[Bug] CI builds omit shared sample files and publish default app templates for multiple Android and iOS demos
Location
.github/workflows/build-android-demos.yml
Context
Demo documentation can reference files from other demos, but the Android build workflow copies files located inside the demo being built. This mismatch can produce a successful build containing the default template instead of the documented sample.
For example, MASTG-DEMO-0088 reuses the code sample from MASTG-DEMO-0087:
{{ ../MASTG-DEMO-0087/MastgTest.kt }}However, its directory contains neither MastgTest.kt nor AndroidManifest.xml. The workflow does not resolve the shared files, retains the base app files, and publishes the resulting APK as MASTG-DEMO-0088.apk.
The CI job logs confirm this:
No MastgTest.kt found for demos/android/MASVS-RESILIENCE/MASTG-DEMO-0088
No AndroidManifest.xml found for demos/android/MASVS-RESILIENCE/MASTG-DEMO-0088
> Task :app:compileDebugKotlin UP-TO-DATE
BUILD SUCCESSFULSteps to Reproduce
- Download MASTG-DEMO-0088.apk from the linked workflow run.
- Install and launch the app.
- Run the sample using the Start button.
The app displays the default template results instead of running the root detection checks documented in MASTG-DEMO-0088.
Other Demos with the Same Build-Input Gap
Repository inspection at dd8bc103ed054daa37f37e861ed9f36d63bbea40 identified 26 additional demos whose documented sample references build inputs outside the demo directory. Those inputs are absent locally, and the current APK/IPA workflows do not copy them from the referenced location.
This concerns APK/IPA builds, not Markdown rendering. These additional artifacts have not been individually downloaded or executed. The findings below are based on source-file and workflow inspection; the CI-log evidence above concerns MASTG-DEMO-0088.
The table lists explicitly referenced build inputs missing from each demo directory. It is not a complete inventory of every file needed to build each sample.
| Platform | Demo | References Files From | Referenced Build Inputs Missing Locally |
|---|---|---|---|
| Android | MASTG-DEMO-0034 | MASTG-DEMO-0020 | AndroidManifest.xml, MastgTest.kt, backup_rules.xml |
| Android | MASTG-DEMO-0035 | MASTG-DEMO-0020 | AndroidManifest.xml, MastgTest.kt, backup_rules.xml |
| Android | MASTG-DEMO-0038 | MASTG-DEMO-0037 | MastgTest.kt |
| Android | MASTG-DEMO-0039 | MASTG-DEMO-0037 | MastgTest.kt |
| Android | MASTG-DEMO-0072 | MASTG-DEMO-0071 | MastgTest.kt |
| Android | MASTG-DEMO-0091 | MASTG-DEMO-0090 | MastgTest.kt |
| Android | MASTG-DEMO-0092 | MASTG-DEMO-0090 | MastgTest.kt |
| Android | MASTG-DEMO-0093 | MASTG-DEMO-0090 | MastgTest.kt |
| Android | MASTG-DEMO-0108 | MASTG-DEMO-0107 | MastgTest.kt |
| Android | MASTG-DEMO-0120 | MASTG-DEMO-0121 | AndroidManifest.xml, MastgTest.kt |
| Android | MASTG-DEMO-0138 | MASTG-DEMO-0136 | MastgTest.kt |
| Android | MASTG-DEMO-0158 | MASTG-DEMO-0157 | AndroidManifest.xml, MastgTestWebView.kt |
| iOS | MASTG-DEMO-0042 | MASTG-DEMO-0041 | MastgTest.swift |
| iOS | MASTG-DEMO-0044 | MASTG-DEMO-0043 | MastgTest.swift |
| iOS | MASTG-DEMO-0046 | MASTG-DEMO-0045 | MastgTest.swift |
| iOS | MASTG-DEMO-0066 | MASTG-DEMO-0065 | MastgTest.swift |
| iOS | MASTG-DEMO-0074 | MASTG-DEMO-0073 | MastgTest.swift |
| iOS | MASTG-DEMO-0077 | MASTG-DEMO-0076 | MastgTest.swift |
| iOS | MASTG-DEMO-0084 | MASTG-DEMO-0083 | MastgTest.swift |
| iOS | MASTG-DEMO-0096 | MASTG-DEMO-0095 | MastgTest.swift |
| iOS | MASTG-DEMO-0099 | MASTG-DEMO-0098 | MastgTest.swift |
| iOS | MASTG-DEMO-0113 | MASTG-DEMO-0112 | MastgTest.swift |
| iOS | MASTG-DEMO-0119 | MASTG-DEMO-0118 | MastgTest.swift |
| iOS | MASTG-DEMO-0125 | MASTG-DEMO-0124 | MastgTest.swift |
| iOS | MASTG-DEMO-0127 | MASTG-DEMO-0126 | Info.plist, MASTestApp.entitlements, MastgTest.swift |
| iOS | MASTG-DEMO-0143 | MASTG-DEMO-0142 | MastgTest.swift |
Source: OWASP/mastg