vpnhide/.github/workflows/ci.yml

name: CI

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
  workflow_dispatch:

permissions:
  contents: write
  packages: read

jobs:
  lint-rust:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/${{ github.repository }}/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - name: Mark workspace safe
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - name: rustfmt
        run: |
          cd zygisk && cargo fmt --check
          cd ../test-app/native && cargo fmt --check
      - name: clippy (zygisk)
        run: cd zygisk && cargo ndk -t arm64-v8a clippy -- -D warnings
      - name: clippy (test-app)
        run: cd test-app/native && cargo ndk -t arm64-v8a clippy -- -D warnings

  kmod:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        kmi:
          - android12-5.10
          - android13-5.10
          - android13-5.15
          - android14-5.15
          - android14-6.1
          - android15-6.6
          - android16-6.12
    container:
      image: ghcr.io/ylarod/ddk-min:${{ matrix.kmi }}-20260313
    env:
      KDIR: /opt/ddk/kdir/${{ matrix.kmi }}

    steps:
      - uses: actions/checkout@v4

      - name: Build kernel module
        run: |
          CLANG=$(echo /opt/ddk/clang/clang-r*/bin)
          make -C $KDIR M=$GITHUB_WORKSPACE/kmod \
              ARCH=arm64 LLVM=1 LLVM_IAS=1 \
              CC=$CLANG/clang LD=$CLANG/ld.lld \
              AR=$CLANG/llvm-ar NM=$CLANG/llvm-nm \
              OBJCOPY=$CLANG/llvm-objcopy \
              OBJDUMP=$CLANG/llvm-objdump \
              STRIP=$CLANG/llvm-strip \
              CROSS_COMPILE=aarch64-linux-gnu- \
              modules
          $CLANG/llvm-strip -d kmod/vpnhide_kmod.ko

      - name: Package KSU module zip
        run: |
          cp kmod/vpnhide_kmod.ko kmod/module/
          apt-get update -qq && apt-get install -y -qq zip >/dev/null
          (cd kmod/module && zip -qr "$GITHUB_WORKSPACE/vpnhide-kmod-${{ matrix.kmi }}.zip" .)

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: vpnhide-kmod-${{ matrix.kmi }}
          path: vpnhide-kmod-${{ matrix.kmi }}.zip
          if-no-files-found: error

  zygisk:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/${{ github.repository }}/ci:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Mark workspace safe
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            /usr/local/cargo/registry
            /usr/local/cargo/git
            zygisk/target
          key: cargo-${{ runner.os }}-${{ hashFiles('zygisk/Cargo.lock') }}
          restore-keys: cargo-${{ runner.os }}-

      - name: Build module zip
        run: cd zygisk && ./build-zip.sh

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: vpnhide-zygisk
          path: zygisk/target/vpnhide-zygisk.zip
          if-no-files-found: error

  lsposed:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Build APK
        run: |
          cd lsposed && ./gradlew --no-daemon assembleDebug
          cp app/build/outputs/apk/debug/app-debug.apk "$GITHUB_WORKSPACE/vpnhide-lsposed.apk"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: vpnhide-lsposed
          path: vpnhide-lsposed.apk
          if-no-files-found: error

  test-app:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Install Rust + cargo-ndk
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
          . "$HOME/.cargo/env"
          rustup target add aarch64-linux-android
          cargo install cargo-ndk --locked

      - name: Set up Android NDK
        uses: nttld/setup-ndk@v1
        id: ndk
        with:
          ndk-version: r28b

      - name: Build APK
        run: |
          . "$HOME/.cargo/env"
          export ANDROID_NDK_HOME=${{ steps.ndk.outputs.ndk-path }}
          cd test-app && ./gradlew --no-daemon assembleDebug
          cp app/build/outputs/apk/debug/app-debug.apk "$GITHUB_WORKSPACE/vpnhide-test.apk"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: vpnhide-test
          path: vpnhide-test.apk
          if-no-files-found: error

  release:
    needs: [kmod, zygisk, lsposed, test-app]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist/
          merge-multiple: true

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          generate_release_notes: true
          files: |
            dist/*.zip
            dist/*.apk
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}