evidence.yml

name: evidence

on:
  workflow_dispatch:
    inputs:
      scope:
        description: "Space-separated Bazel target patterns such as //cli/cli/... or //pkg:target. Apple on macos_arm64: //apple/... //apple/tests/fixtures/macos_ledger/... //apple/tests/fixtures/macos_bundle/... //apple/tests/fixtures/swift_app/... Android on linux_x86_64: //android/private/sdk:androidsdk_build_test."
        required: true
      task:
        description: "One of test, build or coverage."
        required: false
        default: "test"
      platforms:
        description: 'JSON array of platform labels (e.g. ["windows_x86_64"]).'
        required: false
        default: '["linux_x86_64"]'
      test_timeout:
        description: "Seconds each test may run (test task only)."
        required: false
        default: "600"
      displays:
        description: "Linux only: xcb, wayland or xcb,wayland. Starts Xvfb and a headless Weston and sets DX_QT_DISPLAYS."
        required: false
        default: ""
      android:
        description: "linux_x86_64 only: boot an Android emulator and run the device scenarios after the scope task."
        type: boolean
        required: false
        default: false
      flags:
        description: "Extra Bazel flags, only --//label=value and --config flags, such as --//cc:compiler=msvc."
        required: false
        default: ""
      qualify:
        description: "Run //cc/private/context:qualify. windows_x86_64: llvm and msvc; linux_x86_64: custom GCC via --extra_toolchains."
        type: boolean
        required: false
        default: false
      relocate:
        description: "test or build only: run the task a second time under a fresh output base with caches bypassed, logged to relocated.log."
        type: boolean
        required: false
        default: false
      lock_refresh:
        description: "Regenerate MODULE.bazel.lock on the platform and fail when it differs; the refreshed lock and diff land in lock/ of the artifact."
        type: boolean
        required: false
        default: false
      release_cell:
        description: "Build and qualify the dx release cell of each platform with the script release-cells.yml runs, uncached, before the scope task."
        type: boolean
        required: false
        default: false

permissions:
  contents: read

concurrency:
  group: evidence-${{ github.ref }}-${{ github.run_id }}
  cancel-in-progress: false

env:
  MSYS2_ARG_CONV_EXCL: "//"
  DX_ANDROID_API: "34"
  DX_ANDROID_ABI: "x86_64"

jobs:
  pending:
    name: evidence status (pending)
    runs-on: ubuntu-slim
    timeout-minutes: 5
    permissions:
      statuses: write
    steps:
      - name: Post pending statuses
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          DX_SCOPE: ${{ inputs.scope }}
          DX_TASK: ${{ inputs.task }}
          DX_PLATFORMS: ${{ inputs.platforms }}
        run: |
          set -o pipefail
          task="$(printf '%s' "$DX_TASK" | tr -c 'a-z0-9_' '_' | cut -c1-40)"
          scope="$(printf '%s' "$DX_SCOPE" | tr -c 'A-Za-z0-9_.-' '_' | cut -c1-60)"
          description="$(printf '%s %s' "$task" "$DX_SCOPE" | tr '\n' ' ' | cut -c1-140)"
          url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
          printf '%s' "$DX_PLATFORMS" | jq -r '.[]? | strings' 2>/dev/null | while read -r platform; do
            [[ "$platform" =~ ^[a-z0-9_]{1,40}$ ]] || continue
            gh api "repos/$GH_REPO/statuses/$GITHUB_SHA" \
