Merge branch 'main_upstream' into search_fix

# Conflicts:
#	android/src/main/java/com/tailscale/ipn/ui/view/SearchView.kt

Author: Pawloland

.github/workflows/integration-test.yml

@@ -0,0 +1,32 @@
+name: Integration Test
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [labeled, synchronize, reopened]
+
+jobs:
+  integration-test:
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'run-integration-test'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Enable KVM
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+          ls -l /dev/kvm
+
+      - name: Run integration test
+        run: make android-integration-test

.gitignore

@@ -26,11 +26,14 @@ android/local.properties
 tailscale.jks
 
 # android sdk dir
-./android-sdk
+/android-sdk/
 
 # Persistent $HOME/.android for `make docker-*` (keeps debug.keystore so
 # the debug signer is stable across container runs).
 .android-docker
+.android-integration-docker
+.cache-docker
+.gradle-docker
 
 # Java profiling output
 *.hprof
@@ -51,3 +54,6 @@ libtailscale-sources.jar
 .DS_Store
 
 tailscale.version
+
+# local tmp folder
+.tmp/

Makefile

@@ -10,7 +10,14 @@
 # with this name, it will be used.
 #
 # The convention here is tailscale-android-build-amd64-<date>
-DOCKER_IMAGE := tailscale-android-build-amd64-041425-1
+DOCKER_IMAGE := tailscale-android-build-amd64-072226-3
+
+# The integration test image contains the Android emulator, system image, SDK,
+# build-tools, NDK, adb, and helper tools needed to run the emulator-backed Go
+# integration tests. Bump this tag when docker/Dockerfile.android-integration
+# or the required tool versions change, using:
+# tailscale-android-integration-amd64-YYYYMMDD-N
+ANDROID_INTEGRATION_DOCKER_IMAGE := tailscale-android-integration-amd64-20260609-1
 export TS_USE_TOOLCHAIN=1
 
 # If set, additional comma-separated build tags passed to the libtailscale Go
@@ -20,6 +27,15 @@ export TS_USE_TOOLCHAIN=1
 # affordances for debugging it.
 GOMOBILE_BUILD_TAGS := ts_omit_cachenetmap
 
+# Pull androidApiLevel from gradle.properties.
+ANDROID_API_LEVEL := $(shell grep '^androidApiLevel=' android/gradle.properties | cut -d'=' -f2)
+
+ifeq ($(ANDROID_API_LEVEL),)
+$(error androidApiLevel missing from android/gradle.properties)
+endif
+
+ANDROID_BUILD_TOOLS_VERSION := $(shell grep '^androidBuildToolsVersion=' android/gradle.properties | cut -d'=' -f2)
+
 DEBUG_APK := tailscale-debug.apk
 RELEASE_AAB := tailscale-release.aab
 RELEASE_TV_AAB := tailscale-tv-release.aab
@@ -40,7 +56,7 @@ else
     ANDROID_TOOLS_URL := "https://dl.google.com/android/repository/commandlinetools-mac-9477386_latest.zip"
     ANDROID_TOOLS_SUM := "2072ffce4f54cdc0e6d2074d2f381e7e579b7d63e915c220b96a7db95b2900ee  commandlinetools-mac-9477386_latest.zip"
 endif
-ANDROID_SDK_PACKAGES := 'platforms;android-34' 'extras;android;m2repository' 'ndk;23.1.7779620' 'platform-tools' 'build-tools;34.0.0'
+ANDROID_SDK_PACKAGES := 'platforms;android-$(ANDROID_API_LEVEL)' 'extras;android;m2repository' 'ndk;23.1.7779620' 'platform-tools' 'build-tools;$(ANDROID_BUILD_TOOLS_VERSION)'
 
 # Attempt to find an ANDROID_SDK_ROOT / ANDROID_HOME based either from
 # preexisting environment or common locations.
@@ -84,7 +100,7 @@ else
     export PATH := $(JAVA_HOME)/bin:$(PATH)
 endif
 
