release.yml

name: Build and Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  version:
    name: Extract version
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.VERSION }}
      tag: ${{ steps.version.outputs.TAG }}
    steps:
      - name: Extract version from tag
        id: version
        run: |
          echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
          echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT

  build-android-x86_64:
    name: Android APK (x86_64)
    runs-on: ubuntu-latest
    environment: Release
    needs: version
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Pull builder image
        run: docker pull ghcr.io/magicgrants/skylight-wallet-builder:latest

      - name: Set up Android signing
        run: |
          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > ./android/keystore.jks
          cat > android/key.properties << EOF
          storePassword=${{ secrets.ANDROID_STORE_PASSWORD }}
          keyPassword=${{ secrets.ANDROID_KEY_PASSWORD }}
          keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}
          storeFile=/workspace/android/keystore.jks
          EOF

      - name: Build APK (x86_64)
        run: |
          VERSION='${{ needs.version.outputs.version }}'
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            ghcr.io/magicgrants/skylight-wallet-builder:latest \
            bash -c "flutter pub get && flutter build apk --dart-define=DEMO_MODE=true --release --target-platform android-x64"

          mkdir -p dist
          APK="$(ls -1 build/app/outputs/flutter-apk/*.apk | head -n1)"
          cp -v "$APK" "dist/skylight-wallet-${VERSION}-x86_64.apk"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: android-x86_64
          path: dist/*.apk

  build-android-arm64:
    name: Android APK (arm64-v8a)
    runs-on: ubuntu-latest
    environment: Release
    needs: version
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Pull builder image
        run: docker pull ghcr.io/magicgrants/skylight-wallet-builder:latest

      - name: Set up Android signing
        run: |
          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > ./android/keystore.jks
          cat > android/key.properties << EOF
          storePassword=${{ secrets.ANDROID_STORE_PASSWORD }}
          keyPassword=${{ secrets.ANDROID_KEY_PASSWORD }}
          keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}
          storeFile=/workspace/android/keystore.jks
          EOF

      - name: Build APK (arm64-v8a)
        run: |
          VERSION='${{ needs.version.outputs.version }}'
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            ghcr.io/magicgrants/skylight-wallet-builder:latest \
            bash -c "flutter pub get && flutter build apk --dart-define=DEMO_MODE=true --release --target-platform android-arm64"

          mkdir -p dist
          APK="$(ls -1 build/app/outputs/flutter-apk/*.apk | head -n1)"
          cp -v "$APK" "dist/skylight-wallet-${VERSION}-arm64-v8a.apk"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: android-arm64-v8a
          path: dist/*.apk

  build-android-armeabi-v7a:
    name: Android APK (armeabi-v7a)
    runs-on: ubuntu-latest
    environment: Release
    needs: version
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Pull builder image
        run: docker pull ghcr.io/magicgrants/skylight-wallet-builder:latest

      - name: Set up Android signing
        run: |
          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > ./android/keystore.jks
          cat > android/key.properties << EOF
          storePassword=${{ secrets.ANDROID_STORE_PASSWORD }}
          keyPassword=${{ secrets.ANDROID_KEY_PASSWORD }}
          keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}
          storeFile=/workspace/android/keystore.jks
          EOF

      - name: Build APK (armeabi-v7a)
        run: |
          VERSION='${{ needs.version.outputs.version }}'
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            ghcr.io/magicgrants/skylight-wallet-builder:latest \
            bash -c "flutter pub get && flutter build apk --dart-define=DEMO_MODE=true --release --target-platform android-arm"

          mkdir -p dist
          APK="$(ls -1 build/app/outputs/flutter-apk/*.apk | head -n1)"
          cp -v "$APK" "dist/skylight-wallet-${VERSION}-armeabi-v7a.apk"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: android-armeabi-v7a
          path: dist/*.apk

  build-android-aab:
    name: Android App Bundle (AAB)
    runs-on: ubuntu-latest
    environment: Release
    needs: version
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Pull builder image
        run: docker pull ghcr.io/magicgrants/skylight-wallet-builder:latest

      - name: Set up Android signing
        run: |
          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > ./android/keystore.jks
          cat > android/key.properties << EOF
          storePassword=${{ secrets.ANDROID_STORE_PASSWORD }}
          keyPassword=${{ secrets.ANDROID_KEY_PASSWORD }}
          keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}
          storeFile=/workspace/android/keystore.jks
          EOF

      - name: Build AAB
        run: |
          VERSION='${{ needs.version.outputs.version }}'
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            ghcr.io/magicgrants/skylight-wallet-builder:latest \
            bash -c "flutter pub get && flutter build appbundle --dart-define=DEMO_MODE=true --release"

          mkdir -p dist
          cp -v build/app/outputs/bundle/release/app-release.aab "dist/skylight-wallet-${VERSION}.aab"

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: android-aab
          path: dist/*.aab

  build-linux-x86_64:
    name: Linux AppImage (x86_64)
    runs-on: ubuntu-latest
    environment: Release
    needs: version
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Pull builder image
        run: docker pull ghcr.io/magicgrants/skylight-wallet-builder:latest

      - name: Build AppImage (x86_64)
        run: |
          VERSION='${{ needs.version.outputs.version }}'
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            ghcr.io/magicgrants/skylight-wallet-builder:latest \
            bash -c "flutter pub get && ./appimage/build_appimage.sh --version ${VERSION}"

          mkdir -p dist
          cp -v appimage/skylight-wallet-*.AppImage dist/

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: linux-appimage
          path: dist/*.AppImage

  release:
    name: Sign + Release
    runs-on: ubuntu-latest
    environment: Release
    needs:
      - version
      - build-android-x86_64
      - build-android-arm64
      - build-android-armeabi-v7a
      - build-android-aab
      - build-linux-x86_64
    permissions:
      contents: write
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist

      - name: List downloaded artifacts
        run: |
          echo "=== dist tree ==="
          find dist -type f -maxdepth 3 -print

      - name: Import GPG key
        run: |
          echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import

      - name: Sign artifacts with GPG
        env:
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          set -euo pipefail
          find dist -type f \( -name "*.apk" -o -name "*.aab" -o -name "*.AppImage" \) -print0 | while IFS= read -r -d '' file; do
            echo "$GPG_PASSPHRASE" | gpg --batch --yes --pinentry-mode loopback --passphrase-fd 0 --detach-sign --armor "$file"
            echo "Signed: $file"
          done

          echo "=== Generated signatures ==="
          find dist -name "*.asc" -type f -print

      - name: Create Release
        uses: softprops/action-gh-release@v1
        with:
          name: ${{ needs.version.outputs.tag }}
          draft: false
          prerelease: false
          generate_release_notes: true
          files: |
            dist/**/*.apk
            dist/**/*.apk.asc
            dist/**/*.aab
            dist/**/*.aab.asc
            dist/**/*.AppImage
            dist/**/*.AppImage.asc
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}