              -f state=pending \
              -f "context=evidence/$platform/$task/$scope" \
              -f "target_url=$url" \
              -f "description=$description"
          done

  evidence:
    name: evidence (${{ matrix.platform }})
    timeout-minutes: ${{ inputs.release_cell && 90 || 60 }}
    defaults:
      run:
        shell: bash
    strategy:
      fail-fast: false
      matrix:
        platform: ${{ fromJSON(inputs.platforms) }}
    runs-on: ${{ fromJSON('{"linux_x86_64":"ubuntu-latest","linux_arm64":"ubuntu-24.04-arm","macos_arm64":"macos-15","windows_x86_64":"windows-latest","windows_arm64":"windows-11-arm"}')[matrix.platform] || 'ubuntu-latest' }}
    env:
      BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
    permissions:
      contents: read
    steps:
      - name: Free disk space
        if: ${{ inputs.android && matrix.platform == 'linux_x86_64' }}
        run: |
          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/.ghcup /usr/local/share/boost /usr/local/lib/node_modules /opt/hostedtoolcache/CodeQL
          df -h /
      - name: Check out files in parallel
        run: |
          git init "$GITHUB_WORKSPACE"
          git -C "$GITHUB_WORKSPACE" remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY"
          git -C "$GITHUB_WORKSPACE" -c checkout.workers=0 fetch --depth=1 --no-tags origin "$GITHUB_SHA"
          git -C "$GITHUB_WORKSPACE" -c checkout.workers=0 checkout --force FETCH_HEAD
      - name: Validate workflow inputs
        id: inputs
        env:
          DX_SCOPE: ${{ inputs.scope }}
          DX_TASK: ${{ inputs.task }}
          DX_PLATFORMS: ${{ inputs.platforms }}
          DX_DISPLAYS: ${{ inputs.displays }}
          DX_TEST_TIMEOUT: ${{ inputs.test_timeout }}
          DX_FLAGS: ${{ inputs.flags }}
          DX_RELOCATE: ${{ inputs.relocate }}
          DX_EVIDENCE_NO_JQ: ${{ runner.os == 'Windows' && '1' || '' }}
        run: bash tools/ci/evidence_inputs.sh
      - id: setup
        uses: ./.github/actions/setup-bazel
      - name: Build and qualify the release cell
        if: ${{ inputs.release_cell }}
        env:
          DX_PLATFORM: ${{ matrix.platform }}
          WORKFLOW_REF: ${{ github.workflow_ref }}
          WORKFLOW_SHA: ${{ github.workflow_sha }}
          RUN_ID: ${{ github.run_id }}
          JOB: ${{ github.job }}
          SHA: ${{ github.sha }}
        run: |
          export CELL="dx-${DX_PLATFORM/_/-}"
          out="$RUNNER_TEMP/evidence/release-cell"
          status=0
          tools/ci/release_cell.sh "$out" || status=$?
          cp "$RUNNER_TEMP"/rebuilt-* "$out/" 2>/dev/null || true
          exit "$status"
      - name: Use the BuildBuddy remote cache
        env:
          DX_PLATFORM: ${{ matrix.platform }}
        run: |
          [ -n "${BB_ARGS:-}" ] || exit 0
          {
            echo "common --config=ci"
            echo "common $BB_ARGS"
          } >> user.bazelrc
          [ "$DX_PLATFORM" != linux_x86_64 ] || echo "common --config=rbe" >> user.bazelrc
      - name: Enable KVM
        if: ${{ inputs.android && matrix.platform == 'linux_x86_64' }}
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm
          if [ ! -e /dev/kvm ]; then
            echo "android: /dev/kvm is missing; this runner cannot run a hardware-accelerated emulator" && exit 1
          fi
      - name: Install the Android SDK packages
        if: ${{ inputs.android && matrix.platform == 'linux_x86_64' }}
