
+        path: cross-build/${{ inputs.triplet }}/dist/*
+        if-no-files-found: error
+
+    # Currently, GitHub Actions can only run the Android emulator on Linux, so
+    # all the remaining steps are conditional on that.
+
+    # (https://github.blog/changelog/2024-04-02-github-actions-hardware-accelerated-android-virtualization-now-available/).
+    - name: Enable KVM for Android emulator
+      if: runner.os == "Linux"
+      run: |
+        echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
+          | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+        sudo udevadm control --reload-rules
+        sudo udevadm trigger --name-match=kvm
+
+    - name: Unpack release artifact
+      if: runner.os == "Linux"
+      run: |
+        mkdir $RUNNER_TEMP/android
+        tar -C $RUNNER_TEMP/android -xf cross-build/${{ inputs.triplet }}/dist/*
+
+    - name: Tests
+      if: runner.os == "Linux"
+      run: |
+        $RUNNER_TEMP/android/android.py test --managed maxVersion -v -- \
+          -uall --single-process --rerun -W

.github/workflows/build.yml

@@ -397,6 +397,31 @@ jobs:
     - name: SSL tests
       run: ./python Lib/test/ssltests.py
 
+  build-android:
+    name: "Android"
+    needs: build-context
+    if: needs.build-context.outputs.run-tests == 'true'
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [aarch64, x86_64]
+        include:
+          # Use the same runs-on configuration as build-macos and build-ubuntu.
+          - arch: aarch64
+            runs-on: ${{ github.repository_owner == 'python' && 'ghcr.io/cirruslabs/macos-runner:sonoma' || 'macos-14' }}
+          - arch: x86_64
+            runs-on: ubuntu-24.04
+
+    runs-on: ${{ matrix.runs-on }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/build-android
+        with:
+          triplet: ${{ matrix.arch }}-linux-android
+
   build-wasi:
     name: 'WASI'
     needs: build-context
@@ -705,6 +730,7 @@ jobs:
     - build-ubuntu
     - build-ubuntu-ssltests-awslc
     - build-ubuntu-ssltests-openssl
+    - build-android
     - build-wasi
     - test-hypothesis
     - build-asan
@@ -740,6 +766,7 @@ jobs:
             build-ubuntu,
             build-ubuntu-ssltests-awslc,
             build-ubuntu-ssltests-openssl,
+            build-android,
             build-wasi,
             test-hypothesis,
             build-asan,

.github/zizmor.yml

@@ -8,3 +8,6 @@ rules:
     config:
       policies:
         "*": ref-pin
+  obfuscation:
+    ignore:
+      - build.yml

.pre-commit-config.yaml

@@ -72,7 +72,7 @@ repos:
       - id: actionlint
 
   - repo: https://github.com/woodruffw/zizmor-pre-commit
-    rev: v1.6.0
+    rev: v1.11.0
     hooks:
       - id: zizmor
 

Android/README.md

@@ -96,10 +96,13 @@ similar to the `Android` directory of the CPython source tree.
 
 ## Testing
 
-The Python test suite can be run on Linux, macOS, or Windows:
+The Python test suite can be run on Linux, macOS, or Windows.
 
-* On Linux, the emulator needs access to the KVM virtualization interface, and
-  a DISPLAY environment variable pointing at an X server. Xvfb is acceptable.
+On Linux, the emulator needs access to the KVM virtualization interface. This may
+require adding your user to a group, or [changing your udev
+rules](https://github.blog/changelog/2024-04-02-github-actions-hardware-accelerated-android-virtualization-now-available/).
+If the emulator fails to start, try running `$ANDROID_HOME/emulator/emulator
+-accel-check`.
 
 The test suite can usually be run on a device with 2 GB of RAM, but this is
 borderline, so you may need to increase it to 4 GB. As of Android