android-release.yml

name: Android Release

on:
  push:
    tags:
      - "*"

permissions:
  contents: write

env:
  ANDROID_NDK_VERSION: "26.3.11579264"

jobs:
  verify:
    name: Verify
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.24.1"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Install Android NDK
        run: |
          yes | sdkmanager --licenses >/dev/null || true
          sdkmanager --install "ndk;$ANDROID_NDK_VERSION"

      - name: Make Gradle executable
        run: chmod +x ./gradlew

      - name: Android unit tests
        run: ./gradlew :app:testDebugUnitTest --stacktrace

      - name: DNSTT helper tests
        working-directory: dnstt-helper
        run: go test ./...

  build-apks:
    name: Build APKs
    runs-on: ubuntu-latest
    needs: verify
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.24.1"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Install Android NDK
        run: |
          yes | sdkmanager --licenses >/dev/null || true
          sdkmanager --install "ndk;$ANDROID_NDK_VERSION"

      - name: Make Gradle executable
        run: chmod +x ./gradlew

      - name: Decode release keystore
        env:
          RELEASE_KEYSTORE_BASE64: ${{ secrets.RELEASE_KEYSTORE_BASE64 }}
          RELEASE_STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }}
          RELEASE_KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
          RELEASE_KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
        run: |
          set -euo pipefail

          for secret_name in RELEASE_KEYSTORE_BASE64 RELEASE_STORE_PASSWORD RELEASE_KEY_ALIAS RELEASE_KEY_PASSWORD; do
            if [ -z "${!secret_name:-}" ]; then
              echo "::error::$secret_name is required for signed release builds."
              exit 1
            fi
          done

          signing_dir="$RUNNER_TEMP/android-signing"
          mkdir -p "$signing_dir"
          keystore_path="$signing_dir/range-scout-release.jks"
          printf '%s' "$RELEASE_KEYSTORE_BASE64" | base64 --decode > "$keystore_path"

          {
            echo "RELEASE_STORE_FILE=$keystore_path"
            echo "RELEASE_STORE_PASSWORD=$RELEASE_STORE_PASSWORD"
            echo "RELEASE_KEY_ALIAS=$RELEASE_KEY_ALIAS"
            echo "RELEASE_KEY_PASSWORD=$RELEASE_KEY_PASSWORD"
          } >> "$GITHUB_ENV"

      - name: Build release APKs
        run: ./gradlew :app:assembleRelease --stacktrace

      - name: List APKs
        run: find app/build/outputs/apk/release -name "*.apk" -print | sort

      - name: Prepare release assets
        env:
          TAG_NAME: ${{ github.ref_name }}
        run: bash scripts/prepare-release-apks.sh

      - name: List release assets
        run: find app/build/release-assets -name "*.apk" -print | sort

      - name: Upload APK artifacts
        uses: actions/upload-artifact@v4
        with:
          name: range-scout-apks-${{ github.ref_name }}
          path: app/build/release-assets/*.apk
          if-no-files-found: error

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          shopt -s nullglob
          assets=(app/build/release-assets/*.apk)

          if [ "${#assets[@]}" -eq 0 ]; then
            echo "No APK files found for release upload."
            exit 1
          fi

          if gh release view "$TAG_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            while IFS= read -r asset_name; do
              if [[ "$asset_name" == *.apk ]]; then
                gh release delete-asset "$TAG_NAME" "$asset_name" --repo "$GITHUB_REPOSITORY" -y
              fi
            done < <(gh release view "$TAG_NAME" --repo "$GITHUB_REPOSITORY" --json assets --jq '.assets[].name')
            gh release upload "$TAG_NAME" "${assets[@]}" --repo "$GITHUB_REPOSITORY" --clobber
          else
            gh release create "$TAG_NAME" "${assets[@]}" --repo "$GITHUB_REPOSITORY" --title "Range Scout $TAG_NAME" --generate-notes
          fi