chore: Add CI workflows for building and running the example app (#13)

# Add CI workflows for building and running the example app

## Summary

Adds two GitHub Actions workflows to the `hello-android` project:

- **`build.yml`** — Builds the debug APK using Gradle on ubuntu-22.04
with Java 17 (Temurin).
- **`run.yml`** — Fetches the LaunchDarkly mobile key and flag key from
AWS SSM, injects them into the source, builds the debug APK, launches it
on an Android emulator (API 29, x86_64), and validates that the UI
displays "feature flag evaluates to true".

Both workflows trigger on pushes and PRs to `main`, ignoring
markdown-only changes.

All actions are pinned to full SHAs with inline version comments and a
reference link to the release page above each `uses:` line.

### Action versions used

| Action | Version | SHA | Reference |
|---|---|---|---|
| `actions/checkout` | v4.2.2 |
`11bd71901bbe5b1630ceea73d27597364c9af683` |
[release](https://github.com/actions/checkout/releases/tag/v4.2.2) |
| `actions/setup-java` | v4.7.1 |
`c5195efecf7bdfc987ee8bae7a71cb8b11521c00` |
[release](https://github.com/actions/setup-java/releases/tag/v4.7.1) |
| `launchdarkly/gh-actions/actions/release-secrets` |
release-secrets-v1.2.0 | `bbbbbda684f500766264e7fe327668094ba83d1c` |
[release](https://github.com/launchdarkly/gh-actions/releases/tag/release-secrets-v1.2.0)
|
| `jlumbroso/free-disk-space` | v1.3.1 |
`54081f138730dfa15788a46383842cd2f914a1be` |
[release](https://github.com/jlumbroso/free-disk-space/releases/tag/v1.3.1)
|
| `reactivecircus/android-emulator-runner` | v2.34.0 |
`324029e2f414c084d8b15ba075288885e74aef9c` |
[release](https://github.com/reactivecircus/android-emulator-runner/releases/tag/v2.34.0)
|

## Review & Testing Checklist for Human

- [ ] **Verify SHA pins**: Confirm each SHA in the table above matches
the stated version tag on the corresponding GitHub action repository.
- [ ] **Verify `AWS_ROLE_ARN` repository variable**: The run workflow
requires `vars.AWS_ROLE_ARN` to be configured for the OIDC-based AWS
credentials flow. Confirm this variable is set in the repo settings.
- [ ] **`sed` injection robustness**: The mobile key is injected via
`sed -i
"s/mobile-key-from-launch-darkly-website/$LAUNCHDARKLY_MOBILE_KEY/"`. If
the mobile key contains `/` or other sed-special characters, this will
break. Verify the key format is safe, or consider switching to a
different delimiter.
- [ ] **`uiautomator dump` reliability**: The evaluation validation uses
`adb exec-out uiautomator dump /dev/tty` to capture UI text. Verify this
reliably captures the flag evaluation text on the emulator. The
15-second sleep before the dump may need tuning if SDK initialization
takes longer in CI.
- [ ] **Test workflow execution**: Trigger or wait for both workflows to
run and verify they complete successfully end-to-end.

### Notes

- Inspired by the `js-core` repo's
[`react-native-detox.yml`](https://github.com/launchdarkly/js-core/blob/main/.github/workflows/react-native-detox.yml)
workflow.
- SDK key retrieval follows the same `release-secrets` pattern used in
other hello-app repos (e.g. `hello-ruby`).
- The build workflow (`build.yml`) is straightforward and low-risk.
- The run workflow (`run.yml`) uses KVM acceleration for emulator
performance and frees disk space before launching the emulator to avoid
space issues.

---

Link to Devin Session:
https://app.devin.ai/sessions/0b2bb3fc4f5845238a581c78eefd5369
Requested by: rlamb@launchdarkly.com
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/launchdarkly/hello-android/pull/13"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: rlamb@launchdarkly.com <rlamb@launchdarkly.com>

Author: devin-ai-integration[bot]

.github/workflows/build.yml

@@ -0,0 +1,32 @@
+name: Build
+
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    branches: [main]
+    paths-ignore:
+      - '**.md'
+
+jobs:
+  build:
+    runs-on: ubuntu-22.04
+    steps:
+      # https://github.com/actions/checkout/releases/tag/v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      # https://github.com/actions/setup-java/releases/tag/v4.7.1
+      - name: Setup Java
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          distribution: temurin
+          java-version: 17
+          cache: 'gradle'
+
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+
+      - name: Build with Gradle
+        run: ./gradlew assembleDebug

.github/workflows/run.yml

@@ -0,0 +1,76 @@
+name: Run
+
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    branches: [main]
+    paths-ignore:
+      - '**.md'
+
+jobs:
+  run:
+    runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      # https://github.com/actions/checkout/releases/tag/v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      # https://github.com/launchdarkly/gh-actions/releases/tag/release-secrets-v1.2.0
+      - uses: launchdarkly/gh-actions/actions/release-secrets@bbbbbda684f500766264e7fe327668094ba83d1c # release-secrets-v1.2.0
+        name: 'Get mobile key and flag key'
+        with:
+          aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
+          ssm_parameter_pairs: '/sdk/common/hello-apps/mobile-key = LAUNCHDARKLY_MOBILE_KEY,
+            /sdk/common/hello-apps/boolean-flag-key = LAUNCHDARKLY_FLAG_KEY'
+
+      - name: Configure SDK mobile key
+        run: |
+          sed -i "s/mobile-key-from-launch-darkly-website/$LAUNCHDARKLY_MOBILE_KEY/" app/src/main/java/com/launchdarkly/hello_android/MainApplication.kt
+
+      - name: Configure feature flag key
+        run: |
+          sed -i "s/sample-feature/$LAUNCHDARKLY_FLAG_KEY/" app/src/main/java/com/launchdarkly/hello_android/MainActivity.kt
+
+      # https://github.com/actions/setup-java/releases/tag/v4.7.1
+      - name: Setup Java
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          distribution: temurin
+          java-version: 17
+          cache: 'gradle'
+
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+
+      - name: Build debug APK
+        run: ./gradlew assembleDebug
+
+      - name: Enable KVM group perms (for performance)
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+
+      # https://github.com/jlumbroso/free-disk-space/releases/tag/v1.3.1
+      - name: Free disk space
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+        with:
+          android: false
+          large-packages: false
+
+      # https://github.com/reactivecircus/android-emulator-runner/releases/tag/v2.34.0
+      - name: Run on emulator
+        uses: reactivecircus/android-emulator-runner@324029e2f414c084d8b15ba075288885e74aef9c # v2.34.0
+        with:
+          api-level: 29
+          arch: x86_64
+          script: |
+            adb install app/build/outputs/apk/debug/app-debug.apk
+            adb shell am start -n com.launchdarkly.hello_android/.MainActivity
+            sleep 15
+            adb exec-out uiautomator dump /dev/tty | grep -o 'feature flag evaluates to true'