# Builds a signed release APK on every version tag and attaches it to the
# Gitea release, so Obtainium can track updates. See issue #3.
#
# Required repository secrets (Settings → Secrets → Actions):
#   RELEASE_KEYSTORE_BASE64  — base64 of android/mindlist-release.keystore
#   RELEASE_STORE_PASSWORD   — keystore password
#   RELEASE_KEY_ALIAS        — key alias (mindlist)
#   RELEASE_KEY_PASSWORD     — key password
#
# Obtainium: Add App → Gitea → paste the repo URL. If the repo is private,
# enter an access token (account → Settings → Applications → token with
# repo scope) in the Obtainium source settings.

name: Release APK

on:
  push:
    tags:
      - 'v*'

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - name: Setup JDK 21
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3

      - name: Install SDK packages
        run: |
          yes | sdkmanager --licenses > /dev/null
          sdkmanager "platforms;android-36" "build-tools;36.0.0"

      - name: Install dependencies
        run: npm ci

      - name: Test
        run: npm test

      - name: Build PWA + sync
        run: |
          npm run build
          npx cap sync android

      - name: Restore release keystore
        env:
          KEYSTORE_BASE64: ${{ secrets.RELEASE_KEYSTORE_BASE64 }}
          STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
        run: |
          test -n "$KEYSTORE_BASE64" || { echo "::error::Missing RELEASE_KEYSTORE_BASE64 secret"; exit 1; }
          echo "$KEYSTORE_BASE64" | base64 -d > android/mindlist-release.keystore
          printf 'storeFile=../mindlist-release.keystore\nstorePassword=%s\nkeyAlias=%s\nkeyPassword=%s\n' \
            "$STORE_PASSWORD" "$KEY_ALIAS" "$KEY_PASSWORD" > android/keystore.properties
          echo "sdk.dir=$ANDROID_HOME" > android/local.properties

      - name: Assemble signed release
        working-directory: android
        env:
          JAVA_HOME: ${{ env.JAVA_HOME }}
        run: ./gradlew assembleRelease

      - name: Verify signature
        run: $ANDROID_HOME/build-tools/36.0.0/apksigner verify app/build/outputs/apk/release/app-release.apk
        working-directory: android

      - name: Stage artifact
        run: cp android/app/build/outputs/apk/release/app-release.apk "mindlist-${GITHUB_REF_NAME}.apk"

      - name: Create Gitea release + upload APK
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ github.ref_name }}
          SERVER: ${{ github.server_url }}
          REPO: ${{ github.repository }}
        run: |
          REL=$(curl -sS -H "Authorization: token $TOKEN" -H 'Content-Type: application/json' \
            -d "{\"tag_name\":\"$TAG\",\"name\":\"Mindlist $TAG\",\"draft\":false,\"prerelease\":false}" \
            "$SERVER/api/v1/repos/$REPO/releases")
          echo "$REL" | head -c 300; echo
          RID=$(echo "$REL" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
          curl -sS -H "Authorization: token $TOKEN" -H 'Content-Type: application/vnd.android.package-archive' \
            --data-binary "@mindlist-$TAG.apk" \
            "$SERVER/api/v1/repos/$REPO/releases/$RID/assets?name=mindlist-$TAG.apk"
          echo; echo "Uploaded mindlist-$TAG.apk to release $RID"