android/.github/workflows/build-testharness.yml

name: Build Test Harness

on:
  push:
    paths:
      - testharness/**
    branches:
      - main
      - release/**/*
  workflow_dispatch:
    inputs:
      version-name:
        description: "Optional. Version string to use, in X.Y.Z format. Overrides default in the project."
        required: false
        type: string
      version-code:
        description: "Optional. Build number to use. Overrides default of GitHub run number."
        required: false
        type: number
      patch_version:
        description: "Order 999 - Overrides Patch version"
        type: boolean
      distribute-to-firebase:
        description: "Optional. Distribute artifacts to Firebase."
        required: false
        default: true
        type: boolean

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  GITHUB_ACTION_RUN_URL: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
  DISTRIBUTE_TO_FIREBASE: ${{ inputs.distribute-to-firebase || github.event_name == 'push' }}

permissions:
  contents: read
  packages: read

jobs:
  version:
    name: Calculate Version Name and Number
    uses: bitwarden/android/.github/workflows/_version.yml@main
    with:
      app_codename: "bwpm"
      base_version_number: 0
      version_name: ${{ inputs.version-name }}
      version_number: ${{ inputs.version-code }}
      patch_version: ${{ inputs.patch_version && '999' || '' }}

  build:
    name: Build Test Harness
    runs-on: ubuntu-24.04
    needs: version
    permissions:
      id-token: write

    steps:
      - name: Log inputs to job summary
        uses: bitwarden/android/.github/actions/log-inputs@main
        with:
          inputs: "${{ toJson(inputs) }}"

      - name: Check out repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Log in to Azure
        uses: bitwarden/gh-actions/azure-login@main
        with:
          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
          client_id: ${{ secrets.AZURE_CLIENT_ID }}

      - name: Get Azure Key Vault secrets
        id: get-kv-secrets
        uses: bitwarden/gh-actions/get-keyvault-secrets@main
        with:
          keyvault: gh-android
          secrets: "TESTHARNESS-KEYSTORE-STORE-PASSWORD,TESTHARNESS-KEYSTORE-KEY-PASSWORD"

      - name: Retrieve keystore
        env:
          ACCOUNT_NAME: bitwardenci
          CONTAINER_NAME: mobile
        run: |
          mkdir -p ${{ github.workspace }}/keystores

          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
          --name testharness_apk-keystore.jks --file ${{ github.workspace }}/keystores/testharness_apk-keystore.jks --output none

      - name: Download Firebase credentials
        if: ${{ env.DISTRIBUTE_TO_FIREBASE == 'true' }}
        env:
          ACCOUNT_NAME: bitwardenci
          CONTAINER_NAME: mobile
        run: |
          mkdir -p ${{ github.workspace }}/secrets

          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
          --name app_play_dev_firebase-creds.json --file ${{ github.workspace }}/secrets/app_play_dev_firebase-creds.json --output none

      - name: AZ Logout
        uses: bitwarden/gh-actions/azure-logout@main

      - name: Setup Android Build
        uses: ./.github/actions/setup-android-build

      - name: Increment version
        env:
          VERSION_CODE: ${{ needs.version.outputs.version_number || github.run_number }}
          VERSION_NAME: ${{ needs.version.outputs.version_name }}
        run: ./.github/scripts/set-build-version.sh "$VERSION_CODE" "$VERSION_NAME"

      - name: Build and sign Test Harness Release APK
        env:
          STORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.TESTHARNESS-KEYSTORE-STORE-PASSWORD }}
          KEY_PASSWORD: ${{ steps.get-kv-secrets.outputs.TESTHARNESS-KEYSTORE-KEY-PASSWORD }}
        run: |
          bundle exec fastlane buildTestHarnessRelease \
          storeFile:"${{ github.workspace }}/keystores/testharness_apk-keystore.jks" \
          storePassword:"$STORE_PASSWORD" \
          keyAlias:"bitwardentestharness" \
          keyPassword:"$KEY_PASSWORD"

      - name: Upload Test Harness Release APK
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: com.bitwarden.testharness.apk
          path: testharness/build/outputs/apk/release/com.bitwarden.testharness.apk
          if-no-files-found: error

      - name: Create checksum for Test Harness Release APK
        run: |
          sha256sum "testharness/build/outputs/apk/release/com.bitwarden.testharness.apk" \
            > ./com.bitwarden.testharness.apk-sha256.txt

      - name: Upload Test Harness Release SHA file
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: com.bitwarden.testharness.apk-sha256.txt
          path: ./com.bitwarden.testharness.apk-sha256.txt
          if-no-files-found: error

      - name: Install Firebase app distribution plugin
        if: ${{ env.DISTRIBUTE_TO_FIREBASE == 'true' }}
        run: bundle exec fastlane add_plugin firebase_app_distribution

      - name: Distribute to Firebase - testharness.apk
        if: ${{ env.DISTRIBUTE_TO_FIREBASE == 'true' }}
        env:
          APP_PLAY_FIREBASE_CREDS_PATH: ${{ github.workspace }}/secrets/app_play_dev_firebase-creds.json
        run: |
          bundle exec fastlane distributeTestHarnessReleaseToFirebase \
          actionUrl:$GITHUB_ACTION_RUN_URL \
          service_credentials_file:$APP_PLAY_FIREBASE_CREDS_PATH