-AVD_BASE_IMAGE := "system-images;android-33;google_apis;"
+AVD_BASE_IMAGE := 'system-images;android-$(ANDROID_API_LEVEL);google_apis;'
 export HOST_ARCH := $(shell uname -m)
 ifeq ($(HOST_ARCH),aarch64)
     AVD_IMAGE := "$(AVD_BASE_IMAGE)arm64-v8a"
@@ -142,23 +158,35 @@ release-tv: jarsign-env $(RELEASE_TV_AAB)
 
 # gradle-dependencies groups together the android sources and libtailscale needed to assemble tests/debug/release builds.
 .PHONY: gradle-dependencies
-gradle-dependencies: $(shell find android -type f -not -path "android/build/*" -not -path '*/.*') $(LIBTAILSCALE_AAR) tailscale.version
+gradle-dependencies: $(shell find android -type f -not -path "android/build/*" -not -path "android/libs/*" -not -path '*/.*') $(LIBTAILSCALE_AAR) tailscale.version
 
 $(RELEASE_AAB): version gradle-dependencies
 	@echo "Building release AAB"
 	(cd android && ./gradlew test bundleRelease)
 	install -C ./android/build/outputs/bundle/release/android-release.aab $@
 
+# PLATFORM=tv signals to gradle that we should build for AndroidTV. To
+# distinguish the TV variant from the phone/tablet build in the Play Store,
+# we temporarily increment the versionCode in android/build.gradle by 1 for
+# the duration of the build, then restore the original value via a shell trap
+# so the working tree is left clean even if the gradle build fails.
 $(RELEASE_TV_AAB): version gradle-dependencies
 	@echo "Building TV release AAB"
-	(cd android && ./gradlew test bundleRelease_tv)
-	install -C ./android/build/outputs/bundle/release_tv/android-release_tv.aab $@
+	@set -e; \
+		ORIG_VC=$$(grep -oE 'versionCode [0-9]+' android/build.gradle | awk '{print $$2}'); \
+		TV_VC=$$((ORIG_VC + 1)); \
+		echo "TV versionCode: $$ORIG_VC -> $$TV_VC"; \
+		trap "sed -i.bak -E 's/versionCode [0-9]+/versionCode $$ORIG_VC/' android/build.gradle && rm -f android/build.gradle.bak" EXIT INT TERM HUP; \
+		sed -i.bak -E "s/versionCode [0-9]+/versionCode $$TV_VC/" android/build.gradle; \
+		rm -f android/build.gradle.bak; \
+		(cd android && ./gradlew test bundleRelease -PPLATFORM=tv)
+	install -C ./android/build/outputs/bundle/release/android-release.aab $@
 
 tailscale-test.apk: version gradle-dependencies
 	(cd android && ./gradlew assembleApplicationTestAndroidTest)
 	install -C ./android/build/outputs/apk/androidTest/applicationTest/android-applicationTest-androidTest.apk $@
 
-tailscale.version: go.mod go.sum $(wildcard .git/HEAD)
+tailscale.version: go.mod go.sum go.toolchain.rev $(wildcard .git/HEAD)
 	@bash -c "./tool/go run tailscale.com/cmd/mkversion > tailscale.version"
 
 .PHONY: version
@@ -175,10 +203,10 @@ android/libs:
 $(GOBIN):
 	mkdir -p $(GOBIN)
 
-$(GOBIN)/gomobile: $(GOBIN)/gobind go.mod go.sum | $(GOBIN)
+$(GOBIN)/gomobile: $(GOBIN)/gobind go.mod go.sum go.toolchain.rev | $(GOBIN)
 	./tool/go install golang.org/x/mobile/cmd/gomobile
 
-$(GOBIN)/gobind: go.mod go.sum
+$(GOBIN)/gobind: go.mod go.sum go.toolchain.rev
 	./tool/go install golang.org/x/mobile/cmd/gobind
 
 .PHONY: build-unstripped-aar
@@ -271,17 +299,26 @@ androidpath:
 	@echo 'export PATH=$(ANDROID_HOME)/cmdline-tools/latest/bin:$(ANDROID_HOME)/platform-tools:$$PATH'
 
