Skip to content

ci(android): trust cached fixture APKs - #1479

Merged
thymikee merged 6 commits into
mainfrom
agent/android-trusted-fixture-cache
Jul 28, 2026
Merged

ci(android): trust cached fixture APKs#1479
thymikee merged 6 commits into
mainfrom
agent/android-trusted-fixture-cache

Conversation

@thymikee

Copy link
Copy Markdown
Member

Summary

  • Restore Android fixture APKs through the strict, platform-scoped trusted-artifact resolver; repack them while preserving package and signer identity, and expose exact APK/package outputs.
  • Build Android Release APKs with an emulator-free Gradle producer plus trusted-context Gradle caching; smoke CI installs and opens the APK via the public CLI.
  • Deny unsupported Android prepare and viewport capabilities, including advertised capability output and handler admission.

Scope: Android fixture-cache parity only. PR #1408 merged during implementation, so this PR targets main rather than the former stacked branch. No user-facing docs changed; this is CI-internal behavior documented next to the workflow/action contracts.

Validation

  • Fixture artifact tests, both-platform fallback smoke, and actionlint passed.
  • Focused capability/session tests passed; live Android public CLI install, open, snapshot, and close passed.
  • Fresh Expo prebuild plus Gradle Release assemble completed without an emulator in 8m10s and produced a Release APK.
  • Aggregate pnpm check reached the unit suite; two documented contention-prone router-open tests timed out under host load, then passed in isolation.

@github-actions

github-actions Bot commented Jul 28, 2026

Copy link
Copy Markdown

Size Report

Metric Base Current Diff
JS raw 1.87 MB 1.87 MB -45 B
JS gzip 602.0 kB 602.0 kB -40 B
npm tarball 719.9 kB 719.9 kB -5 B
npm unpacked 2.52 MB 2.52 MB -45 B

Startup median (7 runs, lower is better):

Scenario Base Current Diff
CLI --version 28.3 ms 27.3 ms -1.1 ms
CLI --help 57.3 ms 59.1 ms +1.8 ms

Top changed chunks:

Chunk Raw diff Gzip diff
dist/src/session.js -86 B -49 B
dist/src/sdk-batch-runner.js +41 B +9 B

Comment thread .github/workflows/android.yml Outdated
set -e
set -eu
fixture_session=fixture-cache
cleanup_fixture_session() {

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 — The exact-head Android Smoke job is deterministically broken at this line. reactivecircus/android-emulator-runner@v2.35.0 executes each script: line via a separate sh -c; run 30392465598 fails on cleanup_fixture_session() { with /usr/bin/sh: 1: Syntax error: end of file unexpected (expecting "}"), before install/open/snapshot runs. Keep every line self-contained (for example, a one-line EXIT trap) or move this sequence into a checked-in script, then rerun Android Smoke at the new exact head. The current run provides no live app evidence.

Comment thread .github/workflows/android.yml Outdated
trap cleanup_fixture_session EXIT
node --experimental-strip-types src/bin.ts install "${{ steps.fixture-app.outputs.apk-path }}" --platform android
node --experimental-strip-types src/bin.ts open "${{ steps.fixture-app.outputs.app-id }}" --platform android --session "$fixture_session" --relaunch
node --experimental-strip-types src/bin.ts snapshot -i --platform android --session "$fixture_session"

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 — After the script-splitting blocker is fixed, this command still does not establish the claimed Android smoke contract: its output is discarded and the step asserts only a zero exit code. The repository device-verification guidance requires snapshot -i --json evidence with androidSnapshot.backend == android-helper and helperVersion equal to the package version, plus an assertion that the intended fixture app/device state was observed. Add a machine-readable assertion here (or in the checked-in smoke script) and rerun it at the new exact head; the current run never reached this line.

@thymikee thymikee added the ready-for-human Valid work that needs human implementation, judgment, or maintainer merge label Jul 28, 2026
@thymikee

Copy link
Copy Markdown
Member Author

Re-review clean at 01340c1. The linewise emulator-script failure is fixed, and exact-head Android Smoke now proves the trusted cache-hit to repack/signature verification to source CLI install/open/snapshot/close path, plus replay and helper smoke. Static, coverage, typecheck, integration, and Fallow checks are green; iOS Smoke is still in progress. No remaining code findings. Residual risk: no separately authorized cross-vendor review.

@thymikee

Copy link
Copy Markdown
Member Author

Addressed both Android Smoke review findings in caa75ed. The emulator action now calls one checked-in fixture script, so its install/open/snapshot/close sequence is not split across reactivecircus script invocations. That script retains the JSON snapshot and asserts android-helper backend, helper version equal to package.json, and the Agent Device Tester fixture screen. Added regression coverage for the workflow contract and stale-helper rejection. Validation: pnpm format:check, pnpm typecheck, pnpm lint, node --test test/ci/trusted-fixture-artifact.test.mjs, actionlint, and fixture-cache fallback smoke.

@thymikee

thymikee commented Jul 28, 2026

Copy link
Copy Markdown
Member Author

Claude review triage (review completed against the PR diff):

  • Addressed in 1145696: composite pipefail handling for SDK licences; 600s bounded Android producer wait; cache source disclosure; explicit aapt prerequisite; nonempty smoke arguments and output wiring; script-root package lookup.
  • Addressed in 05a3a53: smoke now checks the public snapshot schema, Android helper/version, foreground appBundleId, and fixture label; the capability pin now explicitly preserves macOS/tvOS while denying Android for prepare and viewport.
  • The signer equality premise was verified in the local live Android path: the source and repacked APK certificates matched, followed by public CLI install/open/snapshot evidence.
  • Inline Android build remains the intentional trusted fallback; the 600s bound covers the measured cold producer path.
  • Viewport denial is deliberate scope requested for this PR: Android has no durable set/read/reset lifecycle. The shared handler admission gate replaces the former Android-only rejection, so the generic unsupported error is parity rather than a fallback workaround.

No unresolved actionable Claude findings remain.

@thymikee

Copy link
Copy Markdown
Member Author

Android Smoke diagnosis and fix: the cached APK restore, install, and open all succeeded on 05a3a53. The uploaded snapshot artifact showed the documented CLI response envelope: success=true with the snapshot under data, including appBundleId=com.callstack.agentdevicelab and Android helper metadata. Commit 70ae21f validates that exact envelope and then asserts the foreground package, helper/version, and fixture label. Focused fixture/cache/fallback/actionlint tests and Fallow are green; exact-head CI has restarted.

@thymikee

Copy link
Copy Markdown
Member Author

Re-review clean at 70ae21f. The new checked-in smoke assertion strengthens the evidence: exact-head Android Smoke proves trusted artifact restore, signed APK repack, explicit artifact source, source-CLI install/open, foreground fixture identity, package-version-matched Android helper snapshot, replay, and helper smoke. All completed gates are green; iOS Smoke remains in progress. No remaining code findings. Residual risk: no separately authorized cross-vendor review.

@thymikee
thymikee merged commit 6ab5963 into main Jul 28, 2026
30 checks passed
@thymikee
thymikee deleted the agent/android-trusted-fixture-cache branch July 28, 2026 20:51
@github-actions

Copy link
Copy Markdown
PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-07-28 20:51 UTC

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ready-for-human Valid work that needs human implementation, judgment, or maintainer merge

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant