Merge upstream AnkiDroid (Oct 5)

.github/check_alpha_release.js

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+const fs = require("node:fs");
+
+module.exports = async function checkAlphaRelease({ github, context, core }) {
+    const metadata = JSON.parse(
+        fs.readFileSync("AnkiDroid/build/outputs/release-metadata.json", "utf8"),
+    );
+    if (metadata.releaseType !== "alpha") {
+        core.info("Skipping scheduled release: main is not on an alpha version.");
+        return false;
+    }
+
+    const releases = await github.paginate(github.rest.repos.listReleases, {
+        ...context.repo,
+        per_page: 100,
+    });
+    // Use calendar days to check, so last Monday's release doesn't block this release.
+    const day = 24 * 60 * 60 * 1000;
+    const today = Math.floor(Date.now() / day);
+    const recentRelease = releases.find(
+        release => !release.draft && today - Math.floor(Date.parse(release.published_at) / day) < 7,
+    );
+    if (recentRelease) {
+        core.info(
+            `Skipping scheduled release: ${recentRelease.tag_name} was published fewer than seven UTC calendar days ago.`,
+        );
+        return false;
+    }
+
+    const latestAlpha = releases
+        .filter(release => !release.draft && /^v\d+\.\d+\.\d+alpha\d+$/.test(release.tag_name))
+        .sort((a, b) => Date.parse(b.published_at) - Date.parse(a.published_at))[0];
+    if (!latestAlpha) {
+        core.info("Skipping scheduled release: no published alpha to compare against.");
+        return false;
+    }
+
+    const { data: comparison } = await github.rest.repos.compareCommitsWithBasehead({
+        ...context.repo,
+        basehead: `${latestAlpha.tag_name}...${context.sha}`,
+    });
+    if (comparison.status !== "ahead" || comparison.ahead_by === 0) {
+        core.info(
+            `Skipping scheduled release: no new commits descending from ${latestAlpha.tag_name}.`,
+        );
+        return false;
+    }
+
+    core.info(
+        `Publishing an alpha: ${comparison.ahead_by} new commits since ${latestAlpha.tag_name}.`,
+    );
+    return true;
+};

.github/run_emulator_tests.py

@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+"""Run emulator tests and generate the coverage report."""
+
+import hashlib
+from pathlib import Path
+import subprocess
+import sys
+import time
+
+
+def read_coverage():
+    shell = ["adb", "shell", "-T", "run-as", "com.ichi2.anki"]
+    for attempt in range(1, 6):
+        try:
+            checksum = subprocess.check_output([*shell, "sha256sum", "coverage.ec"], timeout=30).split()
+            data = subprocess.check_output([*shell, "cat", "coverage.ec"], timeout=30)
+            # ADB can exit successfully after a truncated transfer.
+            if not data or not checksum or hashlib.sha256(data).hexdigest().encode() != checksum[0]:
+                raise ValueError("Coverage copy is empty or incomplete")
+            return data
+        except (subprocess.SubprocessError, ValueError) as error:
+            # TODO (Issue 22147 - Dec 2026): check CI logs for "Coverage copy attempt" failures.
+            print(f"Coverage copy attempt {attempt}/5 failed: {error}", file=sys.stderr)
+            if attempt == 5:
+                raise
+            time.sleep(1)
+
+
+def main():
+    connected_test = ":AnkiDroid:connectedPlayReleaseAndroidTest"
+    subprocess.run(
+        ["./gradlew", "uninstallAll", connected_test,
+         "-Pandroid.injected.androidTest.leaveApksInstalledAfterRun=true", "--daemon"],
+        check=True,
+    )
+    data = read_coverage()
+    output_dir = Path("AnkiDroid/build/outputs/code_coverage/playReleaseAndroidTest/connected")
+    output_dir.mkdir(parents=True, exist_ok=True)
+    # JaCoCo reads every .ec file, including AGP's potentially truncated copy.
+    for previous in output_dir.rglob("*.ec"):
+        previous.unlink()
+    (output_dir / "coverage.ec").write_bytes(data)
+    subprocess.run(
+        ["./gradlew", ":AnkiDroid:jacocoAndroidTestReport", "-x", connected_test, "--daemon"],
+        check=True,
+    )
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except subprocess.CalledProcessError as error:
+        sys.exit(error.returncode)
+    except (OSError, ValueError, subprocess.TimeoutExpired) as error:
+        sys.exit(str(error))

.github/workflows/README.md

@@ -22,4 +22,21 @@ Alternately, you may run the actions on your fork of `Anki-Android`.
 