        run: |
          sudo apt-get update
          sudo apt-get install -y libpulse0
          sdkmanager="$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager"
          yes | "$sdkmanager" --licenses > /dev/null || true
          "$sdkmanager" --install \
            "platform-tools" \
            "emulator" \
            "system-images;android-$DX_ANDROID_API;google_apis;$DX_ANDROID_ABI" > /dev/null
          {
            echo "SDKMANAGER=$sdkmanager"
            echo "EMULATOR=$ANDROID_HOME/emulator/emulator"
            echo "ANDROID_HOME=$ANDROID_HOME"
          } >> "$GITHUB_ENV"
          echo "$ANDROID_HOME/platform-tools" >> "$GITHUB_PATH"
      - name: Boot the emulator
        if: ${{ inputs.android && matrix.platform == 'linux_x86_64' }}
        run: |
          mkdir -p "$RUNNER_TEMP/evidence" "$RUNNER_TEMP/avd"
          export ANDROID_AVD_HOME="$RUNNER_TEMP/avd"
          echo no | "$ANDROID_HOME/cmdline-tools/latest/bin/avdmanager" create avd --force -n dx \
            -k "system-images;android-$DX_ANDROID_API;google_apis;$DX_ANDROID_ABI"
          "$EMULATOR" -list-avds | grep -qx dx || { echo "android: the dx AVD was not created"; ls -la "$ANDROID_AVD_HOME" "$HOME/.android" 2>&1; exit 1; }
          nohup "$EMULATOR" -avd dx -port 5554 -no-window -no-audio -no-boot-anim -no-snapshot \
            -gpu swiftshader_indirect > "$RUNNER_TEMP/evidence/emulator.log" 2>&1 &
          adb start-server
      - name: Start virtual displays
        if: ${{ inputs.displays != '' && startsWith(matrix.platform, 'linux') }}
        env:
          DX_DISPLAYS: ${{ inputs.displays }}
        run: |
          set -eu
          case "$DX_DISPLAYS" in
            xcb|wayland|xcb,wayland|wayland,xcb) ;;
            *) echo "displays must be xcb, wayland or xcb,wayland, got '$DX_DISPLAYS'"; exit 1 ;;
          esac
          sudo apt-get update
          sudo apt-get install -y xvfb weston
          runtime="$RUNNER_TEMP/xdg"
          mkdir -p "$runtime"
          chmod 700 "$runtime"
          echo "DX_QT_DISPLAYS=$DX_DISPLAYS" >> "$GITHUB_ENV"
          echo "XDG_RUNTIME_DIR=$runtime" >> "$GITHUB_ENV"
          case ",$DX_DISPLAYS," in
            *,xcb,*)
              Xvfb :99 -screen 0 1280x720x24 > "$RUNNER_TEMP/xvfb.log" 2>&1 &
              echo "DISPLAY=:99" >> "$GITHUB_ENV"
              sleep 3
              ;;
          esac
          case ",$DX_DISPLAYS," in
            *,wayland,*)
              XDG_RUNTIME_DIR="$runtime" weston --backend=headless --socket=wayland-dx --idle-time=0 > "$RUNNER_TEMP/weston.log" 2>&1 &
              echo "WAYLAND_DISPLAY=wayland-dx" >> "$GITHUB_ENV"
              for _ in $(seq 1 20); do
                [ -S "$runtime/wayland-dx" ] && break
                sleep 1
              done
              [ -S "$runtime/wayland-dx" ] || { cat "$RUNNER_TEMP/weston.log"; exit 1; }
              ;;
          esac
      - name: Allow unprivileged user namespaces
        if: runner.os == 'Linux'
        run: |
          if [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then
            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
          fi
      - name: Deny the host MSVC trees to hermetic runs
        if: ${{ runner.os == 'Windows' && contains(steps.inputs.outputs.flags, 'compiler=msvc') }}
        env:
          DX_FLAGS: ${{ steps.inputs.outputs.flags }}
        run: |
          read -ra flags <<< "$DX_FLAGS"
          denies=()
