android-build.yml

name: Build Android AAB

on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: android
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      # Checksums the committed wrapper jar against Gradle's known-good
      # release hashes, so a tampered wrapper fails the build instead of
      # silently running.
      - uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

      - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
        with:
          java-version: '17'
          distribution: 'temurin'

      - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

      # @bubblewrap/cli is declared as a devDependency with a committed
      # lockfile in .github/tools/android, so this installs a pinned,
      # hash-verified version instead of resolving a version string at
      # runtime.
      - name: Install Bubblewrap
        working-directory: .github/tools/android
        run: npm install

      # bubblewrap prompts interactively for JDK/SDK paths on first run
      # (Cli.ts's loadOrCreateConfig), which hangs on a non-TTY runner.
      # Pre-seeding the config with the paths setup-java/setup-android
      # already installed skips that prompt entirely.
      - name: Configure Bubblewrap JDK/SDK paths
        run: |
          mkdir -p ~/.bubblewrap
          echo "{\"jdkPath\":\"$JAVA_HOME\",\"androidSdkPath\":\"$ANDROID_HOME\"}" > ~/.bubblewrap/config.json

      - name: Decode keystore
        run: echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > "$RUNNER_TEMP/keystore.jks"

      - name: Build release AAB
        env:
          BUBBLEWRAP_KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          BUBBLEWRAP_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: |
          "$GITHUB_WORKSPACE/.github/tools/android/node_modules/.bin/bubblewrap" build --skipPwaValidation \
            --signingKeyPath="$RUNNER_TEMP/keystore.jks" \
            --signingKeyAlias="video-shrinker"

      - name: Upload AAB
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: video-shrinker-${{ github.run_number }}
          path: |
            android/app-release-bundle.aab
            android/app-release-signed.apk
          if-no-files-found: warn
          retention-days: 90

  # Runs only after a successful build, so a broken build never advances
  # the version. Bumps versionCode/versionName one past what this run
  # just built, so the next build produces a Play-Console-uploadable AAB
  # without anyone needing to remember to do it by hand.
  bump-version:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      actions: write
    steps:
      # This job pushes the version-bump branch, so it needs the checkout's
      # persisted credentials — persist-credentials: false would break the push.
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # zizmor: ignore[artipacked]

      - name: Bump version and open PR
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          current=$(grep -oP 'versionCode \K\d+' android/app/build.gradle)
          next=$((current + 1))

          sed -i "s/versionCode $current/versionCode $next/" android/app/build.gradle
          sed -i "s/versionName \"$current\"/versionName \"$next\"/" android/app/build.gradle
          sed -i "s/\"appVersionCode\": $current/\"appVersionCode\": $next/" android/twa-manifest.json
          sed -i "s/\"appVersion\": \"$current\"/\"appVersion\": \"$next\"/" android/twa-manifest.json
          sha1sum android/twa-manifest.json | cut -d' ' -f1 | tr -d '\n' > android/manifest-checksum.txt

          BRANCH="bump-android-version-$next"
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git checkout -b "$BRANCH"
          git add android/app/build.gradle android/twa-manifest.json android/manifest-checksum.txt
          git commit -m "Bump Android versionCode to $next"
          git push origin "$BRANCH"
          gh pr create \
            --title "Bump Android versionCode to $next" \
            --body "Auto-bump after a successful android-build.yml run that built versionCode $current. Prepares the repo so the next build produces versionCode $next." \
            --base main \
            --head "$BRANCH"
          # Dispatch the required check onto the branch explicitly and wait
          # for it. GitHub also auto-creates a pull_request run for this
          # bot-authored PR, so filter by event to watch the run we started,
          # not that one.
          gh workflow run pr-checks.yml --ref "$BRANCH"
          sleep 15
          RUN_ID=$(gh run list --workflow=pr-checks.yml --branch "$BRANCH" --event workflow_dispatch --limit 1 --json databaseId --jq '.[0].databaseId')
          gh run watch "$RUN_ID" --exit-status
          # The auto-created pull_request run blocks the merge box until it
          # finishes (it lags the dispatched run by a few seconds), so retry
          # the merge instead of failing on the first attempt.
          for i in $(seq 1 10); do
            if gh pr merge "$BRANCH" --squash --delete-branch; then
              exit 0
            fi
            echo "Merge blocked, retrying in 15s ($i/10)..."
            sleep 15
          done
          echo "PR never became mergeable; approve/merge it manually."
          exit 1