 .PHONY: tag_release
-tag_release: debug-symbols tailscale.version ## Tag the current commit with the current version
-	source tailscale.version && git tag -a "$${VERSION_LONG}" -m "OSS and Version updated to $${VERSION_LONG}"
+tag_release: tailscale.version bump-version-code ## Tag the current commit with the current version
+	@if ! git diff --quiet -- android/build.gradle; then \
+		source tailscale.version && git commit -sm "android: bump versionCode for $${VERSION_LONG}" android/build.gradle; \
+	fi
+	source tailscale.version && git tag -a "$${VERSION_LONG}" -m "Version updated to $${VERSION_LONG}"
 
 .PHONY: bumposs ## Bump to the latest oss and update the versions.
-bumposs: update-oss tailscale.version
+bumposs: update-oss tailscale.version bump-version-code
 	source tailscale.version && git commit -sm "android: bump OSS" -m "OSS and Version updated to $${VERSION_LONG}" go.toolchain.rev android/build.gradle go.mod go.sum
 	source tailscale.version && git tag -a "$${VERSION_LONG}" -m "OSS and Version updated to $${VERSION_LONG}"
 
-.PHONY: bump_version_code ## Bump the version code in build.gradle
-bump_version_code:
-	sed -i'.bak' "s/versionCode .*/versionCode $$(expr $$(awk '/versionCode ([0-9]+)/{print $$2}' android/build.gradle) + 1)/" android/build.gradle && rm android/build.gradle.bak
+# Recomputes the base versionCode from tailscale.version and rewrites the
+# `versionCode <n>` line in android/build.gradled
+.PHONY: bump-version-code
+bump-version-code: tailscale.version
+	@source tailscale.version && \
+		BASE_VERSION_CODE=$$((VERSION_MAJOR * 100000000 + VERSION_MINOR * 100000 + VERSION_PATCH * 10)) && \
+		echo "Setting android/build.gradle versionCode to $$BASE_VERSION_CODE" && \
+		sed -i.bak -E "s/versionCode [0-9]+/versionCode $$BASE_VERSION_CODE/" android/build.gradle && \
+		rm android/build.gradle.bak
 
 .PHONY: update-oss ## Update the tailscale.com go module
 update-oss:
@@ -365,6 +402,14 @@ docker-build-image: ## Builds the docker image for the android build environment
 		docker build -f docker/DockerFile.amd64-build -t $(DOCKER_IMAGE) .; \
 	fi
 
+.PHONY: docker-build-android-integration-image
+docker-build-android-integration-image: ## Build the Docker image used to run Android integration tests
+	@echo "Checking if docker image $(ANDROID_INTEGRATION_DOCKER_IMAGE) already exists..."
+	@if ! docker images $(ANDROID_INTEGRATION_DOCKER_IMAGE) -q | grep -q . ; then \
+		echo "Image does not exist. Building..."; \
+		docker build -f docker/Dockerfile.android-integration -t $(ANDROID_INTEGRATION_DOCKER_IMAGE) .; \
+	fi
+
 # DOCKER_ANDROID_DIR is bind-mounted as /root/.android inside the container
 # so the Gradle-generated debug keystore (and anything else under ~/.android)
 # persists across docker runs. Without this, every docker-based debug build
@@ -373,12 +418,19 @@ docker-build-image: ## Builds the docker image for the android build environment
 # JVM's user.home resolves to /root for the container's root user, regardless
 # of the Dockerfile's HOME=/build env.
 DOCKER_ANDROID_DIR := $(CURDIR)/.android-docker
+DOCKER_ANDROID_INTEGRATION_DIR := $(CURDIR)/.android-integration-docker
+DOCKER_GRADLE_DIR := $(CURDIR)/.gradle-docker
+DOCKER_GO_CACHE_DIR := $(CURDIR)/.cache-docker
 