 ## Other Workflows
 
-These are typically run by maintainers. See the [Maintenance guide](https://github.com/ankidroid/Anki-Android/wiki/Maintenance-guide)
+These are typically run by maintainers. See the [Maintenance guide](https://github.com/ankidroid/Anki-Android/wiki/Maintenance-guide)
+
+### Merge queue cancellation
+
+GitHub can leave jobs running after their merge group has been removed.
+
+`cancel_merge_queue_runs.yml` is triggered when a temporary merge queue branch is deleted.
+The workflow cancels unfinished runs for unmerged groups.
+
+### Automatic publish
+
+An automatic alpha publish is performed every Monday at 04:30 UTC. This publish is skipped if:
+
+* A publish occurred fewer than 7 UTC calendar days ago.
+* The app is not in alpha.
+* There were no commits since the last release.
+
+An alpha published on Monday does not block the following Monday's release, regardless of the time it finished.

.github/workflows/cancel_merge_queue_runs.yml

@@ -0,0 +1,135 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+name: Cancel Obsolete Merge Queue Runs
+
+# `merge_group: destroyed` identifies the merge group and reason for removal,
+# but is not documented as a supported Actions trigger. Use `delete` instead.
+on:
+  # GitHub deletes temporary branches after discarded groups and successful merges.
+  # Preserve runs for merged commits: their checks also appear on the target branch.
+  delete:
+
+permissions: {}
+
+jobs:
+  cancel:
+    if: >-
+      github.event.ref_type == 'branch' &&
+      startsWith(github.event.ref, 'gh-readonly-queue/')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: write
+      contents: read
+    steps:
+      # SECURITY: never check out PR code here, use an inline script.
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const deletedBranch = context.payload.ref;
+            const delay = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+            // Target branch names may contain slashes. Refuse unfamiliar queue ref formats.
+            const targetBranch = /^gh-readonly-queue\/(.+)\/pr-\d+-[0-9a-f]{40}$/.exec(deletedBranch)?.[1];
+            if (!targetBranch) {
+              core.setFailed(`Cannot determine the target branch for ${deletedBranch}; skipping cleanup.`);
+              return;
+            }
+
+            // Collect unfinished merge-group workflow runs for this deleted branch.
+            const candidateRuns = await findUnfinishedMergeGroupRuns(deletedBranch);
+            for (const run of candidateRuns) {
+              try {
+                const outcome = await cancelObsoleteRun(run);
+
+                // The branch may have been requeued and its runs may be needed again.
+                if (outcome === 'branch-recreated') return;
+              } catch (error) {
+                core.setFailed(`Could not clean up run ${run.id}: ${error.message}`);
+              }
+            }
+
+            async function findUnfinishedMergeGroupRuns(branch) {
+              const runs = new Map();
+              let discoveryError;
+
+              // Poll three times to reduce the impact of stale API results.
+              // Known defect: all three scans can omit unfinished runs, potentially missing
+              // the entire group. Cleanup can then report success without cancelling them.
+              // There is no automatic follow-up cleanup, so missed runs can continue
+              // consuming runner capacity.
+              // TODO(2026-10-01): Remove when resolved: https://github.com/orgs/community/discussions/206725
+              for (let scan = 0; scan < 3; scan++) {
+                if (scan > 0) await delay(10000);
+                try {
+                  const discovered = await github.paginate(github.rest.actions.listWorkflowRunsForRepo, {
+                    ...context.repo, branch, event: 'merge_group', per_page: 100,
+                  });
+                  for (const run of discovered) {
+                    if (run.event === 'merge_group' && run.head_branch === branch && run.status !== 'completed') {
+                      runs.set(run.id, run);
+                    }
+                  }
+                  discoveryError = undefined;
+                } catch (error) {
+                  discoveryError = error;
+                  core.warning(`Discovery failed: ${error.message}`);
+                }
+              }
+              if (discoveryError) core.setFailed(`Could not finish discovering runs: ${discoveryError.message}`);
+              return runs.values();
+            }
+
+            async function getCancellationStatus(runId) {
+              const { data: run } = await github.rest.actions.getWorkflowRun({ ...context.repo, run_id: runId });
+              if (run.status === 'completed' || run.run_attempt !== 1) return 'ineligible';
+
+              try {
+                await github.rest.git.getRef({ ...context.repo, ref: `heads/${deletedBranch}` });
+                core.info('Skipping cleanup: the queue branch exists again.');
+                return 'branch-recreated';
+              } catch (error) {
+                if (error.status !== 404) throw error;
+              }
+
+              // The target may have advanced since merging, so check ancestry, not just its tip.
+              // Comparison errors must prevent cancellation; a missing queue ref alone is insufficient.
+              const { data: comparison } = await github.rest.repos.compareCommitsWithBasehead({
+                ...context.repo, basehead: `${run.head_sha}...refs/heads/${targetBranch}`, per_page: 1,
+              });
+              if (comparison.status === 'ahead' || comparison.status === 'identical') {
+                core.info(`Skipping ${run.id}: its commit is already on ${targetBranch}.`);
+                return 'merged';
+              }
+              if (comparison.status !== 'behind' && comparison.status !== 'diverged') {
+                throw new Error(`Unexpected comparison status: ${comparison.status}`);
+              }
+              return 'eligible';
+            }
+
+            async function cancelObsoleteRun(run) {
+              let lastError;
+              for (let attempt = 1; attempt <= 3; attempt++) {
+                try {
+                  // Recheck completion, reruns, branch recreation, and merging before each cancellation.
+                  const status = await getCancellationStatus(run.id);
+                  if (status !== 'eligible') return status;
+
+                  core.info(`Cancelling ${run.id}: ${run.name}`);
+                  await github.rest.actions.cancelWorkflowRun({ ...context.repo, run_id: run.id });
+                  return;
+                } catch (error) {
+                  // 409 Conflict => the run could be retried, in which case we skip this run.
+                  const retryable = error.status == null || error.status === 409 || (error.status >= 500 && error.status < 600);
+                  if (!retryable) throw error;
+                  lastError = error;
+                  core.warning(`Run ${run.id}: ${error.message}; rechecking in 5 seconds.`);
+                }
+                await delay(5000);
+              }
+
+              // The run may have finished, been retried, merged, or its branch been recreated.
+              // Recheck once more; if still eligible, report the error without a fourth request.
+              const status = await getCancellationStatus(run.id);
+              if (status === 'eligible') throw lastError;
+              return status;
+            }

