build-native-android.yml

name: Build locked OpenCode v2 for native Android

on:
  workflow_dispatch:
    inputs:
      strategy:
        description: Build strategy for the unsigned candidate
        type: choice
        required: true
        default: source-bun144-sourcegraph
        options:
          - source-bun140
          - source-bun144-sourcegraph
          - minimal-bun144-transplant

permissions:
  contents: read

env:
  OPENCODE_VERSION: "2.2.5"
  TERMUX_RELEASE_TAG: "v2.2.5-bun144.1"
  OPENTUI_VERSION: "0.8.0"
  OPENTUI_COMMIT: "738067f47e940dcec3f5aab74868908574335c6c"
  OPENTUI_PATCH_VERSION: "0.8.0"
  ZIG_VERSION: "0.16.0"
  ANDROID_API: "28"

jobs:
  build-candidate:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: Fetch workflow commit without broken submodules
        run: |
          set -euo pipefail
          git init .
          git remote add origin "https://github.com/$GITHUB_REPOSITORY.git"
          git fetch --depth=1 origin "$GITHUB_SHA"
          git checkout --detach FETCH_HEAD
          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"

      - name: Verify release pins
        run: python3 tools/check-release-pins.py

      - name: Fetch pinned OpenTUI source
        run: |
          set -euo pipefail
          mkdir -p work/opentui
          git -C work/opentui init .
          git -C work/opentui remote add origin https://github.com/anomalyco/opentui.git
          git -C work/opentui fetch --depth=1 origin "$OPENTUI_COMMIT"
          git -C work/opentui checkout --detach FETCH_HEAD

      - name: Install hash-verified Zig
        run: |
          set -euo pipefail
          URL="https://ziglang.org/download/$ZIG_VERSION/zig-x86_64-linux-$ZIG_VERSION.tar.xz"
          SHA="$(python3 -c 'import json,os; print(json.load(open("tools/supply-chain-lock.json"))["opentui"][os.environ["OPENTUI_VERSION"]]["zig_x86_64_linux_sha256"])')"
          mkdir -p work
          curl -fsSLo work/zig.tar.xz "$URL"
          echo "$SHA  work/zig.tar.xz" | sha256sum -c -
          tar -xJf work/zig.tar.xz -C work
          echo "$GITHUB_WORKSPACE/work/zig-x86_64-linux-$ZIG_VERSION" >> "$GITHUB_PATH"

      - name: Verify locked metadata
        run: |
          set -euo pipefail
          python3 - <<'PY'
          import json
          import os
          import subprocess

          lock = json.load(open("tools/supply-chain-lock.json", encoding="utf-8"))
          bind = json.load(open("tools/transplant/config/bun-bind.json", encoding="utf-8"))
          oc = lock["opencode"][os.environ["OPENCODE_VERSION"]]
          ot = lock["opentui"][os.environ["OPENTUI_VERSION"]]
          strategy = os.environ["BUILD_STRATEGY"]
          bun_version = (
              "1.4.0"
              if strategy == "source-bun140"
              else "1.4.4"
              if strategy in ("source-bun144-sourcegraph", "minimal-bun144-transplant")
              else oc["bun_version"]
          )
          bun = lock["android_bun"][bun_version]
          assert ot["commit"] == os.environ["OPENTUI_COMMIT"]
          assert ot["zig_version"] == os.environ["ZIG_VERSION"]
          if strategy == "upstream-transplant":
              assert bind["target"] == bun_version, (bind["target"], bun_version)
              assert bind["archive_sha256"] == bun["archive_sha256"]
              assert bind["elf_sha256"] == bun["elf_sha256"]
          else:
              source_bind = json.load(open(f"tools/transplant/config/bun-bind-source-{bun_version}.json", encoding="utf-8"))
              source_bun = lock["android_bun"][bun_version]
              assert source_bind["target"] == bun_version
              assert source_bind["archive_sha256"] == source_bun["archive_sha256"]
              assert source_bind["elf_sha256"] == source_bun["elf_sha256"]
          head = subprocess.check_output(
              ["git", "-C", "work/opentui", "rev-parse", "HEAD"], text=True
          ).strip()
          assert head == ot["commit"], (head, ot["commit"])
          if os.environ["BUILD_STRATEGY"] == "upstream-transplant":
              assert len(oc["cli_linux_arm64_sha256"]) == 64
          PY
          test "$(zig version)" = "$ZIG_VERSION"
        env:
          BUILD_STRATEGY: ${{ inputs.strategy }}