          # Git Bash upper-cases ProgramFiles but keeps ProgramFiles(x86) as is.
          for root in "${PROGRAMFILES:-$(printenv ProgramFiles)}" "$(printenv 'ProgramFiles(x86)')"; do
            [ -n "$root" ] || continue
            for name in "Microsoft Visual Studio" "Windows Kits" "Microsoft SDKs"; do
              dir="$root\\$name"
              if [ -d "$(cygpath -u "$dir")" ]; then
                denies+=(--deny "$dir")
              fi
            done
          done
          bazel run --noshow_progress "${flags[@]}" //tools/testing/hermetic:appcontainer_run -- \
            --backend user --ensure-host-denies "${denies[@]}"
      - name: Regenerate MODULE.bazel.lock
        if: ${{ inputs.lock_refresh }}
        run: |
          out="$RUNNER_TEMP/evidence/lock"
          mkdir -p "$out"
          bazel mod deps --lockfile_mode=update 2>&1 | tee "$out/mod-deps.log"
          cp MODULE.bazel.lock "$out/MODULE.bazel.lock"
          git diff --exit-code MODULE.bazel.lock > "$out/lock.diff" || { cat "$out/lock.diff"; exit 1; }
      - name: Run evidence task
        env:
          DX_SCOPE: ${{ steps.inputs.outputs.scope }}
          DX_TASK: ${{ steps.inputs.outputs.task }}
          DX_TEST_TIMEOUT: ${{ steps.inputs.outputs.test_timeout }}
          DX_FLAGS: ${{ steps.inputs.outputs.flags }}
          DX_RELOCATE: ${{ steps.inputs.outputs.relocate }}
        run: |
          set -o pipefail
          mkdir -p "$RUNNER_TEMP/evidence"
          read -ra patterns <<< "$DX_SCOPE"
          read -ra flags <<< "$DX_FLAGS"
          DX_HERMETIC_BAZELISK="$(command -v bazel)"
          export DX_HERMETIC_BAZELISK
          startup=()
          extra=(--notrack_incremental_state --nokeep_state_after_build)
          downloads=()
          # The determinism check reads outputs from the execution root, so only a plain run leaves them remote.
          [ "$DX_RELOCATE" = true ] || downloads=(--remote_download_minimal "--remote_download_regex=.*/testlogs/.*")
          profile=("--profile=$RUNNER_TEMP/evidence/profile.gz" --noslim_profile --experimental_profile_include_target_label --experimental_profile_include_primary_output)
          run_task() {
            log="$1"
            if [ "$DX_TASK" = "build" ]; then
              bazel "${startup[@]}" build --noshow_progress "${profile[@]}" "${downloads[@]}" "${extra[@]}" "${patterns[@]}" "${flags[@]}" 2>&1 | tee "$log"
            elif [ "$DX_TASK" = "coverage" ]; then
              bazel run --noshow_progress "${profile[@]}" //cli/cli:dx -- coverage --min-coverage 100 "${patterns[@]}" ${flags[@]:+-- "${flags[@]}"} 2>&1 | tee "$log"
            else
              bazel "${startup[@]}" test --keep_going --noshow_progress "${profile[@]}" --nozip_undeclared_test_outputs --test_timeout="$DX_TEST_TIMEOUT" "--test_env=DX_HERMETIC_BAZELISK=$DX_HERMETIC_BAZELISK" "${downloads[@]}" "${extra[@]}" "${patterns[@]}" "${flags[@]}" 2>&1 | tee "$log"
            fi
          }
          run_task "$RUNNER_TEMP/evidence/evidence.log"
          if [ "$DX_RELOCATE" = true ]; then
            base="$RUNNER_TEMP/relocated-base"
            rm -rf "$base"
            startup=("--output_base=$base")
            extra=(--disk_cache= --noremote_accept_cached)
            profile=()
            run_task "$RUNNER_TEMP/evidence/relocated.log"
            differ=0
            if [ "$DX_TASK" = build ]; then
              det="$RUNNER_TEMP/evidence/determinism"
              mkdir -p "$det"
              first_root="$(bazel info "${flags[@]}" execution_root | tr -d '\r')"
              second_root="$(bazel "--output_base=$base" info "${flags[@]}" execution_root | tr -d '\r')"
              bazel cquery --noshow_progress --output=files "${DX_SCOPE// / + }" "${flags[@]}" | tr -d '\r' > "$det/first.txt"
              bazel "--output_base=$base" cquery --noshow_progress --output=files "${DX_SCOPE// / + }" "${flags[@]}" | tr -d '\r' > "$det/relocated.txt"
              sort -u "$det/first.txt" "$det/relocated.txt" > "$det/files.txt"
