release.yml

name: Build Android APK

on:
  push:
    tags:
      - '*.*.*'
      - '!*-*'
  workflow_dispatch:

jobs:
  build-android:
    name: Build Android APK
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Setup JDK 17
        uses: actions/setup-java@v5
        with:
          distribution: microsoft
          java-version: 17

      - name: Install .NET 10.0.x
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: "10.0.x"

      - name: Install .NET Android workload
        run: dotnet workload install android

      - name: Ensure Android NDK and CMake are available
        run: |
          # The ubuntu-latest runner has $ANDROID_HOME pre-installed.
          # sdkmanager is not on PATH; use the full path.
          SDKMANAGER="$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager"
          # Install latest stable NDK (r29) + CMake.
          yes | "$SDKMANAGER" --licenses > /dev/null 2>&1 || true
          "$SDKMANAGER" --install "ndk;29.0.14206865" "cmake;3.22.1" > /dev/null 2>&1

      - name: Build native library (libosu_native.so)
        run: |
          NDK_HOME="$ANDROID_HOME/ndk/29.0.14206865"
          CMAKE_BIN="$ANDROID_HOME/cmake/3.22.1/bin/cmake"

          # arm64 only — matches RuntimeIdentifiers in osu.Android.props.
          for ABI in arm64-v8a; do
            echo "::group::Building osu_native for $ABI"
            "$CMAKE_BIN" -B "build-native/$ABI" -S osu.Android/Native \
              -DCMAKE_TOOLCHAIN_FILE="$NDK_HOME/build/cmake/android.toolchain.cmake" \
              -DANDROID_ABI="$ABI" \
              -DANDROID_PLATFORM=android-36 \
              -DCMAKE_BUILD_TYPE=Release
            "$CMAKE_BIN" --build "build-native/$ABI" --config Release -j "$(nproc)"
            mkdir -p "osu.Android/libs/$ABI"
            cp "build-native/$ABI/libosu_native.so" "osu.Android/libs/$ABI/"
            echo "::endgroup::"
          done

          echo "Native libraries built successfully:"
          find osu.Android/libs -name "*.so" -exec ls -lh {} \;

      - name: Decode keystore
        id: keystore
        run: |
          if [ -n "$KEYSTORE_BASE64" ]; then
            echo "$KEYSTORE_BASE64" | base64 --decode > "${{ github.workspace }}/osu.Android/osu.keystore"
            echo "has_keystore=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_keystore=false" >> "$GITHUB_OUTPUT"
          fi
        env:
          KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}

      - name: Set version
        id: version
        run: |
          REF="${{ github.ref_name }}"
          if [[ "$REF" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "version=$REF" >> "$GITHUB_OUTPUT"
          else
            echo "version=0.0.0" >> "$GITHUB_OUTPUT"
          fi

      # Always build Release for full optimization (trimming, AOT, compression).
      # When a keystore is available we sign with it; otherwise the SDK produces
      # a debug-signed Release APK that can be sideloaded for testing.
      - name: Build Android APK (signed)
        if: steps.keystore.outputs.has_keystore == 'true'
        env:
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_SIGNING_KEY_ALIAS }}
          ANDROID_KEY_PASS: ${{ secrets.ANDROID_SIGNING_KEY_PASSWORD }}
          ANDROID_STORE_PASS: ${{ secrets.ANDROID_SIGNING_STORE_PASSWORD }}
        run: >
          dotnet publish -c Release
          osu.Android/osu.Android.csproj
          -f net10.0-android
          -p:Version="${{ steps.version.outputs.version }}"
          -p:ApplicationDisplayVersion="${{ steps.version.outputs.version }}"
          -p:ApplicationVersion="${{ github.run_number }}"
          -p:AndroidKeyStore=true
          -p:AndroidSigningKeyStore="${{ github.workspace }}/osu.Android/osu.keystore"
          -p:AndroidSigningKeyAlias="$ANDROID_KEY_ALIAS"
          -p:AndroidSigningKeyPass="$ANDROID_KEY_PASS"
          -p:AndroidSigningStorePass="$ANDROID_STORE_PASS"

