pr-preview-auto.yml

name: Automatic PR preview APK

on:
  workflow_run:
    workflows: ["Android build and releases"]
    types: [completed]
  pull_request:
    types: [closed]

permissions:
  contents: read

concurrency:
  group: pr-preview-${{ github.event.workflow_run.id || github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  publish-pr-preview:
    if: >-
      github.event_name == 'workflow_run' &&
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'pull_request' &&
      github.event.workflow_run.pull_requests[0].number != null
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      actions: read
      contents: write
      pull-requests: read

    steps:
      - name: Verify the source PR is still open and trusted
        id: pr
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
        run: |
          set -euo pipefail
          pr_json="$(gh api "repos/${GH_REPO}/pulls/${PR_NUMBER}")"
          state="$(jq -r '.state' <<< "$pr_json")"
          head_repo="$(jq -r '.head.repo.full_name' <<< "$pr_json")"

          if [[ "$state" != "open" ]]; then
            echo "PR #$PR_NUMBER is $state; skipping stale preview upload."
            echo "publish=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          if [[ "$head_repo" != "$GH_REPO" ]]; then
            echo "PR #$PR_NUMBER comes from $head_repo; refusing to publish an untrusted preview."
            echo "publish=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "publish=true" >> "$GITHUB_OUTPUT"
          echo "number=$PR_NUMBER" >> "$GITHUB_OUTPUT"

      - name: Download the APK produced by full PR CI
        if: steps.pr.outputs.publish == 'true'
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: DualSub-Replay-preview
          path: verified
          github-token: ${{ github.token }}
          run-id: ${{ github.event.workflow_run.id }}

      - name: Package the versioned PR preview APK
        if: steps.pr.outputs.publish == 'true'
        id: package
        env:
          PR_NUMBER: ${{ steps.pr.outputs.number }}
          BUILD_NUMBER: ${{ github.event.workflow_run.run_number }}
        run: |
          set -euo pipefail
          mkdir -p release
          asset_name="DualSub-Replay-PR${PR_NUMBER}-build${BUILD_NUMBER}-preview.apk"
          cp verified/DualSub-Replay-preview.apk "release/$asset_name"
          sha256sum "release/$asset_name"
          echo "asset_name=$asset_name" >> "$GITHUB_OUTPUT"

      - name: Upload newest PR preview to rolling preview release
        if: steps.pr.outputs.publish == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          PR_NUMBER: ${{ steps.pr.outputs.number }}
          ASSET_NAME: ${{ steps.package.outputs.asset_name }}
        run: |
          set -euo pipefail
          assets="$(gh release view preview --json assets --jq '.assets[].name' || true)"
          while IFS= read -r asset; do
            [[ -z "$asset" ]] && continue
            if [[ "$asset" =~ ^DualSub-Replay-PR${PR_NUMBER}-(build[0-9]+-)?preview\.apk$ ]] && [[ "$asset" != "$ASSET_NAME" ]]; then
              gh release delete-asset preview "$asset" --yes
              echo "Removed older PR #$PR_NUMBER preview: $asset"
            fi
          done <<< "$assets"

          gh release upload preview "release/$ASSET_NAME" --clobber
          echo "Published $ASSET_NAME from the already-verified CI artifact."

  cleanup-pr-preview:
    if: >-
      github.event_name == 'pull_request' &&
      github.event.action == 'closed' &&
      github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: write

    steps:
      - name: Remove closed PR preview APKs
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          set -euo pipefail
          assets="$(gh release view preview --json assets --jq '.assets[].name' || true)"
          removed=false
          while IFS= read -r asset; do
            [[ -z "$asset" ]] && continue
            if [[ "$asset" =~ ^DualSub-Replay-PR${PR_NUMBER}-(build[0-9]+-)?preview\.apk$ ]]; then
              gh release delete-asset preview "$asset" --yes
              echo "Deleted $asset from the preview release."
              removed=true
            fi
          done <<< "$assets"

          if [[ "$removed" == "false" ]]; then
            echo "PR #$PR_NUMBER preview APK is already absent from the preview release."
          fi