build(gha): check for unused resources in prs

.github/actions/setup-environment/action.yml

@@ -0,0 +1,27 @@
+name: Set up environment
+description: Common environment setup steps for this repository
+
+inputs:
+  jdk:
+    description: Set up JDK
+    required: false
+    default: 'false'
+  gradle:
+    description: Set up Gradle
+    required: false
+    default: 'false'
+
+runs:
+  using: composite
+  steps:
+  - name: Set up JDK
+    if: ${{ inputs.jdk == 'true' || inputs.gradle == 'true }}
+    uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
+    with:
+      java-version-file: '.java-version'
+      distribution: 'temurin'
+      # Using 'temurin' speeds up the job, because this distribution is cached by the runner.
+      # See: https://github.com/actions/setup-java/blob/main/docs/advanced-usage.md#Hosted-Tool-Cache
+  - name: Set up Gradle
+    if: ${{ inputs.gradle == 'true' }}
+    uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4.1.0

.github/workflows/on-pull-request.yml

@@ -1,23 +1,37 @@
 name: PR checks
 
-on: pull_request
+on:
+  pull_request:
+  merge_group:
 
 jobs:
+  android-lint:
+    name: Android Lint
+    runs-on: ubuntu-24.04
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - name: Set up environment
+      uses: ./.github/actions/setup-environment
+      with:
+        gradle: true
+    - name: Decrypt secrets
+      env:
+        GPG_KEY: ${{ secrets.gpg_key }}
+      run: secrets/decrypt.sh
+    - name: Run Android Lint
+      run: scripts/run-android-lint.sh
+
   licenses:
     name: Validate licenses
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout repository
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-    - name: Set up JDK
-      uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
+    - name: Set up environment
+      uses: ./.github/actions/setup-environment
       with:
-        java-version-file: '.java-version'
-        distribution: 'temurin'
-        # Using 'temurin' speeds up the job, because this distribution is cached by the runner.
-        # See: https://github.com/actions/setup-java/blob/main/docs/advanced-usage.md#Hosted-Tool-Cache
-    - name: Set up Gradle
-      uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4.1.0
+        gradle: true
     - name: Decrypt secrets
       env:
         GPG_KEY: ${{ secrets.gpg_key }}

Pocket/build.gradle.kts

@@ -216,8 +216,8 @@ android {
     }
 
     lint {
-        abortOnError = false
         checkReleaseBuilds = false
+        checkDependencies = true
     }
     buildFeatures {
         viewBinding = true

Pocket/src/main/res/values/donottranslate.xml

@@ -1,5 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
-<resources>
+<resources
+    xmlns:tools="http://schemas.android.com/tools"
+    >
     <string name="nm_icon" translatable="false">Pocket</string>
     <string name="nm_app" translatable="false">Pocket</string>
     <string name="alpha_settings" translatable="false">Alpha Settings</string>
@@ -31,5 +33,5 @@
     <string name="gcm_defaultSenderId" translatable="false">638773995762</string>
     <string name="google_app_id" translatable="false">1:638773995762:android:11ffc4bd95a81fa4</string>
     <string name="google_storage_bucket" translatable="false">api-project-638773995762.appspot.com</string>
-    <string name="project_id" translatable="false">api-project-638773995762</string>
+    <string name="project_id" translatable="false" tools:ignore="UnusedResources">api-project-638773995762</string>
 </resources>

Pocket/src/main/res/values/leakcanary.xml

@@ -1,4 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
-<resources>
+<resources
+    xmlns:tools="http://schemas.android.com/tools"
+    tools:ignore="UnusedResources"
+    >
     <bool name="leak_canary_add_launcher_icon">false</bool>
 </resources>

lint.xml

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<lint>
+    <!-- Turn off all checks by default, so we can opt into just the ones we want. -->
+    <issue id="all" severity="ignore" />
+
+    <issue id="UnusedResources" severity="error" />
+</lint>

scripts/run-android-lint.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+# Fail if any commands fails.
+set -e
+
+./gradlew :Pocket:lint