CI CD Pipeline

CI/CD Pipeline

The GitHub Actions workflow at .github/workflows/ci.yml builds and validates the Flutter app on every push/PR to main/develop (plus manual workflow_dispatch). Stages mirror our GitLab pipelines: prepare → lint → analyse → test → build → notify, each as a separate job so a failure shows up as its own named check.

Stages

Prepare Checks out the repo, installs the pinned Flutter SDK, materialises gitignored Firebase config placeholders from committed *.example templates, runs flutter pub get, then generates code with dart run build_runner build --delete-conflicting-outputs. It archives just lib/, test/, and pubspec.lock into workspace.tar.gz and uploads it as the workspace artifact (1-day retention) — the full working tree isn't archived because build_runner/.dart_tool caches are huge and mutate mid-read, which breaks tar.

Lint Depends on prepare. Does a full checkout, downloads and extracts the workspace artifact on top, installs the Flutter SDK (no pub get — dart format only parses syntax, not package resolution), then runs dart format --set-exit-if-changed over hand-written lib/test files, excluding generated files (*.g.dart, *.config.dart, *.swagger.dart, *.chopper.dart, *.gen.dart, locale_keys.g.dart).

Analyse Depends on prepare. Full checkout + workspace overlay, flutter pub get, then flutter analyze.

Test Depends on prepare. Full checkout + workspace overlay, flutter pub get, then flutter test.

Build (parallel) Runs once lint, analyse, and test all pass:

• build-android — full checkout + workspace overlay, Java 17, flutter pub get, provisions Firebase config (real secrets if configured, else example placeholders), builds a debug APK for the dev flavor stamped with --build-number=$GITHUB_RUN_NUMBER, uploads it as app-dev-debug-apk.
• build-ios — same overlay pattern on macOS, caches SwiftPM, provisions Firebase plist, builds an unsigned iOS app (--no-codesign, dev flavor, same run-number build stamp), zips the .app and uploads it as app-dev-debug-ios.

Notify Depends on all prior jobs and runs with if: always() (skipped on PRs). Checks out with fetch-depth: 8 for changelog history, then posts a Telegram message to the build notifications channel containing overall status, the version (pubspec.yaml version + GITHUB_RUN_NUMBER), branch, short SHA, run link, and the last 8 commits as a plain-text changelog (no Markdown parse mode, to avoid Telegram 400 errors from unpaired */`/_ in commit subjects).

Shared generated code

Only the prepare job runs build_runner. Every downstream job does a full git checkout, then downloads and extracts the workspace artifact on top, overlaying the generated lib/, test/, and resolved pubspec.lock from prepare. This guarantees lint, analyse, test, and both builds all operate on byte-identical generated code, since generator patch versions can drift and produce slightly different output across separate build_runner runs.