      - name: Build minimal Bun 1.4.4 transplant diagnostic
        if: ${{ inputs.strategy == 'minimal-bun144-transplant' }}
        run: bash scripts/ci/build-minimal-bun144-transplant.sh

      - name: Apply version-locked OpenTUI Android hardening
        run: |
          set -euo pipefail
          python3 "tools/patch-opentui-${OPENTUI_PATCH_VERSION}.py" work/opentui
          patch --fuzz=0 -d work/opentui -p1 < "patches/opentui/v${OPENTUI_PATCH_VERSION}-file-prefix-map.patch"
          patch --fuzz=0 -d work/opentui -p1 < "patches/opentui/v${OPENTUI_PATCH_VERSION}-tlsdesc-self-resolver.patch"
          git -C work/opentui diff --check

      - name: Build Bionic OpenTUI library
        run: |
          set -euo pipefail
          NDK="${ANDROID_NDK_LATEST_HOME:-}"
          if [ -z "$NDK" ] || [ ! -d "$NDK" ]; then
            NDK="$(find "$ANDROID_SDK_ROOT/ndk" -mindepth 1 -maxdepth 1 -type d | sort -V | tail -1)"
          fi
          test -d "$NDK/toolchains/llvm/prebuilt/linux-x86_64/sysroot"
          SYSROOT="$NDK/toolchains/llvm/prebuilt/linux-x86_64/sysroot"
          LIBDIR="$SYSROOT/usr/lib/aarch64-linux-android/$ANDROID_API"
          test -d "$LIBDIR"
          LLVM_STRIP="$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip"
          test -x "$LLVM_STRIP"
          echo "LLVM_STRIP=$LLVM_STRIP" >> "$GITHUB_ENV"
          mkdir -p work artifacts/transplant/opentui-bionic
          {
            echo "include_dir=$SYSROOT/usr/include/aarch64-linux-android"
            echo "sys_include_dir=$SYSROOT/usr/include"
            echo "crt_dir=$LIBDIR"
            echo "msvc_lib_dir="
            echo "kernel32_lib_dir="
            echo "gcc_dir="
          } > work/android-libc.txt
          sh work/opentui/packages/native/scripts/prepare-zig-deps.sh
          (
            cd work/opentui/packages/native
            OPENTUI_C_REMAP="-ffile-prefix-map=$GITHUB_WORKSPACE=/usr/src -D__ANDROID_MIN_SDK_VERSION__=28 -D__ANDROID_API__=28" \
            BIONIC_ARCH_INCLUDE="$SYSROOT/usr/include/aarch64-linux-android" \
            BIONIC_SYS_INCLUDE="$SYSROOT/usr/include" \
            BIONIC_LIB_DIR="$LIBDIR" \
              zig build -Dlibrary-target=aarch64-linux-android.28 \
                -Doptimize=ReleaseSafe --libc "$GITHUB_WORKSPACE/work/android-libc.txt"
          )
          SO="work/opentui/packages/native/lib/aarch64-linux-android.28/libopentui.so"
          test -f "$SO"
          python3 tools/remap-binary-prefix.py "$SO" "$GITHUB_WORKSPACE" /usr/src
          cp "$SO" artifacts/transplant/opentui-bionic/libopentui.unstripped.so
          "$LLVM_STRIP" --strip-unneeded "$SO"
          cp "$SO" artifacts/transplant/opentui-bionic/libopentui.so

      - name: Verify Bionic library
        run: |
          set -euo pipefail
          SO=artifacts/transplant/opentui-bionic/libopentui.so
          UNSTRIPPED=artifacts/transplant/opentui-bionic/libopentui.unstripped.so
          test -f "$UNSTRIPPED"
          file "$SO" | grep -q 'ARM aarch64'
          readelf -d "$SO" > work/opentui-needed.txt
          grep -q 'NEEDED.*libc.so' work/opentui-needed.txt
          if grep -q 'libc.so.6' work/opentui-needed.txt; then
            echo "glibc dependency found in Bionic library" >&2
            exit 1
          fi
          if readelf -Ws "$SO" | grep -E 'UND[[:space:]]+pthread_tryjoin_np' >/dev/null; then
            echo "glibc-only pthread_tryjoin_np import found in Bionic library" >&2
            exit 1
          fi
          python3 -c 'import sys; sys.path.insert(0,"tools/transplant"); from swap_tui import has_ffi_guard; assert has_ffi_guard(open(sys.argv[1],"rb").read())' "$UNSTRIPPED"
          if grep -aFq "$GITHUB_WORKSPACE" "$SO"; then
            echo "build workspace path leaked into library" >&2
            exit 1
          fi

