size-analysis.yml

name: SDK Size Analysis

on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened, labeled]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  ready-to-merge-gate:
    name: Ready-to-merge gate
    uses: ./.github/workflows/ready-to-merge-workflow.yml

  files-changed:
    name: Detect File Changes
    runs-on: ubuntu-latest
    needs: ready-to-merge-gate
    outputs:
      run_size_analysis_for_prs: ${{ steps.changes.outputs.run_size_analysis_for_prs }}
      is_dependabot: ${{ github.actor == 'dependabot[bot]' }}
      is_fork: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
      - name: Get changed files
        id: changes
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        with:
          token: ${{ github.token }}
          filters: .github/file-filters.yml

  skip-size-analysis-for-non-contributors:
    name: Skip Size Analysis for Non-Contributors
    runs-on: ubuntu-latest
    needs: files-changed
    # Skip for non-contributors or fork PRs, but not for dependabot (handled in build)
    if: |
      github.event_name == 'pull_request' &&
      needs.files-changed.outputs.run_size_analysis_for_prs == 'true' &&
      (
        !contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR", "CONTRIBUTOR"]'), github.event.pull_request.author_association) ||
        needs.files-changed.outputs.is_fork == 'true'
      ) &&
      needs.files-changed.outputs.is_dependabot == 'false'
    steps:
      - name: Skip Size Analysis for Non-Contributors
        run: |
          echo "Skipping size analysis for non-contributors"
          exit 0

  build:
    name: Build and Analyze SDK Size
    runs-on: macos-26
    # Run for PRs with related changes (including dependabot) or non-PR events.
    if: |
      github.event_name != 'pull_request' || (
        needs.files-changed.outputs.run_size_analysis_for_prs == 'true' &&
        needs.files-changed.outputs.is_fork != 'true' && (
          contains(
          fromJson('["OWNER", "MEMBER", "COLLABORATOR", "CONTRIBUTOR"]'),
          github.event.pull_request.author_association
        ) ||
        needs.files-changed.outputs.is_dependabot == 'true')
      )
    needs: files-changed
    timeout-minutes: 20
    steps:
      - name: Checkout Repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
      - name: Setup Xcode
        uses: ./.github/actions/setup-xcode
        with:
          version: "26"

      - name: Setup Ruby
        uses: ruby/setup-ruby@89f90524b88a01fe6e0b732220432cc6142926af # v1.313.0
        with:
          bundler-cache: true

      - run: make init-ci-build

      # This needs to be done before xcode-ci because it makes the Sentry framework to be static.
      # Or Xcode will try to embed an empty framework.
      - name: Make Sentry Static
        run: |
          echo "MACH_O_TYPE = staticlib" >> Sources/Configuration/Sentry.xcconfig

      - run: make xcode-ci

      # When running the workflows for dependabot PRs, we need to skip code signing, because the code signing secrets are not available for dependabot PRs.
      # We still want to run as much of the full workflow as possible, to verify the behaviour.
      - name: Build and Upload for Size Analysis
        run: |
          bundle exec fastlane build_ios_for_size_analysis \
            skip_codesigning:${{ needs.files-changed.outputs.is_dependabot == 'true' }}
        env:
          FASTLANE_BUNDLE_VERSION: ${{ github.run_number }}
          FASTLANE_KEYCHAIN_PASSWORD: ${{ secrets.FASTLANE_KEYCHAIN_PASSWORD }}
          MATCH_GIT_PRIVATE_KEY: ${{ secrets.MATCH_GIT_PRIVATE_KEY }}
          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
          MATCH_USERNAME: ${{ secrets.MATCH_USERNAME }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}

      - name: Run CI Diagnostics
        uses: ./.github/actions/ci-diagnostics
        if: failure()

  build-required-check:
    needs:
      [
        ready-to-merge-gate,
        files-changed,
        build,
        skip-size-analysis-for-non-contributors,
      ]
    name: Size Analysis
    # This is necessary since a failed/skipped dependent job would cause this job to be skipped
    if: always()
    runs-on: ubuntu-latest
    steps:
      # If any jobs we depend on fails gets cancelled or times out, this job will fail.
      # Skipped jobs are not considered failures.
      - name: Check for failures
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: |
          echo "One of the size analysis jobs has failed." && exit 1