 .PHONY: docker-android-dir
 docker-android-dir:
-	@mkdir -p $(DOCKER_ANDROID_DIR)
+	@mkdir -p $(DOCKER_ANDROID_DIR) $(DOCKER_GRADLE_DIR) $(DOCKER_GO_CACHE_DIR)
+
+.PHONY: docker-android-integration-dir
+docker-android-integration-dir:
+	@mkdir -p $(DOCKER_ANDROID_INTEGRATION_DIR) $(DOCKER_GO_CACHE_DIR)
 
-DOCKER_RUN_VOLS := -v $(CURDIR):/build/tailscale-android -v $(DOCKER_ANDROID_DIR):/root/.android
+DOCKER_RUN_VOLS := -v $(CURDIR):/build/tailscale-android -v $(DOCKER_ANDROID_DIR):/root/.android -v $(DOCKER_GRADLE_DIR):/build/.gradle -v $(DOCKER_GO_CACHE_DIR):/build/.cache --env GOPATH=/build/.cache/go --env GOMODCACHE=/build/.cache/go/pkg/mod
 
 .PHONY: docker-run-build
 docker-run-build: clean jarsign-env docker-build-image docker-android-dir ## Runs the docker image for the android build environment and builds release
@@ -388,6 +440,21 @@ docker-run-build: clean jarsign-env docker-build-image docker-android-dir ## Run
 docker-tailscale-debug: docker-build-image docker-android-dir ## Build tailscale-debug.apk inside the docker env (stable signer across runs)
 	@docker run --rm $(DOCKER_RUN_VOLS) $(DOCKER_IMAGE) make tailscale-debug
 
+.PHONY: android-integration-test
+android-integration-test: docker-tailscale-debug android-integration-test-run ## Build APK and run adb-backed Android integration tests in Docker
+
+.PHONY: android-integration-test-run
+android-integration-test-run: docker-build-android-integration-image docker-android-integration-dir ## Run adb-backed Android integration tests in Docker using existing APK
+	@docker run --rm --device /dev/kvm \
+		-v $(CURDIR):/workspace \
+		-v $(DOCKER_ANDROID_INTEGRATION_DIR):/root/.android \
+		-v $(DOCKER_GO_CACHE_DIR):/root/.cache \
+		--env GOPATH=/root/.cache/go \
+		--env GOMODCACHE=/root/.cache/go/pkg/mod \
+		-w /workspace \
+		$(ANDROID_INTEGRATION_DOCKER_IMAGE) \
+		/usr/local/bin/run-android-integration-test /workspace/$(DEBUG_APK)
+
 .PHONY: docker-remove-build-image
 docker-remove-build-image: ## Removes the current docker build image
 	docker rmi --force $(DOCKER_IMAGE)

README.md

@@ -92,6 +92,37 @@ alias nix='nix --extra-experimental-features "nix-command flakes"'
 nix develop
 ```
 
+The flake provides host tools such as Java, `make`, `curl`, and `git`, and
+points the build at a repo-local Android SDK in `./android-sdk`. The SDK
+directory is ignored by Git and is reused across builds.
+
+On first use, install the Android SDK components:
+
+```sh
+make androidsdk
+```
+
+Then build normally:
+
+```sh
+make tailscale-debug
+```
+
+The debug APK is written to `./tailscale-debug.apk`.
+
+For one-shot commands without entering an interactive shell:
+
+```sh
+nix develop --command make androidsdk
+nix develop --command make tailscale-debug
+```
+
+For faster Kotlin-only iteration while avoiding the `gomobile bind` step:
+
+```sh
+nix develop --command bash -lc 'cd android && ./gradlew ktfmtCheck compileDebugKotlin'
+```
+
 ## Building
 