.github/workflows/codeql.yml

@@ -72,7 +72,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -86,7 +86,7 @@ jobs:
     # AnkiDroid requires JDK21+ to build, current runners default to 17
     - name: Configure JDK
       if: matrix.language == 'java-kotlin'
-      uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+      uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
       with:
         distribution: "jetbrains"
         java-version: "21"  # also change jitpack.yml
@@ -108,6 +108,6 @@ jobs:
         ./gradlew --stop
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/compare_apk_size.yml

@@ -30,7 +30,7 @@ jobs:
       KEYALIAS: nrkeystorealias
     steps:
       - name: Configure JDK
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: "jetbrains"
           java-version: "21"
@@ -51,7 +51,7 @@ jobs:
           ref: 'refs/pull/${{ github.event.inputs.prNumber }}/head'
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
         timeout-minutes: 5
         with:
           # Use open source provider: https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#basic-caching

.github/workflows/lint.yml

@@ -29,15 +29,15 @@ jobs:
           fetch-depth: 2
 
       - name: Configure JDK
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: "jetbrains"
           java-version: "21"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
         timeout-minutes: 5
         with:
           # Use open source provider: https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#basic-caching
@@ -88,7 +88,7 @@ jobs:
       - name: Prettify AnkiDroid javascript code
         uses: creyD/prettier_action@8c18391fdc98ed0d884c6345f03975edac71b8f0 # v4.6
         with:
-          prettier_options: --check AnkiDroid/**/*.js
+          prettier_options: --check AnkiDroid/**/*.js .github/check_alpha_release.js
           dry: True
 
       - name: Install Localization