Merge open PRs #27–#41 with review follow-ups

.editorconfig

@@ -0,0 +1,25 @@
+# Shared formatting rules, used by ktlint (through Spotless) and by editors.
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 4
+trim_trailing_whitespace = true
+
+[*.{kt,kts}]
+ktlint_code_style = android_studio
+# Existing Sidekit code does not enforce a wrap column; keep it that way.
+max_line_length = off
+# Sidekit imports MMS and WorkManager types wholesale in a few adapters.
+ktlint_standard_no-wildcard-imports = disabled
+# Screens are composables with PascalCase names, which is the Compose convention.
+ktlint_function_naming_ignore_when_annotated_with = Composable
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false

.github/actions/android-setup/action.yml

@@ -0,0 +1,21 @@
+name: Android build setup
+description: Install the JDK, Android SDK platform and Gradle caching used by every CI job.
+
+runs:
+  using: composite
+  steps:
+    - name: Set up JDK 21
+      uses: actions/setup-java@v4
+      with:
+        distribution: temurin
+        java-version: "21"
+
+    - name: Set up Android SDK
+      uses: android-actions/setup-android@v3
+      with:
+        # setup-android splits this on spaces, so a YAML block scalar arrives as one package name
+        # containing newlines and sdkmanager fails with "Failed to find package".
+        packages: platform-tools platforms;android-37.0 build-tools;37.0.0
+
+    - name: Set up Gradle
+      uses: gradle/actions/setup-gradle@v4

.github/workflows/ci.yml

@@ -0,0 +1,140 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  # Only supersede PR runs; every push to main keeps its own status.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  wrapper-validation:
+    name: Gradle wrapper validation
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: gradle/actions/wrapper-validation@v4
+
+  build:
+    name: Build (debug + R8 release)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      # versionName/versionCode come from `git describe` and the commit count, so a shallow
+      # clone would build a release that claims versionCode 1.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/android-setup
+      - name: Assemble debug and release
+        run: >
+          ./gradlew :app:assembleDebug :app:assembleRelease :sidekit:assembleDebug
+          --stacktrace
+
+  unit-tests:
+    name: Unit tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/android-setup
+      # Robolectric downloads its Android runtime jars outside Gradle's cache.
+      - uses: actions/cache@v4
+        with:
+          path: ~/.m2/repository
+          key: robolectric-${{ runner.os }}-${{ hashFiles('gradle/libs.versions.toml') }}
+          restore-keys: robolectric-${{ runner.os }}-
+      - name: Run JVM and Robolectric tests
+        run: ./gradlew testDebugUnitTest --stacktrace
+      - name: Upload test reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: unit-test-reports
+          path: |
+            **/build/reports/tests/testDebugUnitTest
+            **/build/test-results/testDebugUnitTest
+          retention-days: 7
+          if-no-files-found: ignore
+
+  android-lint:
+    name: Android Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/android-setup
+      - name: Run lint
+        run: ./gradlew lintDebug --stacktrace
+      - name: Upload lint reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: android-lint-reports
+          path: |
+            **/build/reports/lint-results-debug.html
+            **/build/reports/lint-results-debug.txt
+            **/build/reports/lint-results-debug.xml
+          retention-days: 7
+          if-no-files-found: ignore
+      - name: Upload lint results to code scanning
+        if: always()
+        continue-on-error: true
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: app/build/reports/lint-results-debug.sarif
+          category: android-lint
+
+  kotlin-format:
+    name: Kotlin formatting
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      # Spotless ratchets against origin/main, so it needs the base ref.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/android-setup
+      - name: Check ktlint formatting of changed files
+        run: ./gradlew spotlessCheck --stacktrace
+
+  secrets:
+    name: Secret scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  dependency-review:
+    name: Dependency review
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: on-failure

.github/workflows/codeql.yml

@@ -0,0 +1,40 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+  packages: read
+  actions: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze Kotlin and Java
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/android-setup
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: java-kotlin
+          build-mode: manual
+      - name: Build for analysis
+        run: ./gradlew :app:assembleDebug :sidekit:assembleDebug --stacktrace
+      - name: Analyze
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:java-kotlin"

