zapstore/.github/workflows/repro.yml

name: Reproducible APK Proof

on:
  # push:
  #   branches:
  #     - reproducible-build
  workflow_dispatch:

jobs:
  repro:
    runs-on: ubuntu-22.04
    timeout-minutes: 90
    permissions:
      contents: read

    steps:
      - name: Free disk space (Docker/Android toolchain is large)
        run: |
          df -h
          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android  /usr/local/share/boost || true
          sudo apt-get clean || true
          docker system prune -af || true
          df -h

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Show runner info
        run: |
          uname -a
          lscpu | sed -n '1,30p'
          docker version
          docker info | sed -n '1,80p'

      - name: Make scripts executable
        run: |
          chmod +x repro/prove_repro.sh || true
          chmod +x repro/build_in_container.sh || true

      - name: Set cache dirs (host paths)
        run: |
          echo "GRADLE_USER_HOME=${{ runner.temp }}/gradle" >> $GITHUB_ENV
          echo "PUB_CACHE=${{ runner.temp }}/pub-cache" >> $GITHUB_ENV
          mkdir -p "${{ runner.temp }}/gradle" "${{ runner.temp }}/pub-cache"
          # The Docker image runs as a non-root "builder" user (uid != runner uid).
          # Make the bind-mounted caches writable inside the container.
          chmod -R a+rwx "${{ runner.temp }}/gradle" "${{ runner.temp }}/pub-cache" || true

      - name: Cache Gradle
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/gradle
          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}

      - name: Cache Pub
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/pub-cache
          key: pub-${{ runner.os }}-${{ hashFiles('pubspec.lock') }}

      - name: Run reproducibility proof (Docker)
        run: |
          bash repro/prove_repro.sh

      - name: Install diff tools
        if: failure()
        run: |
          sudo apt-get update
          sudo apt-get install -y diffoscope unzip

      - name: Diff APKs (if present)
        if: failure()
        run: |
          ls -la .repro_out || true
          A="$(ls -1 .repro_out/*-A-release.apk 2>/dev/null | head -n1 || true)"
          B="$(ls -1 .repro_out/*-B-release.apk 2>/dev/null | head -n1 || true)"
          echo "A=$A"
          echo "B=$B"
          if [ -n "$A" ] && [ -n "$B" ]; then
            diffoscope "$A" "$B" --text .repro_out/diffoscope.txt || true
            mkdir -p /tmp/apkA /tmp/apkB
            unzip -q "$A" -d /tmp/apkA
            unzip -q "$B" -d /tmp/apkB
            diff -qr /tmp/apkA /tmp/apkB | head -n 200 > .repro_out/unzip-diff.txt || true
          fi

      - name: Upload artifacts (.repro_out)
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: repro-out-${{ github.sha }}
          path: .repro_out
          if-no-files-found: warn
          include-hidden-files: true