ci: consolidate workflows and optimize build steps

- merge lint and detekt jobs into a single `build-and-check` job
- add desktop build and jvm tests to CI
- add a conditional `ios-check` job with caching for Kotlin/Native
- update release workflow to use properties files for signing and improve cleanup

Author: renaudmathieu

.github/workflows/pr.yml

@@ -14,7 +14,7 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  build:
+  build-and-check:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -27,10 +27,17 @@ jobs:
         uses: gradle/actions/setup-gradle@v4
         with:
           validate-wrappers: true
-      - name: Build
+          gradle-home-cache-cleanup: true
+      - name: Build Android
         run: ./gradlew assembleDebug :wearApp:assembleDebug
+      - name: Build Desktop
+        run: ./gradlew :desktopApp:jvmJar
       - name: Run tests
-        run: ./gradlew allTests
+        run: ./gradlew jvmTest
+      - name: Run Android Lint
+        run: ./gradlew :androidApp:lintDebug :wearApp:lintDebug
+      - name: Run Detekt
+        run: ./gradlew detekt
       - name: Upload debug APKs
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         uses: actions/upload-artifact@v4
@@ -40,22 +47,6 @@ jobs:
             androidApp/build/outputs/apk/debug/*.apk
             wearApp/build/outputs/apk/debug/*.apk
           retention-days: 14
-
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up JDK 21
-        uses: actions/setup-java@v4
-        with:
-          distribution: 'temurin'
-          java-version: '21'
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
-        with:
-          validate-wrappers: true
-      - name: Run Android Lint
-        run: ./gradlew :androidApp:lintDebug :wearApp:lintDebug
       - name: Upload lint reports
         if: always()
         uses: actions/upload-artifact@v4
@@ -64,24 +55,52 @@ jobs:
           path: |
             androidApp/build/reports/lint-results-debug.html
             wearApp/build/reports/lint-results-debug.html
+      - name: Upload SARIF to GitHub
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: build/reports/detekt/detekt.sarif
 
-  detekt:
-    runs-on: ubuntu-latest
+  ios-check:
+    runs-on: macos-latest
+    if: github.event_name == 'push' || github.event_name == 'pull_request'
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+      - name: Check for iOS-related changes
+        id: filter
+        run: |
+          if [ "${{ github.event_name }}" = "push" ]; then
+            CHANGED=$(git diff --name-only HEAD~1 HEAD)
+          else
+            git fetch origin ${{ github.base_ref }} --depth=1
+            CHANGED=$(git diff --name-only FETCH_HEAD HEAD)
+          fi
+          if echo "$CHANGED" | grep -qE '^(shared/|iosApp/|gradle/|build-logic/|.*\.gradle\.kts$|gradle\.properties$)'; then
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Set up JDK 21
+        if: steps.filter.outputs.should_run == 'true'
         uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: '21'
       - name: Setup Gradle
+        if: steps.filter.outputs.should_run == 'true'
         uses: gradle/actions/setup-gradle@v4
         with:
           validate-wrappers: true
-      - name: Run Detekt
-        run: ./gradlew detekt
-      - name: Upload SARIF to GitHub
-        if: always()
-        uses: github/codeql-action/upload-sarif@v3
+          gradle-home-cache-cleanup: true
+      - name: Cache Kotlin/Native compiler
+        if: steps.filter.outputs.should_run == 'true'
+        uses: actions/cache@v4
         with:
-          sarif_file: build/reports/detekt/detekt.sarif
+          path: ~/.konan
+          key: konan-${{ runner.os }}-${{ hashFiles('gradle/libs.versions.toml') }}
+          restore-keys: konan-${{ runner.os }}-
+      - name: Build iOS framework
+        if: steps.filter.outputs.should_run == 'true'
+        run: ./gradlew :shared:linkReleaseFrameworkIosSimulatorArm64

.github/workflows/release.yml

@@ -17,14 +17,18 @@ jobs:
         uses: gradle/actions/setup-gradle@v4
         with:
           validate-wrappers: true
+          gradle-home-cache-cleanup: true
       - name: Decode keystore
         env:
           KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
-        run: echo "$KEYSTORE_BASE64" | base64 --decode > keystore.jks
-      - name: Build release APKs
+        run: echo "$KEYSTORE_BASE64" | base64 --decode > androidApp/keystore.release
+      - name: Create keystore properties
         env:
           KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
           KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+        run: |
+          printf 'keyAlias=%s\nkeyAliasPassword=%s\n' "$KEY_ALIAS" "$KEY_PASSWORD" > androidApp/keystore.properties
+      - name: Build release APKs
         run: ./gradlew :androidApp:assembleRelease :wearApp:assembleRelease
       - name: Upload release APKs
         uses: actions/upload-artifact@v4
@@ -33,6 +37,6 @@ jobs:
           path: |
             androidApp/build/outputs/apk/release/*.apk
             wearApp/build/outputs/apk/release/*.apk
-      - name: Cleanup keystore
+      - name: Cleanup signing files
         if: always()
-        run: rm -f keystore.jks
+        run: rm -f androidApp/keystore.release androidApp/keystore.properties