.github/workflows/dependency-graph.yml

@@ -0,0 +1,24 @@
+name: Dependency graph
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: dependency-graph-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  submit:
+    name: Submit Gradle dependencies
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/android-setup
+      # Populates GitHub's dependency graph, which the PR dependency-review job reads.
+      - uses: gradle/actions/dependency-submission@v4

app/build.gradle.kts

@@ -3,6 +3,39 @@ plugins {
     alias(libs.plugins.kotlin.compose)
 }
 
+// Version metadata is read from git instead of being hand-edited here, so a build always reports
+// the code it was made from: a tagged commit is exactly "1.2.3", anything after it is
+// "1.2.3-3-g<sha>", and uncommitted changes add "-dirty". `versionCode` counts commits, so it only
+// ever grows and a newer build always installs over an older one — including over the 1.2.3 stable
+// build, which was bumped by hand to 6. A checkout without git (exported source, a CI tarball)
+// falls back to the last release; pass -PsidekitVersionName=… / -PsidekitVersionCode=… to override.
+val fallbackVersionName = "1.2.3"
+val fallbackVersionCode = 6
+
+fun git(vararg args: String) = providers.exec {
+    commandLine("git", *args)
+    workingDir = rootDir
+    isIgnoreExitValue = true
+}.standardOutput.asText.map(String::trim)
+
+// `--always` prints the bare sha when no release tag is reachable (a shallow clone, say), so such a
+// build reads "0.0.0-g<sha>" rather than passing itself off as the last release.
+val gitVersionName = git("describe", "--tags", "--match", "v[0-9]*", "--dirty", "--always")
+    .map { described ->
+        val name = described.removePrefix("v")
+        when {
+            name.isEmpty() -> fallbackVersionName
+            name.first().isDigit() -> name
+            else -> "0.0.0-g$name"
+        }
+    }
+val gitVersionCode = git("rev-list", "--count", "HEAD")
+    .map { it.toIntOrNull() ?: fallbackVersionCode }
+
+// A machine without a `git` binary makes the exec itself throw, rather than exit non-zero.
+fun versionCodeFromGit() = runCatching { gitVersionCode.get() }.getOrDefault(fallbackVersionCode)
+fun versionNameFromGit() = runCatching { gitVersionName.get() }.getOrDefault(fallbackVersionName)
+
 android {
     namespace = "hrln.interactive.sidekit"
     compileSdk {
@@ -13,8 +46,11 @@ android {
         applicationId = "hrln.interactive.sidekit"
         minSdk = 31
         targetSdk = 36
-        versionCode = 2
-        versionName = "1.1"
+        versionCode = providers.gradleProperty("sidekitVersionCode")
+            .map(String::toInt)
+            .getOrElse(versionCodeFromGit())
+        versionName = providers.gradleProperty("sidekitVersionName")
+            .getOrElse(versionNameFromGit())
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }
@@ -40,9 +76,11 @@ android {
         // Development build that installs alongside the stable SideKit as a separate app
         // (`hrln.interactive.sidekit.dev`), so the stable one can remain the daily driver while
         // this tracks the current branch/tip for testing. See app/src/dev/res for its distinct
-        // name. It derives from `profile` (R8 + debug signing, no debug Compose checks, baseline
+        // name, and for the DEV pill and About row that mark its UI (values/build.xml). It derives from `profile` (R8 + debug signing, no debug Compose checks, baseline
         // profile) so the on-device testing build doesn't stutter like a raw debug build — it
         // also falls back to `.sidekit` release. Use `debug` for breakpoint debugging instead.
+        // The version comes from git describe, so a dev build names the branch tip it was built
+        // from (e.g. 1.2.3-1-g91da863-dev) rather than a stale hand-written number.
         create("dev") {
             initWith(getByName("profile"))
             applicationIdSuffix = ".dev"

app/src/dev/res/values/build.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    Dev build only. `hrln.interactive.sidekit.dev` installs alongside the stable Sidekit, and
+    these overrides are what stops the two being confused on the device: the launcher header
+    carries a DEV pill and Settings → About names the build.
+-->
+<resources>
+    <string name="build_label" translatable="false">DEV</string>
+    <bool name="is_dev_build">true</bool>
+</resources>

app/src/dev/res/values/strings.xml

@@ -2,7 +2,9 @@
 <!--
     Overrides applied only to the `dev` build type (installs as a separate app,
     hrln.interactive.sidekit.dev, so it can run alongside the stable SideKit).
-    Only app_name is overridden; every other string is inherited from src/main.
+    Only app_name is overridden here; every other string is inherited from src/main. The rest of
+    what marks the UI as dev (the header pill, the About row) lives in
+    app/src/dev/res/values/build.xml.
 -->
 <resources>
     <string name="app_name">SideKit Dev</string>

app/src/main/AndroidManifest.xml

@@ -80,7 +80,7 @@
         android:theme="@style/Theme.Sidekit">
 
         <!--
-            configChanges: SideKit draws a fixed 480 x 640 canvas, so no configuration change
+            configChanges: SideKit draws its own 480-wide canvas, so no configuration change
             needs new resources. Handling them in place avoids tearing down and rebuilding the
             whole Compose tree (hundreds of ms on the MT8766) when e.g. a keyboard is attached,
             the font scale or dark mode changes.