# CI/CD Workflows

We use **GitHub Actions** for automated testing, code quality, and deployment.

## Primary Workflows

### 1. Continuous Integration (`ci.yml`)

Runs on every Pull Request to `main` and `develop`.

* **Check**: Unit tests and Linting.
* **Build**: Assembles debug APKs.
* **Permissions**: Strictly controlled via `permissions` blocks.

### 2. Pro Backend Deployment (`deploy-pro-backend.yml`)

Deploys the premium Cloudflare Worker.

* Triggers on changes to `pro-backend/`.
* Uses environment-scoped secrets (Staging/Production).

### 3. Community Relay Deployment (`deploy-community-relay.yml`)

Deploys the lightweight self-hosted relay code.

* Triggers on changes to `notification-relay/`.

## Quality Gates

* **SonarCloud (`sonarqube.yml`)**: Static analysis and code coverage reporting.
* **Dependabot**: Automated dependency vulnerability scanning and updates.

## Required Secrets

To run deployments, the following Repository Secrets must be set:

* `CLOUDFLARE_API_TOKEN_PROD`
* `CLOUDFLARE_ACCOUNT_ID`
* `GOOGLE_APPLICATION_CREDENTIALS_JSON_PROD`