More apksave

.github/actions/on_host_test/action.yaml

@@ -104,14 +104,14 @@ runs:
         tags="${tags},os:${{ inputs.os }}"
         echo $tags > ${TEST_RESULTS_DIR}/${{ matrix.platform }}/TAGS
     - name: Archive unit test results
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4
       if: (success() || failure()) && steps.run-tests.outputs.test_type == 'unit_tests'
       with:
         name: unit-test-results
         path: ${{env.TEST_RESULTS_DIR}}/
     - name: Archive coverage html report
       if: success() && matrix.shard == 'coverage'
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4
       with:
         name: coverage-report
         path: ${{env.COVERAGE_DIR}}/html

.github/workflows/android.yaml

@@ -1,6 +1,8 @@
 name: android
 
 on:
+  release:
+    types: [prereleased, released, published]
   pull_request:
     types: [opened, reopened, synchronize, labeled]
     branches:
@@ -30,6 +32,7 @@ jobs:
     with:
       platform: android-arm64
       nightly: ${{ github.event.inputs.nightly }}
+      keep_artifacts: cobalt.apk
   android-x86:
     uses: ./.github/workflows/main.yaml
     permissions:
@@ -38,6 +41,7 @@ jobs:
     with:
       platform: android-x86
       nightly: ${{ github.event.inputs.nightly }}
+      keep_artifacts: cobalt.apk
   android-arm:
     uses: ./.github/workflows/main.yaml
     permissions:
@@ -46,3 +50,55 @@ jobs:
     with:
       platform: android-arm
       nightly: ${{ github.event.inputs.nightly }}
+      keep_artifacts: cobalt.apk
+
+  final_android_job:
+    runs-on: ubuntu-latest
+    needs: [ android-arm, android-arm64, android-x86 ]
+    permissions:
+      actions: write
+    steps:
+      - name: Download the gold arm thing
+        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # v4.1.0
+        with:
+          name: android-arm-gold
+          path: arm-gold
+      - name: Download the qa arm thing
+        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # v4.1.0
+        with:
+          name: android-arm-qa
+          path: arm-qa
+      - name: Download the gold arm64 thing
+        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # v4.1.0
+        with:
+          name: android-arm64-gold
+          path: arm64-gold
+      - name: Download the qa arm64 thing
+        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # v4.1.0
+        with:
+          name: android-arm64-gold
+          path: arm64-qa
+      - name: Download the gold x86 thing
+        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # v4.1.0
+        with:
+          name: android-x86-gold
+          path: x86-gold
+      - name: Download the qa x86 thing
+        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # v4.1.0
+        with:
+          name: android-x86-gold
+          path: x86-qa
+      - name: 'Upload Android APKs'
+        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4
+        with:
+          name: Android APKs
+          path: ./*
+          retention-days: 90
+          compression-level: 0 # We expect kept artifacts to be already compressed
+          if-no-files-found: error
+      - name: 'Delete intermediates'
+        uses: geekyeggo/delete-artifact@9d15d164b1dcd538ff1b1a2984bc2c0240986c3b # v4.0.0
+        with:
+          token: ${{ github.token }}
+          name: android-arm-qa
+          failOnError: true

.github/workflows/main.yaml

@@ -29,6 +29,15 @@ on:
         required: false
         type: boolean
         default: false
+      keep_artifacts:
+        description: 'Which artifacts to keep for releases'
+        required: false
+        type: string
+        default: ''
+    outputs:
+      first_output:
+        description: "My random output"
+        value: ${{ jobs.build.outputs.output1 }}
 
 # Global env vars.
 env:
@@ -218,13 +227,15 @@ jobs:
       matrix:
         platform: ${{ fromJson(needs.initialize.outputs.platforms) }}
         include: ${{ fromJson(needs.initialize.outputs.includes) }}
-        config: [devel, debug, qa, gold]
+        config: [qa, gold]
     container: ${{ needs.docker-build-image.outputs.docker_tag }}
     env:
       # We want temp folder to be on tmpfs which makes workloads faster.
       # However, dind container ends up having / folder mounted on overlay
       # filesystem, whereas /__w which contains Cobalt source code is on tmpfs.
       TMPDIR: /__w/_temp
+    outputs:
+      output1: ${{ steps.output_step_1.outputs.firstword }}
     steps:
       - name: Checkout
         uses: kaidokert/[email protected]
@@ -237,6 +248,23 @@ jobs:
         uses: ./.github/actions/gn
       - name: Build Cobalt
         uses: ./.github/actions/build
+      - id: output_step_1
+        name: Set output
+        run: |
+          echo "The artifacts we need to keep:" ${{ inputs.keep_artifacts }}
+          echo "Full spec" out/${{ matrix.platform}}-${{ matrix.config }}/${{ inputs.keep_artifacts }}
+          find . -name "*.apk"
+          ls -la out/${{ matrix.platform}}_${{ matrix.config }}/${{ inputs.keep_artifacts }}
+          echo "firstword=hello"  >> $GITHUB_OUTPUT
+      - name: 'Upload Artifact'
+        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4
+        if: inputs.keep_artifacts
+        with:
+          name: ${{ matrix.platform }}-${{ matrix.config }}
+          path: out/${{ matrix.platform }}_${{ matrix.config }}/${{ inputs.keep_artifacts }}
+          retention-days: 7
+          compression-level: 0 # We expect kept artifacts to be already compressed
+          if-no-files-found: error
       - name: Run API Leak Detector
         uses: ./.github/actions/api_leak_detector
         if: inputs.run_api_leak_detector

.github/workflows/scorecards.yml

@@ -45,7 +45,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v3.1.1
+        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4
         with:
           name: SARIF file
           path: results.sarif