npm_release.yml

name: NPM Release
on:
  push:
    branches:
      - main
    tags:
      - "v*"

env:
  NPM_TAG: "next"
  EMULATOR_NAME: "runtime-emu"
  NDK_VERSION: r27d
  ANDROID_API: 33
  ANDROID_ABI: x86_64
  NDK_ARCH: darwin

permissions:
  contents: read

jobs:
  build:
    name: Build
    runs-on: macos-15
    outputs:
      npm_version: ${{ steps.npm_version_output.outputs.NPM_VERSION }}
      npm_tag: ${{ steps.npm_version_output.outputs.NPM_TAG }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
          submodules: true
      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          node-version: 22
          registry-url: "https://registry.npmjs.org"
      - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
        with:
          distribution: "temurin"
          java-version: "21"
          cache: gradle
      - name: Setup Android SDK
        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2
      - name: Homebrew dependencies
        run: |
          brew install wget
      - name: Setup NDK
        run: |
          echo "y" | sdkmanager "cmake;3.6.4111459"
          wget -q https://dl.google.com/android/repository/android-ndk-$NDK_VERSION-$NDK_ARCH.zip
          chmod +x android-ndk-$NDK_VERSION-$NDK_ARCH.zip
          unzip -q android-ndk-$NDK_VERSION-$NDK_ARCH.zip
          rm -rf android-ndk-$NDK_VERSION-$NDK_ARCH.zip
          export ANDROID_NDK_HOME=`pwd`/android-ndk-$NDK_VERSION
          echo ANDROID_NDK_HOME=${ANDROID_NDK_HOME} >> $GITHUB_ENV
          echo ANDROID_NDK=${ANDROID_NDK_HOME} >> $GITHUB_ENV
          echo ${ANDROID_NDK_HOME} >> $GITHUB_PATH
      - name: Install Dependencies
        run: |
          npm install
          npm install --prefix ./test-app/tools
      - name: Get Current Version
        run: |
          NPM_VERSION=$(node -e "console.log(require('./package.json').version);")
          echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV
      - name: Bump version for dev release
        if: ${{ !contains(github.ref, 'refs/tags/') }}
        run: |
          NPM_VERSION=$(node ./scripts/get-next-version.js)
          echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV
          npm version $NPM_VERSION --no-git-tag-version
      - name: Output NPM Version and tag
        id: npm_version_output
        run: |
          NPM_TAG=$(node ./scripts/get-npm-tag.js)
          echo NPM_VERSION=$NPM_VERSION >> $GITHUB_OUTPUT
          echo NPM_TAG=$NPM_TAG >> $GITHUB_OUTPUT
      - name: Build npm package
        run: ./gradlew -PgitCommitVersion=${{ github.sha }} -PnoCCache --stacktrace
      - name: Upload npm package artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: npm-package
          path: dist/nativescript-android-${{steps.npm_version_output.outputs.NPM_VERSION}}.tgz
      - name: Upload debug symbols
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: debug-symbols
          path: test-app/runtime/build/intermediates/merged_native_libs/release/mergeReleaseNativeLibs/out/lib/*

