Setup Android GitHub Workflows

This documentation was generated with the assistance of AI. Please report any inaccuracies.

Scaffold or update the GitHub Actions CI/CD and security workflows, plus a Dependabot config, for an Android/Gradle repository produced by iru-setup-android-library or iru-setup-android-app.

Purpose

iru-setup-android-github-workflows wires up the house CI/CD pipeline for an Android/Gradle repository: build and unit test, an optional instrumented test on a reactivecircus/android-emulator-runner emulator, lint with SARIF upload, unit-test coverage via AGP’s own createDebugUnitTestCoverageReport task (with a vendored- jacococli.jar fallback), an optional SonarQube/SonarCloud scan, a Dokka + Antora documentation build published to GitHub Pages (library flavor; with pages: no the docs are still built but only uploaded as a workflow artifact), and — depending on flavor — either an optional Maven Central publish or a signed release build uploaded to Google Play or Firebase App Distribution. It also generates a security.yml (dependency-review, CodeQL, OSV-Scanner, gitleaks, plus two opt-in jobs) and .github/dependabot.yml, regardless of branching model. The skill supports two branching shapes — gitflow (develop.yml/main.yml/sync.yml) and main-only (main.yml/publish.yml, no sync.yml) — and two flavors (library/app), ships genericized example templates derived from a real Android library repository’s actual workflows, and resolves every placeholder from a survey of the target repository rather than guessing. It announces whether it is creating the pipeline from scratch or updating an existing one; for each pre-existing workflow file it compares the file with this run’s choices, names every concrete mismatch (for example an emulator step with ci-tests: unit, or a Pages deploy with pages: no), and asks Update / Keep as is / Replace (Stop on the first question), preserving any step/job this skill doesn’t own on Update. Standalone, it also resolves visibility, sonar, ci-tests and pages with cost-aware recommendations for private repositories (GitHub Actions minutes, SonarCloud pricing, GitHub Pages availability). There is no ci key: invoking the skill means CI is wanted. Every build job also ends with an Upload UI screenshots step (actions/upload-artifact, if: always(), 7-day retention) that attaches the .ui-screenshots/ captures of the catalog’s UI contract as a ui-screenshots workflow artifact — evidence only, nothing is published (see Building user interfaces). When the repository’s .ui-quality.yml sets accessibility: none, no accessibility report artifact, upload or accessibility-only job/step is generated (the UI test run and screenshot upload are unaffected).

Purpose group

Android Bootstrap

Plugin

Shipped by the iru-android plugin of the ai-catalog marketplace (install with /plugin install iru-android@ai-catalog; see Plugins).

Invocation

/iru-setup-android-github-workflows

Inputs

Argument Required Description Default

args (key: value lines)

No

Pre-resolved values, one per line, e.g. flavor: library. Key values: flavor (library/app), branching (gitflow/main-only), integration-branch, stable-branch, java-version, run-instrumented-tests (yes/no), api-level, plus this catalog’s shared workflow-args vocabulary — open-source, visibility (public/private/internal), ci-tests (unit/full; used only to derive run-instrumented-tests when that key is absent, full giving yes and unit giving no; an explicit run-instrumented-tests always wins), pages (yes/no — library only; deploy docs to GitHub Pages, or only upload them as a workflow artifact; public repositories default to yes, private/internal ones are asked with no recommended), publish (library only), distribution (none/internal/store, app only), sonar (cloud/self-hosted/none + sonar-organization/sonar-project-key/sonar-host-url; cloud is recommended only for an open-source public repository), mode (new/existing; informational only, it never means "update silently"), on-existing (ask/keep/update/replace; applied to every pre-existing file without asking, the warning still printed; meant for scripted runs), and four security-* opt-outs (security-dependency-review, security-codeql, security-osv, security-gitleaks) plus two security opt-ins (security-owasp-dependency-check, security-mobsfscan, app only) — so an orchestrating skill can supply them without re-prompting. The shared scaffold keys license, developer-name, developer-email and organization-url are accepted but unused by the generated files (noted in the report if supplied).

None — if args is absent or doesn’t match this format, every parameter is instead resolved by surveying the repository (module layout, existing sonar {}/mavenPublishing {} blocks, signing config, vendored JaCoCo CLI, branch names, README/Antora version wording) and asking the user for the rest — flavor is required and detected/asked if ambiguous; branching defaults to gitflow, java-version to 17, api-level to 35.

Outputs

Which files are written depends on branching × flavor:

branching × flavor Files written

gitflow / library

.github/workflows/develop.yml, main.yml, sync.yml, .github/scripts/sync_versions.py, security.yml, .github/dependabot.yml

gitflow / app

Same six files (the release job inside main.yml differs internally — signing/store upload instead of Maven Central publish)

main-only / library

.github/workflows/main.yml, publish.yml, security.yml, .github/dependabot.yml

main-only / app

Same four files (the release job inside publish.yml differs internally, same as above)

  • Every file above is created fresh when absent. When it already existed, it is updated in place (merged, preserving any step/job this skill doesn’t own), replaced with the template, or left as is, per the user’s answer or on-existing (Step 1); choosing Stop writes nothing. Per file, the report states the action taken (created / updated / replaced / kept as is) and, for a kept file, each mismatch with this run’s choices.

  • In every workflow’s build job, an Upload UI screenshots step (ui-screenshots artifact, 7-day retention, if-no-files-found: ignore) covering the repository-root .ui-screenshots/ and, with instrumented tests, each module’s connected_android_test_additional_output captures; no extra job or runner is added.

