gh-137242: Add Android CI job

.github/actions/build-android/action.yml

@@ -0,0 +1,77 @@
+# This is coded as an action rather than a workflow so the release-tools
+# repository can load it from a dynamically-chosen commit. Cross-repository
+# workflow calls must have a Git reference hard-coded in the calling workflow,
+# but actions can be run dynamically from the runner's filesystem.
+
+name: Build and test (Android)
+description: Build and test (Android)
+
+inputs:
+  triplet:
+    description: Host triplet
+    required: true
+
+runs:
+  using: composite
+
+  steps:
+    # The steps of a composite action are not clearly divided in the GitHub
+    # UI, so use a single step with ::group:: markers instead.
+    - shell: bash
+      env:
+        triplet: ${{ inputs.triplet }}
+      # The `name` of a composite action step doesn't appear anywhere in the
+      # GitHub UI, so put it in a comment on the first line instead.
+      run: |
+        # Build and test (Android)
+        echo "::group::Configure build Python"
+        ./Android/android.py configure-build
+        echo "::endgroup::"
+
+        echo "::group::Compile build Python"
+        ./Android/android.py make-build
+        echo "::endgroup::"
+
+        echo "::group::Configure host Python"
+        ./Android/android.py configure-host $triplet
+        echo "::endgroup::"
+
+        echo "::group::Compile host Python"
+        ./Android/android.py make-host $triplet
+        echo "::endgroup::"
+
+        echo "::group::Make release package"
+        ./Android/android.py package $triplet
+        echo "::endgroup::"
+
+        if [ "$RUNNER_OS" = "Linux" ] && [ "$RUNNER_ARCH" = "X64" ]; then
+            # https://github.blog/changelog/2024-04-02-github-actions-hardware-accelerated-android-virtualization-now-available/
+            echo "::group::Enable KVM for Android emulator"
+            echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
+              | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+            sudo udevadm control --reload-rules
+            sudo udevadm trigger --name-match=kvm
+            echo "::endgroup::"
+
+            echo "::group::Unpack release artifact"
+            mkdir $RUNNER_TEMP/android
+            tar -C $RUNNER_TEMP/android -xf cross-build/$triplet/dist/*
+            echo "::endgroup::"
+
+            echo "::group::Tests"
+            # Arguments are similar to --fast-ci, but in single-process mode.
+            $RUNNER_TEMP/android/android.py test --managed maxVersion -v -- \
+              --single-process --fail-env-changed --rerun --slowest --verbose3 \
+              -u "all,-cpu" --timeout=600
+            echo "::endgroup::"
+
+        else
+            echo "Skipping test: GitHub Actions currently only supports the" \
+              "Android emulator on Linux x86_64."
+        fi
+
+    - uses: actions/upload-artifact@v4
+      with:
+        name: ${{ inputs.triplet }}
+        path: cross-build/${{ inputs.triplet }}/dist/*
+        if-no-files-found: error

.github/workflows/build.yml

@@ -178,8 +178,8 @@ jobs:
       free-threading: ${{ matrix.free-threading }}
 
   build-windows-msi:
-    name: >-  # ${{ '' } is a hack to nest jobs under the same sidebar category
-      Windows MSI${{ '' }}
+    # ${{ '' } is a hack to nest jobs under the same sidebar category.
+    name: Windows MSI${{ '' }}  # zizmor: ignore[obfuscation]
     needs: build-context
     if: fromJSON(needs.build-context.outputs.run-windows-msi)
     strategy:
@@ -397,6 +397,32 @@ jobs:
     - name: SSL tests
       run: ./python Lib/test/ssltests.py
 
+  build-android:
+    name: "Android"
+    needs: build-context
+    if: needs.build-context.outputs.run-tests == 'true'
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [aarch64, x86_64]
+        include:
+          # Use the same runs-on configuration as build-macos and build-ubuntu.
+          - arch: aarch64
+            runs-on: ${{ github.repository_owner == 'python' && 'ghcr.io/cirruslabs/macos-runner:sonoma' || 'macos-14' }}
+          - arch: x86_64
+            runs-on: ubuntu-24.04
+
+    runs-on: ${{ matrix.runs-on }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Build and test (Android)
+        uses: ./.github/actions/build-android
+        with:
+          triplet: ${{ matrix.arch }}-linux-android
+
   build-wasi:
     name: 'WASI'
     needs: build-context
@@ -586,8 +612,8 @@ jobs:
       run: xvfb-run make ci
 
   build-san:
-    name: >-  # ${{ '' } is a hack to nest jobs under the same sidebar category
-      Sanitizers${{ '' }}
+    # ${{ '' } is a hack to nest jobs under the same sidebar category.
+    name: Sanitizers${{ '' }}  # zizmor: ignore[obfuscation]
     needs: build-context
     if: needs.build-context.outputs.run-tests == 'true'
     strategy:
@@ -705,6 +731,7 @@ jobs:
     - build-ubuntu
     - build-ubuntu-ssltests-awslc
     - build-ubuntu-ssltests-openssl
+    - build-android
     - build-wasi
     - test-hypothesis
     - build-asan
@@ -740,6 +767,7 @@ jobs:
             build-ubuntu,
             build-ubuntu-ssltests-awslc,
             build-ubuntu-ssltests-openssl,
+            build-android,
             build-wasi,
             test-hypothesis,
             build-asan,

.pre-commit-config.yaml

@@ -72,7 +72,7 @@ repos:
       - id: actionlint
 
   - repo: https://github.com/woodruffw/zizmor-pre-commit
-    rev: v1.6.0
+    rev: v1.11.0
     hooks:
       - id: zizmor
 

Android/README.md

@@ -96,10 +96,13 @@ similar to the `Android` directory of the CPython source tree.
 