 ```sh

android/build.gradle

@@ -11,7 +11,7 @@ buildscript {
         }
     }
     dependencies {
-        classpath 'com.android.tools.build:gradle:8.6.1'
+        classpath 'com.android.tools.build:gradle:8.13.0'
         classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
         classpath "org.jetbrains.kotlin:kotlin-serialization:$kotlin_version"
         classpath("com.ncorti.ktfmt.gradle:plugin:0.17.0")
@@ -32,12 +32,18 @@ apply plugin: 'org.jetbrains.kotlin.plugin.serialization'
 apply plugin: 'com.ncorti.ktfmt.gradle'
 
 android {
+    def androidApiLevel = providers.gradleProperty("androidApiLevel").get().toInteger()
+
     ndkVersion "23.1.7779620"
-    compileSdkVersion 34
+    compileSdkVersion androidApiLevel
     defaultConfig {
         minSdkVersion 26
-        targetSdkVersion 35
-        versionCode 468
+        targetSdkVersion androidApiLevel
+        // versionCode is written here by `make bumposs` / `make tag_release`
+        // (base = major*100000000 + minor*100000 + patch*10). AndroidTV builds
+        // increment this by 1 in the Makefile's release-tv target so the two
+        // variants are distinguishable in the Play Store.
+        versionCode 110102910
         versionName getVersionProperty("VERSION_LONG")
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
 
@@ -79,16 +85,16 @@ android {
     buildTypes {
         applicationTest {
             initWith debug
-            manifestPlaceholders.leanbackRequired = false
+            manifestPlaceholders.leanbackRequired = isTV()
             buildConfigField "String", "GITHUB_USERNAME", "\"" + getLocalProperty("githubUsername", "")+"\""
             buildConfigField "String", "GITHUB_PASSWORD", "\"" + getLocalProperty("githubPassword", "")+"\""
             buildConfigField "String", "GITHUB_2FA_SECRET", "\"" + getLocalProperty("github2FASecret", "")+"\""
         }
         debug {
-            manifestPlaceholders.leanbackRequired = false
+            manifestPlaceholders.leanbackRequired = isTV()
         }
         release {
-            manifestPlaceholders.leanbackRequired = false
+            manifestPlaceholders.leanbackRequired = isTV()
 
             minifyEnabled true
 
@@ -98,10 +104,6 @@ android {
                     'proguard-android-optimize.txt'),
                     'proguard-rules.pro'
         }
-        release_tv {
-            initWith release
-            manifestPlaceholders.leanbackRequired = true
-        }
     }
 
     testBuildType "applicationTest"
@@ -114,6 +116,7 @@ dependencies {
     implementation "androidx.browser:browser:1.8.0"
     implementation "androidx.security:security-crypto:1.1.0-alpha06"
     implementation "androidx.work:work-runtime:2.9.1"
+    implementation "androidx.work:work-runtime-ktx:2.9.1"
 
     // Kotlin dependencies.
     implementation "org.jetbrains.kotlinx:kotlinx-serialization-json:1.6.3"
@@ -170,6 +173,7 @@ dependencies {
     testImplementation 'org.mockito:mockito-core:5.12.0'
     testImplementation 'org.mockito:mockito-inline:5.2.0'
     testImplementation 'org.mockito.kotlin:mockito-kotlin:5.4.0'
+    testImplementation 'org.jetbrains.kotlinx:kotlinx-coroutines-test:1.8.1'
 
     debugImplementation("androidx.compose.ui:ui-tooling")
     implementation("androidx.compose.ui:ui-tooling-preview")
@@ -194,3 +198,7 @@ def getVersionProperty(key) {
     versionProps.load(project.file('../tailscale.version').newDataInputStream())
     return versionProps.getProperty(key).replaceAll('^\"|\"$', '')
 }
+
+def isTV() {
+    return project.findProperty('PLATFORM')?.toString() == 'tv'
+}

android/gradle.properties

@@ -1,3 +1,5 @@
+androidApiLevel=36
+androidBuildToolsVersion=36.0.0
 android.defaults.buildfeatures.buildconfig=true
 android.nonFinalResIds=false
 android.nonTransitiveRClass=true

android/gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=544c35d6bd849ae8a5ed0bcea39ba677dc40f49df7d1835561582da2009b961d
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.7-bin.zip
+distributionSha256Sum=20f1b1176237254a6fc204d8434196fa11a4cfb387567519c61556e8710aed78
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.13-bin.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists