build.yml

name: Build signed release APK

on:
  workflow_dispatch:
  push:
    branches:
      - main
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
      ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}

    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Android SDK
        uses: android-actions/setup-android@v3

      - name: Install Android 35 platform
        run: sdkmanager "platforms;android-35" "build-tools;35.0.0"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4
        with:
          gradle-version: '8.10.2'

      - name: Restore release keystore
        shell: bash
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: |
          set -euo pipefail
          test -n "$ANDROID_KEYSTORE_BASE64"
          umask 077
          printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 --decode > "$RUNNER_TEMP/courierpilot-release.jks"
          echo "ANDROID_KEYSTORE_PATH=$RUNNER_TEMP/courierpilot-release.jks" >> "$GITHUB_ENV"

      - name: Test parser and build signed release APK
        run: gradle testDebugUnitTest assembleRelease --stacktrace

      - name: Verify permanent release certificate
        shell: bash
        run: |
          set -euo pipefail
          APK="app/build/outputs/apk/release/app-release.apk"
          APKSIGNER="$ANDROID_HOME/build-tools/35.0.0/apksigner"
          EXPECTED_CERT_SHA256="74556417f1289281bcaf1a2c6f3f4aa119db24b079a13759a583c3cc66796b70"
          "$APKSIGNER" verify --verbose --print-certs "$APK"
          ACTUAL_CERT_SHA256="$($APKSIGNER verify --print-certs "$APK" | sed -n 's/^Signer #1 certificate SHA-256 digest: //p')"
          test "$ACTUAL_CERT_SHA256" = "$EXPECTED_CERT_SHA256"
          sha256sum "$APK"

      - name: Resolve release version
        shell: bash
        run: |
          set -euo pipefail
          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
            TAG="$GITHUB_REF_NAME"
          else
            VERSION_NAME="$(sed -n 's/^[[:space:]]*versionName = "\([^"]*\)"/\1/p' app/build.gradle.kts | head -n1)"
            test -n "$VERSION_NAME"
            TAG="v$VERSION_NAME"
          fi
          echo "RELEASE_TAG=$TAG" >> "$GITHUB_ENV"
          echo "RELEASE_APK=CourierPilot-$TAG.apk" >> "$GITHUB_ENV"

      - name: Prepare named release APK
        shell: bash
        run: cp app/build/outputs/apk/release/app-release.apk "$RELEASE_APK"

      - name: Prepare release checksum
        shell: bash
        run: sha256sum "$RELEASE_APK" > "$RELEASE_APK.sha256"

      - name: Upload signed release APK artifact
        uses: actions/upload-artifact@v4
        with:
          name: courierpilot-release-${{ github.run_number }}
          path: app/build/outputs/apk/release/app-release.apk
          if-no-files-found: error
          retention-days: 30

      - name: Publish APK to GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euo pipefail
          if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "Release $RELEASE_TAG already exists; keeping its published APK/checksum immutable."
            echo "Bump versionName/versionCode to publish another APK."
            exit 0
          fi
          gh release create "$RELEASE_TAG" "$RELEASE_APK" "$RELEASE_APK.sha256" \
            --repo "$GITHUB_REPOSITORY" \
            --target "$GITHUB_SHA" \
            --title "CourierPilot ${RELEASE_TAG#v}" \
            --generate-notes