 ## Testing
 
-The Python test suite can be run on Linux, macOS, or Windows:
+The Python test suite can be run on Linux, macOS, or Windows.
 
-* On Linux, the emulator needs access to the KVM virtualization interface, and
-  a DISPLAY environment variable pointing at an X server. Xvfb is acceptable.
+On Linux, the emulator needs access to the KVM virtualization interface. This may
+require adding your user to a group, or [changing your udev
+rules](https://github.blog/changelog/2024-04-02-github-actions-hardware-accelerated-android-virtualization-now-available/).
+If the emulator fails to start, try running `$ANDROID_HOME/emulator/emulator
+-accel-check`.
 
 The test suite can usually be run on a device with 2 GB of RAM, but this is
 borderline, so you may need to increase it to 4 GB. As of Android

Android/android.py

@@ -247,7 +247,13 @@ def make_host_python(context):
     # flags to be duplicated. So we don't use the `host` argument here.
     os.chdir(host_dir)
     run(["make", "-j", str(os.cpu_count())])
-    run(["make", "install", f"prefix={prefix_dir}"])
+
+    # The `make install` output is very verbose and rarely useful, so
+    # suppress it by default.
+    run(
+        ["make", "install", f"prefix={prefix_dir}"],
+        capture_output=not context.verbose,
+    )
 
 
 def build_all(context):
@@ -671,6 +677,16 @@ def package(context):
                     else:
                         shutil.copy2(src, dst, follow_symlinks=False)
 
+        # Strip debug information.
+        if not context.debug:
+            run(
+                [
+                    android_env(context.host)["STRIP"],
+                    *glob(f"{temp_dir}/**/*.so", recursive=True),
+                ],
+                log=False,
+            )
+
         dist_dir = subdir(context.host, "dist", create=True)
         package_path = shutil.make_archive(
             f"{dist_dir}/python-{version}-{context.host}", "gztar", temp_dir
@@ -695,24 +711,31 @@ def parse_args():
     parser = argparse.ArgumentParser()
     subcommands = parser.add_subparsers(dest="subcommand", required=True)
 
+    def add_parser(*args, **kwargs):
+        parser = subcommands.add_parser(*args, **kwargs)
+        parser.add_argument(
+            "-v", "--verbose", action="count", default=0,
+            help="Show verbose output. Use twice to be even more verbose.")
+        return parser
+
     # Subcommands
-    build = subcommands.add_parser(
+    build = add_parser(
         "build", help="Run configure-build, make-build, configure-host and "
         "make-host")
-    configure_build = subcommands.add_parser(
+    configure_build = add_parser(
         "configure-build", help="Run `configure` for the build Python")
-    subcommands.add_parser(
+    add_parser(
         "make-build", help="Run `make` for the build Python")
-    configure_host = subcommands.add_parser(
+    configure_host = add_parser(
         "configure-host", help="Run `configure` for Android")
-    make_host = subcommands.add_parser(
+    make_host = add_parser(
         "make-host", help="Run `make` for Android")
 
-    subcommands.add_parser("clean", help="Delete all build directories")
-    subcommands.add_parser("build-testbed", help="Build the testbed app")
-    test = subcommands.add_parser("test", help="Run the testbed app")
-    package = subcommands.add_parser("package", help="Make a release package")
-    env = subcommands.add_parser("env", help="Print environment variables")
+    add_parser("clean", help="Delete all build directories")
+    add_parser("build-testbed", help="Build the testbed app")
+    test = add_parser("test", help="Run the testbed app")
+    package = add_parser("package", help="Make a release package")
+    env = add_parser("env", help="Print environment variables")
 
     # Common arguments
     for subcommand in build, configure_build, configure_host:
@@ -733,11 +756,6 @@ def parse_args():
                                 help="Extra arguments to pass to `configure`")
 
     # Test arguments
-    test.add_argument(
-        "-v", "--verbose", action="count", default=0,
-        help="Show Gradle output, and non-Python logcat messages. "
-        "Use twice to include high-volume messages which are rarely useful.")
-
     device_group = test.add_mutually_exclusive_group(required=True)
     device_group.add_argument(
         "--connected", metavar="SERIAL", help="Run on a connected device. "
@@ -765,6 +783,11 @@ def parse_args():
         "args", nargs="*", help=f"Arguments to add to sys.argv. "
         f"Separate them from {SCRIPT_NAME}'s own arguments with `--`.")
 
+    # Package arguments.
+    package.add_argument(
+        "-g", action="store_true", default=False, dest="debug",
+        help="Include debug information")
+
     return parser.parse_args()
 
 
@@ -803,6 +826,8 @@ def main():
 def print_called_process_error(e):
     for stream_name in ["stdout", "stderr"]:
         content = getattr(e, stream_name)
+        if isinstance(content, bytes):
+            content = content.decode(*DECODE_ARGS)
         stream = getattr(sys, stream_name)
         if content:
             stream.write(content)