              while read -r f; do
                [ -d "$first_root/$f" ] && continue
                a="$(sha256sum < "$first_root/$f" 2>/dev/null | cut -d' ' -f1)" || a=missing
                b="$(sha256sum < "$second_root/$f" 2>/dev/null | cut -d' ' -f1)" || b=missing
                if [ "$a" = "$b" ]; then
                  echo "match $f $a $b"
                  continue
                fi
                echo "differ $f $a $b"
                differ=1
                mkdir -p "$det/first/$(dirname "$f")" "$det/relocated/$(dirname "$f")"
                cp "$first_root/$f" "$det/first/$f" 2>/dev/null || true
                cp "$second_root/$f" "$det/relocated/$f" 2>/dev/null || true
              done < "$det/files.txt" > "$RUNNER_TEMP/evidence/determinism.txt"
              cat "$RUNNER_TEMP/evidence/determinism.txt"
            fi
            bazel "--output_base=$base" shutdown
            exit "$differ"
          fi
      - name: Record the Apple executor
        if: ${{ always() && matrix.platform == 'macos_arm64' }}
        run: |
          mkdir -p "$RUNNER_TEMP/evidence"
          {
            sw_vers
            uname -m
            xcode-select -p
            ls -d /Applications/Xcode*.app
            base="$(bazel info output_base || true)"
            for repo in "$base"/external/*local_config_xcode*; do
              [ -f "$repo/BUILD" ] || continue
              echo "Bazel Xcode detection: $repo"
              grep -E '^ *(name|version|default_[a-z_]*version|aliases) *=' "$repo/BUILD" || true
            done
          } 2>&1 | tee "$RUNNER_TEMP/evidence/executor.txt"
      - name: Qualify cc/private/context exports
        if: ${{ inputs.qualify && matrix.platform == 'windows_x86_64' }}
        run: |
          mkdir -p "$RUNNER_TEMP/evidence"
          "C:/Program Files (x86)/Microsoft Visual Studio/Installer/vswhere.exe" -latest -format json > "$RUNNER_TEMP/evidence/msvc-vswhere.json"
          bazel_bin="$(cygpath -w "$(command -v bazel)")"
          failed=0
          for c in llvm msvc; do
            if ! bazel run --noshow_progress //cc/private/context:qualify -- --target //cc/tests/fixtures/compilation_db:probe_plain --compiler "$c" --bazel "$bazel_bin" --output "$(cygpath -w "$RUNNER_TEMP/evidence/qualify-$c.json")" 2>&1 | tee "$RUNNER_TEMP/evidence/qualify-$c.log"; then
              failed=1
            fi
          done
          exit "$failed"
      - name: Qualify cc/private/context exports with a custom toolchain
        if: ${{ inputs.qualify && matrix.platform == 'linux_x86_64' }}
        run: |
          set -o pipefail
          mkdir -p "$RUNNER_TEMP/evidence"
          bazel run --noshow_progress //cc/private/context:qualify -- --target //cc/tests/fixtures/compilation_db:probe_plain --output "$RUNNER_TEMP/evidence/qualify-custom-gcc.json" -- --extra_toolchains=//cc/private/toolchains/external:custom_gcc_x86_64 2>&1 | tee "$RUNNER_TEMP/evidence/qualify-custom-gcc.log"
      - name: Build the APKs for the inspect tests
        if: ${{ inputs.android && matrix.platform == 'linux_x86_64' }}
        run: |
          set -o pipefail
          bazel build --noshow_progress //examples/shared-rust:tasks_apk_file @shared_consumer//:consumer_apk_file 2>&1 | tail -n 60
      - name: Run the APK inspect tests
        if: ${{ inputs.android && matrix.platform == 'linux_x86_64' }}
        run: |
          set -o pipefail
          bazel test --noshow_progress --test_output=errors --test_timeout=120 //rust/tests/fixtures/shared-rust-checks:inspect_apk_test //rust/tests/fixtures/shared-rust-checks:inspect_consumer_apk_test 2>&1 | tail -n 120
      - name: Wait for the emulator to boot
        id: boot
        if: ${{ inputs.android && matrix.platform == 'linux_x86_64' }}
        run: |
          export PATH="$ANDROID_HOME/platform-tools:$PATH"
          command -v adb || { echo "android: adb is not on PATH: $PATH"; ls -la "$ANDROID_HOME/platform-tools"; exit 1; }