  test:
    name: Test
    runs-on: macos-15-intel
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          submodules: true
      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          node-version: 22
          registry-url: "https://registry.npmjs.org"
      - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
        with:
          distribution: "temurin"
          java-version: "21"
          cache: gradle
      - name: Setup Android SDK
        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2
      - name: Homebrew dependencies
        run: |
          brew install wget
      - name: Setup NDK
        run: |
          echo "y" | sdkmanager "cmake;3.6.4111459"
          wget -q https://dl.google.com/android/repository/android-ndk-$NDK_VERSION-$NDK_ARCH.zip
          chmod +x android-ndk-$NDK_VERSION-$NDK_ARCH.zip
          unzip -q android-ndk-$NDK_VERSION-$NDK_ARCH.zip
          rm -rf android-ndk-$NDK_VERSION-$NDK_ARCH.zip
          export ANDROID_NDK_HOME=`pwd`/android-ndk-$NDK_VERSION
          echo ANDROID_NDK_HOME=${ANDROID_NDK_HOME} >> $GITHUB_ENV
          echo ANDROID_NDK=${ANDROID_NDK_HOME} >> $GITHUB_ENV
          echo ${ANDROID_NDK_HOME} >> $GITHUB_PATH
      - name: Install Dependencies
        run: |
          npm install
          npm install --prefix ./test-app/tools
      - name: SBG tests
        run: ./gradlew runSbgTests --stacktrace
      - name: Run unit tests
        uses: ReactiveCircus/android-emulator-runner@b530d96654c385303d652368551fb075bc2f0b6b # v2.35.0
        with:
          api-level: ${{env.ANDROID_API}}
          # this is needed on API 30+
          #target: google_apis
          arch: ${{env.ANDROID_ABI}}
          script: ./gradlew runtestsAndVerifyResults --stacktrace
      - name: Upload Test Results
        if: ${{ !cancelled() }} # run this step even if previous step failed
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: android-unit-test-results
          path: test-app/dist/android_unit_test_results.xml
  publish:
    runs-on: ubuntu-latest
    environment: npm-publish
    needs:
      - build
      - test
    permissions:
      contents: read
      id-token: write
    env:
      NPM_VERSION: ${{needs.build.outputs.npm_version}}
      NPM_TAG: ${{needs.build.outputs.npm_tag}}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          node-version: 22
          registry-url: "https://registry.npmjs.org"
      - uses: actions/download-artifact@v6
        with:
          name: npm-package
          path: dist
      - name: Update npm (required for OIDC trusted publishing)
        run: |
          npm install -g npm@^11.5.1
          npm --version
      - name: Publish package (OIDC trusted publishing)
        if: ${{ vars.USE_NPM_TOKEN != 'true' }}
        run: |
          echo "Publishing @nativescript/android@$NPM_VERSION to NPM with tag $NPM_TAG via OIDC trusted publishing..."
          unset NODE_AUTH_TOKEN
          if [ -n "${NPM_CONFIG_USERCONFIG:-}" ]; then
            rm -f "$NPM_CONFIG_USERCONFIG"
          fi
          npm publish ./dist/nativescript-android-${{env.NPM_VERSION}}.tgz --tag $NPM_TAG --access public --provenance
        env:
          NODE_AUTH_TOKEN: ""

      - name: Publish package (granular token)
        if: ${{ vars.USE_NPM_TOKEN == 'true' }}
        run: |
          echo "Publishing @nativescript/android@$NPM_VERSION to NPM with tag $NPM_TAG via granular token..."
          npm publish ./dist/nativescript-android-${{env.NPM_VERSION}}.tgz --tag $NPM_TAG --access public --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
  github-release:
    runs-on: ubuntu-latest
    # only runs on tagged commits
    if: ${{ contains(github.ref, 'refs/tags/') }}
    permissions:
      contents: write
    needs:
      - build
      - test
    env:
      NPM_VERSION: ${{needs.build.outputs.npm_version}}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
        with:
          node-version: 22
      - name: Setup
        run: npm install
      - uses: actions/download-artifact@v6
        with:
          name: npm-package
          path: dist
      - uses: actions/download-artifact@v6
        with:
          name: debug-symbols
          path: dist/debug-symbols
      - name: Zip debug symbols
        working-directory: dist/debug-symbols
        run: zip -r debug-symbols.zip .
      - name: Partial Changelog
        run: npx conventional-changelog -p angular -r2 > body.md
      - uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
        with:
          artifacts: "dist/nativescript-android-*.tgz,dist/debug-symbols/debug-symbols.zip"
          bodyFile: "body.md"
          prerelease: ${{needs.build.outputs.npm_tag != 'latest'}}