  • With pages: no the library build job uploads the built Dokka + Antora site as a docs-site workflow artifact (actions/upload-artifact) instead of the Pages artifact, and no deploy-docs job or Pages permissions are generated. With ci-tests: unit the emulator and KVM steps are omitted.

  • A report of required repository secrets and settings — see the table below — plus any open gaps found along the way (missing docs/antora.yml, a Gradle Play Publisher plugin found and preferred over the workflow-level upload action, README/Antora wording that didn’t match sync_versions.py’s regexes, a vendored `jacococli.jar found and used instead of the AGP-path default).

Required secrets (only the rows that apply to what was actually generated need to be created):

Secret Purpose Only needed when

SONAR_TOKEN

Auth token for the SonarQube/SonarCloud scan

sonar is cloud or self-hosted

MAVEN_CENTRAL_USERNAME / MAVEN_CENTRAL_PASSWORD

Maven Central Publishing Portal credentials

flavor: library, publish: yes

SIGNING_MEMORY_KEY / SIGNING_MEMORY_KEY_ID / SIGNING_IN_MEMORY_KEY_PASSWORD

In-memory GPG signing key, its id, and its passphrase, for Vanniktech’s Maven Publish plugin

flavor: library, publish: yes

ANDROID_KEYSTORE_BASE64

Base64-encoded release keystore, decoded to <app-module>/release.jks at build time

flavor: app, distribution isn’t none

ANDROID_KEYSTORE_PASSWORD / ANDROID_KEY_ALIAS / ANDROID_KEY_PASSWORD

Exported as SIGNING_STORE_PASSWORD/SIGNING_KEY_ALIAS/SIGNING_KEY_PASSWORD, the exact env vars iru-setup-android-app’s `app/build.gradle.kts reads via System.getenv()

flavor: app, distribution isn’t none

PLAY_SERVICE_ACCOUNT_JSON

Google Play service-account JSON for the workflow-level upload action

flavor: app, distribution: store, no Gradle Play Publisher plugin found

FIREBASE_APP_ID / FIREBASE_SERVICE_CREDENTIALS

Firebase App Distribution upload

flavor: app, distribution: internal

NVD_API_KEY

Raises the NVD lookup rate limit for OWASP Dependency-Check (the scan runs without it, just slower)

security-owasp-dependency-check: yes

GITHUB_TOKEN

sync.yml’s `gh calls, `security.yml’s CodeQL/gitleaks jobs

Automatic — no setup needed

sync.yml also needs the repository’s Settings → Actions → General → "Workflow permissions" set to allow GitHub Actions to create pull requests. With pages: yes, the Pages deploy jobs also need Settings → Pages → "Build and deployment" → Source set to GitHub Actions (and, for a private/internal repository, a GitHub Pro, Team or Enterprise Cloud plan; the site is public unless Enterprise Cloud private access control is used); with pages: no there is no Pages setting to change. These are called out explicitly in the final report since each fails silently on the first real run without it.

The generated files' bytes come from template files under templates/ (and, where a template needs variant-specific notes, reference/) in .claude/skills/iru-setup-android-github-workflows/; the skill reads only the files for the variant it resolved, not the whole set, which keeps its SKILL.md small.

Execution flow

flowchart TD A[Start /iru-setup-android-github-workflows] --> B["Step 0: Resolve inputs\n(parse args, else ask via AskUserQuestion/survey;\nstandalone: visibility, sonar, ci-tests, pages)"] B --> C["Step 1: Survey repository\n(module layout, flavor, sonar/\npublish blocks, signing, vendored\njacococli.jar, branches, docs)"] C --> D{"Do the relevant\nworkflow files\nalready exist?"} D -- none exist --> D1["Announce: creating from scratch"] D -- some exist --> D2["Announce: updating existing pipeline\nname mismatches with this run's choices"] D2 --> E{"on-existing set?"} E -- yes --> E1["Apply keep / update / replace\nto every file"] E -- no --> E2{"AskUserQuestion per file:\nUpdate / Keep as is / Replace\n(Stop on first question)"} E2 -- stop --> Z["Report which files exist;\nno changes made"] E2 -- choices --> F E1 --> F D1 --> F["Step 2: Resolve action\nversions (live lookup or\nSeptember 2026 fallback)"] F --> G{"branching?"} G -- gitflow --> H["Step 4: Fill develop.yml/\nmain.yml templates\n(Pages deploy or docs artifact per pages)"] G -- main-only --> I["Step 7: Fill main.yml/\npublish.yml templates"] H --> J["Step 5: gitflow only —\nsync.yml + sync_versions.py"] I --> K["Step 8: Fill security.yml +\n.github/dependabot.yml templates"] J --> K K --> L["Step 12: Write files per Step 11's file matrix\nand each file's Update / Keep / Replace choice"] L --> M["Step 14: Report mode, per-file actions, open gaps,\nrequired secrets table, and warnings"]

Dependencies

Invokes

None — iru-setup-android-github-workflows is a leaf skill; it does not call any other skill in this catalog.

Invoked by

  • Setup Android Repository — Step 7 runs iru-setup-android-github-workflows (via the iru-isolated-skill-executor agent), passing the pipeline parameters (flavor, branching, integration/stable branch, Java version, instrumented-test/API-level choice, plus the shared open-source/visibility/ci-tests/pages/publish/distribution/sonar/mode/on-existing/security-* args) through args as key: value lines so it isn’t asked again for facts the orchestrator already collected.

Related agents

None — this skill does not delegate any part of its work to a built-in agent.

Source

SKILL.md on GitHub — the file this page was generated from.