          timeout 600 adb -s emulator-5554 wait-for-device
          waited=0
          until [ "$(adb -s emulator-5554 shell getprop sys.boot_completed 2>/dev/null | tr -d '\r')" = "1" ]; do
            if [ "$waited" -ge 600 ]; then
              echo "android: emulator-5554 did not boot within 600 s" && tail -n 50 "$RUNNER_TEMP/evidence/emulator.log" && exit 1
            fi
            sleep 5
            waited=$((waited + 5))
          done
          adb -s emulator-5554 shell settings put global window_animation_scale 0
          adb -s emulator-5554 shell settings put global transition_animation_scale 0
          adb -s emulator-5554 shell settings put global animator_duration_scale 0
          adb -s emulator-5554 shell input keyevent KEYCODE_WAKEUP
          adb -s emulator-5554 shell wm dismiss-keyguard
          # Version probes must not fail the boot step.
          set +e
          {
            lsb_release -d
            uname -m
            sed -n 's/^Pkg.Revision=/emulator /p' "$ANDROID_HOME/emulator/source.properties"
            adb version
            "$SDKMANAGER" --list_installed
            for prop in ro.build.version.sdk ro.product.cpu.abi ro.product.cpu.abilist; do
              echo "$prop=$(adb -s emulator-5554 shell getprop "$prop" | tr -d '\r')"
            done
          } > "$RUNNER_TEMP/evidence/android-versions.txt" 2>&1
          cat "$RUNNER_TEMP/evidence/android-versions.txt"
      - name: Run the device scenario
        if: ${{ inputs.android && matrix.platform == 'linux_x86_64' }}
        run: sh android/tests/fixtures/rust_apk/device_run.sh emulator-5554 "$RUNNER_TEMP/evidence"
      - name: Run the rust-android fixture on the emulator
        if: ${{ inputs.android && matrix.platform == 'linux_x86_64' }}
        run: |
          set -o pipefail
          checkout="$PWD"
          evidence="$RUNNER_TEMP/evidence"
          bazel build --noshow_progress //cli/cli:dx 2>&1 | tail -n 20
          cp -L bazel-bin/cli/cli/dx "$RUNNER_TEMP/dx"
          starter() {
            set -e
            cd "$RUNNER_TEMP"
            ./dx init --apply demo-app --workspace "$RUNNER_TEMP"
            fixture="$checkout/tools/testing/starters/fixtures/rust-android"
            (cd "$fixture" && find . -type f -name '*.fixture') | while read -r file; do
              dest="demo-app/${file#./}"
              dest="${dest%.fixture}"
              mkdir -p "$(dirname "$dest")"
              case "$dest" in
                demo-app/families) while read -r family; do printf 'bazel_dep(name = "rules_dx_%s", version = "0.0.0")\nlocal_path_override(module_name = "rules_dx_%s", path = "%s/families/%s")\n' "$family" "$family" "$checkout" "$family" >> demo-app/MODULE.bazel; done < "$fixture/$file" ;;
                demo-app/MODULE.bazel | demo-app/.bazelrc) printf '\n' >> "$dest" && cat "$fixture/$file" >> "$dest" ;;
                *) cp "$fixture/$file" "$dest" ;;
              esac
            done
            cd demo-app
            printf 'local_path_override(module_name = "rules_dx", path = "%s")\n' "$checkout" >> MODULE.bazel
            bazel build --noshow_progress :demo-app_apk_file
            bazel build --noshow_progress :demo-app_release_sign
            bazel test --noshow_progress :demo-app_check_test
            adb -s emulator-5554 logcat -c
            bazel run --noshow_progress :demo-app_install
            bazel run --noshow_progress :demo-app_start
            waited=0
            until adb -s emulator-5554 logcat -d -s DxApp:I | grep -q 'greeting=Hello from Rust on Android!'; do
              if [ "$waited" -ge 60 ]; then
                echo "android: the starter greeting is absent from logcat after 60 s" && return 1
              fi
              sleep 1
              waited=$((waited + 1))
            done
            adb -s emulator-5554 logcat -d -s DxApp:I | tee "$evidence/logcat-starter.txt"
          }
          code=0
          (starter) > "$evidence/rust-android-starter.log" 2>&1 || code=$?