      - name: Build Android APK (unsigned Release)
        if: steps.keystore.outputs.has_keystore != 'true'
        run: >
          dotnet publish -c Release
          osu.Android/osu.Android.csproj
          -f net10.0-android
          -p:Version="${{ steps.version.outputs.version }}"
          -p:ApplicationDisplayVersion="${{ steps.version.outputs.version }}"
          -p:ApplicationVersion="${{ github.run_number }}"

      - name: Find APK
        id: find_apk
        run: |
          # Both paths build Release.  Signed builds produce *-Signed.apk; unsigned
          # builds produce the base APK name.  Search publish dir first, then fallback.
          if [ "${{ steps.keystore.outputs.has_keystore }}" == "true" ]; then
            APK=$(find "osu.Android/bin/Release/net10.0-android/publish" -maxdepth 1 -name "*-Signed.apk" 2>/dev/null | head -1)
            if [ -z "$APK" ]; then
              APK=$(find "osu.Android/bin/Release" -name "*-Signed.apk" | head -1)
            fi
          else
            APK=$(find "osu.Android/bin/Release/net10.0-android/publish" -maxdepth 1 -name "*.apk" 2>/dev/null | head -1)
            if [ -z "$APK" ]; then
              APK=$(find "osu.Android/bin/Release" -name "*.apk" | head -1)
            fi
          fi

          if [ -z "$APK" ]; then
            echo "::error::Failed to locate APK. Listing bin directory:"
            find osu.Android/bin -name "*.apk" -o -name "*.aab" 2>/dev/null || true
            exit 1
          fi

          APK_SIZE=$(stat -c %s "$APK" 2>/dev/null || stat -f %z "$APK" 2>/dev/null || wc -c < "$APK")
          APK_SIZE_MB=$((APK_SIZE / 1048576))
          echo "Found APK: $APK ($APK_SIZE_MB MB)"
          echo "apk_path=$APK" >> "$GITHUB_OUTPUT"

      # .NET 10 Android SDK may skip debug-signing for Release publish builds.
      # Verify the APK is signed; if not, sign it with apksigner using the debug
      # keystore so the APK can be sideloaded without INSTALL_PARSE_FAILED_NO_CERTIFICATES.
      - name: Verify and sign APK if needed
        run: |
          APK="${{ steps.find_apk.outputs.apk_path }}"
          APKSIGNER="$ANDROID_HOME/build-tools/$(ls "$ANDROID_HOME/build-tools" | sort -V | tail -1)/apksigner"
          ZIPALIGN="$ANDROID_HOME/build-tools/$(ls "$ANDROID_HOME/build-tools" | sort -V | tail -1)/zipalign"

          if "$APKSIGNER" verify "$APK" 2>/dev/null; then
            echo "APK is already signed ✓"
          else
            echo "::warning::APK is not signed. Signing with debug keystore..."

            # Generate debug keystore if it doesn't exist
            DEBUG_KS="$HOME/.android/debug.keystore"
            if [ ! -f "$DEBUG_KS" ]; then
              mkdir -p "$HOME/.android"
              keytool -genkeypair -v \
                -keystore "$DEBUG_KS" \
                -storepass android \
                -keypass android \
                -alias androiddebugkey \
                -keyalg RSA -keysize 2048 -validity 10000 \
                -dname "CN=Android Debug,O=Android,C=US"
            fi

            # Zipalign first (required before apksigner v2 signing)
            ALIGNED_APK="${APK%.apk}-aligned.apk"
            "$ZIPALIGN" -f -p 4 "$APK" "$ALIGNED_APK"
            mv "$ALIGNED_APK" "$APK"

            # Sign with debug keystore (v1 + v2 + v3 schemes)
            "$APKSIGNER" sign \
              --ks "$DEBUG_KS" \
              --ks-pass pass:android \
              --key-pass pass:android \
              --ks-key-alias androiddebugkey \
              "$APK"

            # Verify signature
            if "$APKSIGNER" verify --print-certs "$APK"; then
              echo "APK signed successfully ✓"
            else
              echo "::error::APK signing failed"
              exit 1
            fi
          fi

      - name: Upload APK artifact
        uses: actions/upload-artifact@v7
        with:
          name: osu-android-${{ github.ref_name }}
          path: ${{ steps.find_apk.outputs.apk_path }}
          if-no-files-found: error

      - name: Create GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: ${{ steps.find_apk.outputs.apk_path }}
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}