      - name: Upload Bionic renderer library
        if: always()
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: opentui-bionic-${{ env.OPENTUI_VERSION }}
          path: artifacts/transplant/opentui-bionic/
          if-no-files-found: warn
          retention-days: 14

      - name: Download and verify locked OpenCode v2 package
        if: ${{ inputs.strategy == 'upstream-transplant' }}
        run: |
          set -euo pipefail
          mkdir -p work/npm
          NAME="$(npm pack "@opencode/cli-linux-arm64@$OPENCODE_VERSION" --pack-destination work/npm --silent | tail -1)"
          TGZ="work/npm/$NAME"
          test -f "$TGZ"
          python3 tools/verify-release-input.py \
            --kind opencode-cli --version "$OPENCODE_VERSION" --file "$TGZ"
          echo "TGZ=$TGZ" >> "$GITHUB_ENV"

      - name: Transplant onto verified Android Bun
        if: ${{ inputs.strategy == 'upstream-transplant' }}
        run: |
          set -euo pipefail
          python3 tools/transplant/transplant.py all \
            --ver "$OPENCODE_VERSION" --tgz "$TGZ" --no-execve
          python3 - <<'PY'
          import json
          import os
          from pathlib import Path

          out = Path("artifacts/transplant") / os.environ["OPENCODE_VERSION"]
          report = json.loads((out / "report.json").read_text(encoding="utf-8"))
          swap = report["steps"].get("swap")
          assert swap and swap["status"] == "ok", report["steps"].get("tui_probe")
          product = out / "opencode-native-tui"
          assert product.is_file() and product.stat().st_size > 50_000_000
          PY

      - name: Build version-matched Bun 1.4.0 source package and transplant it
        if: ${{ inputs.strategy == 'source-bun140' }}
        run: bash scripts/ci/build-opencode-source-bun140.sh

      - name: Build OpenCode source-mode runtime-test candidate
        if: ${{ inputs.strategy == 'source-bun144-sourcegraph' }}
        run: bash scripts/ci/build-opencode-source-bun144-sourcegraph.sh

      - name: Stage candidate and checksums
        run: |
          set -euo pipefail
          OUT="artifacts/transplant/$OPENCODE_VERSION"
          mkdir -p dist
          if [ "${{ inputs.strategy }}" = source-bun140 ]; then
            NAME="opencode-$OPENCODE_VERSION-android-aarch64-source-bun140"
          elif [ "${{ inputs.strategy }}" = source-bun144-sourcegraph ]; then
            NAME="opencode-$OPENCODE_VERSION-android-aarch64-source-bun144-sourcegraph"
          elif [ "${{ inputs.strategy }}" = minimal-bun144-transplant ]; then
            NAME="opencode-$OPENCODE_VERSION-android-aarch64-minimal-bun144-transplant"
          else
            NAME="opencode-$OPENCODE_VERSION-android-aarch64"
          fi
          if [ "${{ inputs.strategy }}" = minimal-bun144-transplant ]; then
            PRODUCT="$OUT/opencode-minimal-bun144-transplant"
          else
            PRODUCT="$OUT/opencode-native-tui"
          fi
          install -m 0755 "$PRODUCT" "dist/$NAME"
          if [ "${{ inputs.strategy }}" = minimal-bun144-transplant ]; then
            install -m 0755 "$OUT/opencode-minimal-bun144-direct" \
              "dist/opencode-$OPENCODE_VERSION-android-aarch64-minimal-bun144-direct"
          fi
          cp "$OUT/report.json" dist/transplant-report.json
          cp tools/supply-chain-lock.json dist/supply-chain-lock.json
          if [ "${{ inputs.strategy }}" = source-bun144-sourcegraph ] || \
             [ "${{ inputs.strategy }}" = minimal-bun144-transplant ]; then
            cp "$OUT/build-variant.json" dist/build-variant.json
          fi
          (cd dist && sha256sum * > SHA256SUMS)
          file "dist/$NAME"
          cat dist/SHA256SUMS

      - name: Upload unsigned runtime-test candidate
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: opencode-${{ env.OPENCODE_VERSION }}-android-aarch64-${{ inputs.strategy }}-candidate
          path: dist/
          if-no-files-found: error
          retention-days: 14