          cat "$evidence/rust-android-starter.log"
          echo "rust-android-starter $code" >> "$evidence/exit-codes.txt"
          exit "$code"
      - name: Run shared-rust on the emulator
        if: ${{ !cancelled() && inputs.android && matrix.platform == 'linux_x86_64' && steps.boot.outcome == 'success' }}
        run: |
          set -o pipefail
          cd "$GITHUB_WORKSPACE"
          adb -s emulator-5554 logcat -c
          bazel run --noshow_progress //examples/shared-rust:install
          bazel run --noshow_progress //examples/shared-rust:start
          sleep 5
          adb -s emulator-5554 shell dumpsys window | grep -E 'mCurrentFocus|mFocusedApp' | tee "$RUNNER_TEMP/evidence/focus-shared-rust.txt"
          adb -s emulator-5554 shell input touchscreen swipe 200 400 200 400 200
          sleep 2
          adb -s emulator-5554 shell input touchscreen swipe 200 400 200 400 200
          sleep 2
          adb -s emulator-5554 shell input keyevent KEYCODE_ENTER
          sleep 2
          adb -s emulator-5554 shell input keyevent KEYCODE_BACK
          sleep 2
          adb -s emulator-5554 logcat -d -s DxSharedTasks:I | tee "$RUNNER_TEMP/evidence/logcat-shared-rust.txt"
          sh rust/tests/fixtures/shared-rust-checks/check_lifecycle.sh "$RUNNER_TEMP/evidence/logcat-shared-rust.txt"
      - name: Run the flutter-app interaction test on the emulator
        if: ${{ !cancelled() && inputs.android && matrix.platform == 'linux_x86_64' && steps.boot.outcome == 'success' }}
        run: |
          set -o pipefail
          bazel test --noshow_progress --test_output=all --test_env=PATH --test_env=HOME --test_env=ANDROID_HOME //flutter/tests/fixtures/flutter-app/android:interaction_test 2>&1 | tail -n 80
      - uses: ./.github/actions/save-registry-cache
        if: ${{ steps.setup.outputs.registry-cache-hit != 'true' }}
      - name: Collect test logs
        if: ${{ always() && steps.inputs.outcome == 'success' }}
        run: |
          out="$RUNNER_TEMP/evidence/testlogs"
          mkdir -p "$out"
          [ -e bazel-testlogs ] || exit 0
          find -L bazel-testlogs/ -name test.outputs -prune -o -name test.log -print | while read -r log; do
            dir="$(dirname "$log")"
            rel="${dir#bazel-testlogs/}"
            mkdir -p "$out/$rel"
            cp "$dir/test.log" "$out/$rel/" 2>/dev/null || true
            cp "$dir/test.xml" "$out/$rel/" 2>/dev/null || true
            cp "$dir/coverage.dat" "$out/$rel/" 2>/dev/null || true
            if [ -d "$dir/test.outputs" ]; then
              cp -RL "$dir/test.outputs" "$out/$rel/" 2>/dev/null || true
            fi
          done
      - name: Check the upload holds no secret
        id: scan-evidence
        if: ${{ always() && steps.inputs.outcome == 'success' }}
        uses: ./.github/actions/assert-no-secret
        with:
          path: ${{ runner.temp }}/evidence
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        if: ${{ always() && steps.scan-evidence.outcome == 'success' }}
        with:
          name: evidence-${{ matrix.platform }}
          path: ${{ runner.temp }}/evidence
          retention-days: 3
      - name: Write job summary
        if: ${{ always() && steps.inputs.outcome == 'success' }}
        env:
          DX_PLATFORM: ${{ matrix.platform }}
