# Builds a signed release APK on every version tag and attaches it to the
# Gitea release, so Obtainium can track updates. See issue #3.
#
# Required repository secrets (Settings → Secrets → Actions):
#   RELEASE_KEYSTORE_BASE64  — base64 of android/mindlist-release.keystore
#   RELEASE_STORE_PASSWORD   — keystore password
#   RELEASE_KEY_ALIAS        — key alias (mindlist)
#   RELEASE_KEY_PASSWORD     — key password
#
# Obtainium: Add App → Gitea → paste the repo URL. If the repo is private,
# enter an access token (account → Settings → Applications → token with
# repo scope) in the Obtainium source settings.

name: Release APK

on:
  push:
    tags:
      - 'v*'

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Setup JDK 21
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - name: Setup Android SDK
        # Manual install: android-actions/setup-android pulls the removed
        # legacy "tools" package and fails on current SDK repositories.
        run: |
          SDK="$HOME/android-sdk"
          mkdir -p "$SDK/cmdline-tools"
          curl -sS -o /tmp/cmdtools.zip https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip
          unzip -q /tmp/cmdtools.zip -d "$SDK/cmdline-tools"
          mv "$SDK/cmdline-tools/cmdline-tools" "$SDK/cmdline-tools/latest"
          export PATH="$SDK/cmdline-tools/latest/bin:$PATH"
          # NB: `yes` dies with SIGPIPE (141) once sdkmanager quits — not a
          # failure under `pipefail`, so neutralize only that code. A real
          # license/install problem still fails loudly below.
          set +o pipefail
          yes | sdkmanager --licenses > /dev/null || true
          set -o pipefail
          sdkmanager "platform-tools" "platforms;android-36" "build-tools;36.0.0"
          echo "ANDROID_HOME=$SDK" >> "$GITHUB_ENV"
          echo "ANDROID_SDK_ROOT=$SDK" >> "$GITHUB_ENV"
          echo "$SDK/cmdline-tools/latest/bin" >> "$GITHUB_PATH"
          echo "$SDK/platform-tools" >> "$GITHUB_PATH"

      - name: Install dependencies
        run: npm ci

      - name: Test
        run: npm test

      - name: Build PWA + sync
        run: |
          npm run build
          npx cap sync android

      - name: Restore release keystore
        env:
          KEYSTORE_BASE64: ${{ secrets.RELEASE_KEYSTORE_BASE64 }}
          STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
        run: |
          test -n "$KEYSTORE_BASE64" || { echo "::error::Missing RELEASE_KEYSTORE_BASE64 secret"; exit 1; }
          echo "$KEYSTORE_BASE64" | base64 -d > android/mindlist-release.keystore
          printf 'storeFile=../mindlist-release.keystore\nstorePassword=%s\nkeyAlias=%s\nkeyPassword=%s\n' \
            "$STORE_PASSWORD" "$KEY_ALIAS" "$KEY_PASSWORD" > android/keystore.properties
          echo "sdk.dir=$ANDROID_HOME" > android/local.properties
          # Self-check: the decoded keystore must match the committed hash
          # (safe to publish: file is password-encrypted) and open with the
          # given alias/password. Fails fast with a clear message otherwise.
          echo "632509e5f1bdda0633736e8bcdc0bc0ce405ebd02fd7187738029240b860b9b6  android/mindlist-release.keystore" | sha256sum -c -
          keytool -list -keystore android/mindlist-release.keystore -storepass "$STORE_PASSWORD" -alias "$KEY_ALIAS" | head -2

      - name: Assemble signed release
        working-directory: android
        env:
          JAVA_HOME: ${{ env.JAVA_HOME }}
        run: ./gradlew assembleRelease

      - name: Verify signature
        run: $ANDROID_HOME/build-tools/36.0.0/apksigner verify app/build/outputs/apk/release/app-release.apk
        working-directory: android

      - name: Stage artifact
        run: cp android/app/build/outputs/apk/release/app-release.apk "mindlist-${GITHUB_REF_NAME}.apk"

      - name: Create Gitea release + upload APK
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ github.ref_name }}
          SERVER: ${{ github.server_url }}
          REPO: ${{ github.repository }}
        run: |
          REL=$(curl -sS -H "Authorization: token $TOKEN" -H 'Content-Type: application/json' \
            -d "{\"tag_name\":\"$TAG\",\"name\":\"Mindlist $TAG\",\"draft\":false,\"prerelease\":false}" \
            "$SERVER/api/v1/repos/$REPO/releases")
          echo "$REL" | head -c 300; echo
          RID=$(echo "$REL" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
          curl -sS -H "Authorization: token $TOKEN" -H 'Content-Type: application/vnd.android.package-archive' \
            --data-binary "@mindlist-$TAG.apk" \
            "$SERVER/api/v1/repos/$REPO/releases/$RID/assets?name=mindlist-$TAG.apk"
          echo; echo "Uploaded mindlist-$TAG.apk to release $RID"