          DX_TASK: ${{ steps.inputs.outputs.task }}
          DX_SCOPE: ${{ steps.inputs.outputs.scope }}
          DX_DISPLAYS: ${{ inputs.displays }}
        run: |
          {
            printf '## Evidence %s\n\n' "$DX_PLATFORM"
            printf "Task \`%s\` on \`%s\`.\n" "$DX_TASK" "$DX_SCOPE"
            printf "Commit \`%s\`, displays \`%s\`.\n" "$GITHUB_SHA" "$DX_DISPLAYS"
            if [ -f "$RUNNER_TEMP/evidence/evidence.log" ]; then
              tail -n 20 "$RUNNER_TEMP/evidence/evidence.log"
              if [ "$DX_TASK" = coverage ]; then
                grep -E 'coverage sources|coverage_sources_incomplete' "$RUNNER_TEMP/evidence/evidence.log" | tail -n 40
              fi
            fi
            if [ -f "$RUNNER_TEMP/evidence/relocated.log" ]; then
              printf '\nRelocated output base:\n'
              tail -n 20 "$RUNNER_TEMP/evidence/relocated.log"
            fi
            if [ -f "$RUNNER_TEMP/evidence/determinism.txt" ]; then
              printf '\nDeterminism:\n```\n'
              cat "$RUNNER_TEMP/evidence/determinism.txt"
              printf '```\n'
            fi
            for log in "$RUNNER_TEMP"/evidence/qualify-*.log; do
              [ -f "$log" ] || continue
              printf '\n%s: ' "$(basename "$log")"
              tail -n 1 "$log"
            done
            if [ -f "$RUNNER_TEMP/evidence/android-versions.txt" ]; then
              printf '\n```\n'
              cat "$RUNNER_TEMP/evidence/android-versions.txt"
              printf '```\n'
            fi
          } >> "$GITHUB_STEP_SUMMARY"

  finish:
    name: evidence status (final)
    needs: [pending, evidence]
    if: ${{ always() && needs.pending.result == 'success' }}
    runs-on: ubuntu-slim
    timeout-minutes: 10
    permissions:
      actions: read
      statuses: write
    steps:
      - name: Post final statuses
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          DX_SCOPE: ${{ inputs.scope }}
          DX_TASK: ${{ inputs.task }}
          DX_PLATFORMS: ${{ inputs.platforms }}
        run: |
          set -o pipefail
          task="$(printf '%s' "$DX_TASK" | tr -c 'a-z0-9_' '_' | cut -c1-40)"
          scope="$(printf '%s' "$DX_SCOPE" | tr -c 'A-Za-z0-9_.-' '_' | cut -c1-60)"
          url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
          jobs="$(gh api "repos/$GH_REPO/actions/runs/$GITHUB_RUN_ID/jobs" --paginate --jq '.jobs[] | {name, conclusion}' | jq -s '.')"
          printf '%s' "$DX_PLATFORMS" | jq -r '.[]? | strings' 2>/dev/null | while read -r platform; do
            [[ "$platform" =~ ^[a-z0-9_]{1,40}$ ]] || continue
            result="$(printf '%s' "$jobs" | jq -r --arg name "evidence ($platform)" '[.[] | select(.name == $name) | .conclusion][0] // "missing"')"
            case "$result" in
              success) state=success; description="evidence passed" ;;
              failure) state=failure; description="evidence failed" ;;
              *) state=error; description="run ended without a result" ;;
            esac
            gh api "repos/$GH_REPO/statuses/$GITHUB_SHA" \
              -f "state=$state" \
              -f "context=evidence/$platform/$task/$scope" \
              -f "target_url=$url" \
              -f "description=$description"
          done