name: Build Android Apk

# Only a release built through "Releases -> New Release" starts a build. A tag
# pushed with plain git does not publish a release and is therefore ignored.
on:
  release:
    types:
      - published

env:
  # Keep in sync with the other workflows and with `ac_web/Dockerfile`.
  FLUTTER_VERSION: '3.44.9'
  # The project produces java 17 bytecode (`android/app/build.gradle.kts`), but
  # gradle 9.1 and the android gradle plugin 9 need a newer jdk to run on.
  JAVA_VERSION: '21'

jobs:
  android:
    runs-on: ubuntu-latest
    container:
      image: catthehacker/ubuntu:act-latest

    # The flutter project lives in a sub directory of the repository.
    defaults:
      run:
        working-directory: ac_web

    steps:
      - name: Checkout
        uses: https://github.com/actions/checkout@v4

      # The flutter tool runs git inside the workspace and inside its own sdk,
      # and git refuses to work in directories it considers to belong to
      # somebody else.
      - name: Trust the workspace
        run: git config --global --add safe.directory '*'

      # Everything the flutter download below needs.
      - name: Install the download tools
        run: |
          apt-get update
          apt-get install -y --no-install-recommends ca-certificates curl xz-utils jq

      - name: Set up Java
        uses: https://github.com/actions/setup-java@v4
        with:
          distribution: temurin
          java-version: ${{ env.JAVA_VERSION }}

      # Installs the command line tools and accepts the sdk licenses. The
      # platform, the build tools and the ndk pinned by the flutter sdk are
      # then downloaded by gradle itself, which is what makes this job slow on
      # a cold runner.
      - name: Set up the Android sdk
        uses: https://github.com/android-actions/setup-android@v3

      # `subosito/flutter-action` cannot be used: it caches the sdk through
      # `actions/cache@v5`, and the act-runner of this gitea instance only
      # supports actions up to node20 ("runs.using ... got node24"). Unpacking
      # the official archive does the same thing and pins the version exactly,
      # just like `ac_web/Dockerfile` does.
      - name: Set up Flutter
        run: |
          curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${{ env.FLUTTER_VERSION }}-stable.tar.xz" \
            | tar -xJ -C /opt
          echo "/opt/flutter/bin" >> "$GITHUB_PATH"

      - name: Show the flutter version
        run: flutter --version

      - name: Install dependencies
        run: flutter pub get

      - name: Run tests
        run: flutter test

      # Android accepts an update only when it is signed with the same key as
      # the installed app, so every release has to carry one key that never
      # changes. The debug key cannot be used: the runner generates a fresh one
      # on every run, which would make each apk a different app to android and
      # break every update through Obtainium.
      #
      # `android/app/build.gradle.kts` picks the key up from
      # `android/key.properties`, which is written here from the repository
      # secrets (Settings -> Actions -> Secrets). See CLAUDE.md for the
      # `keytool` command that creates the keystore.
      - name: Write the release signing key
        env:
          KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          # The act-runner executes `run` with sh (dash), not bash, so this
          # script has to stay posix - `set -o pipefail` for example dies
          # with "Illegal option -o pipefail" before anything else runs.
          set -eu

          # Failing here is on purpose: a silently debug signed apk would be
          # installable once and never updatable afterwards.
          if [ -z "${KEYSTORE_BASE64:-}" ]; then
            echo "::error::The secret ANDROID_KEYSTORE_BASE64 is empty. Add the keystore secrets (see CLAUDE.md) before publishing a release."
            exit 1
          fi

          printf '%s' "$KEYSTORE_BASE64" | base64 -d > android/app/release-keystore.jks

          # storeFile is relative to `android/app`. The file is gitignored.
          cat > android/key.properties <<PROPERTIES
          storeFile=release-keystore.jks
          storePassword=$KEYSTORE_PASSWORD
          keyAlias=$KEY_ALIAS
          keyPassword=$KEY_PASSWORD
          PROPERTIES

      # One apk for all abis. `--split-per-abi` would produce three smaller
      # ones instead, at the cost of having to pick the right one manually.
      #
      # The version in the pubspec (`1.0.0+1`) never moves, so it is replaced
      # here: the version name becomes the tag of the release and the version
      # code the run number, which only ever grows. Android refuses to install
      # an apk whose version code is lower than the installed one, so the code
      # must never go backwards.
      - name: Build the apk
        run: |
          set -eu

          version="${{ github.ref_name }}"
          version="${version#v}"

          # `--build-name` only accepts a dotted number, so an unusual tag
          # ("nightly") keeps the version of the pubspec instead of failing
          # the build.
          case "$version" in
            *[!0-9.]* | '' ) buildName='' ;;
            * ) buildName="$version" ;;
          esac

          if [ -n "$buildName" ]; then
            flutter build apk --release \
              --build-name "$buildName" \
              --build-number "${{ github.run_number }}"
          else
            echo "::warning::'${{ github.ref_name }}' is not a dotted version, keeping the version of the pubspec."
            flutter build apk --release --build-number "${{ github.run_number }}"
          fi

      # Gradle always writes the same file name, so the release the apk belongs
      # to would not be visible after downloading it.
      - name: Name the apk after the release
        run: mv build/app/outputs/flutter-apk/app-release.apk ac_web-${{ github.ref_name }}.apk

      # Obtainium reads `<host>/api/v1/repos/<owner>/<repo>/releases` and
      # downloads the *assets* of a release, so the apk has to hang off the
      # release itself. A workflow artifact is invisible to it: it lives under
      # the run, is zipped and needs a login.
      - name: Attach the apk to the release
        env:
          # The token gitea creates for the run. If the instance hands out a
          # read only token, put a personal access token with repository write
          # access in a secret and use that instead.
          TOKEN: ${{ github.token }}
        run: |
          set -eu

          api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
          asset="ac_web-${{ github.ref_name }}.apk"

          # The release event carries the id; the lookup by tag is only there
          # for a manual re-run of the job.
          releaseId="${{ github.event.release.id }}"
          if [ -z "$releaseId" ] || [ "$releaseId" = "null" ]; then
            release=$(curl -fsSL -H "Authorization: token $TOKEN" \
              "$api/releases/tags/${{ github.ref_name }}")
            releaseId=$(printf '%s' "$release" | jq -r '.id')
          fi

          curl -fsSL -X POST \
            -H "Authorization: token $TOKEN" \
            -F "attachment=@$asset" \
            "$api/releases/$releaseId/assets?name=$asset" > /dev/null

          echo "Attached $asset to release $releaseId."

      # @v3 on purpose: `upload-artifact@v4` bundles `@actions/artifact` v2,
      # which refuses to run as soon as `GITHUB_SERVER_URL` is not github.com
      # ("GHESNotSupportedError") -- and on this instance it is the gitea host.
      # The check happens in the action itself, before any request, so it
      # cannot be fixed on the gitea side. @v3 talks to the older artifact api
      # gitea implements and still runs on node20, which the act-runner allows.
      - name: Upload the apk
        uses: https://github.com/actions/upload-artifact@v3
        with:
          name: ac_web-android-${{ github.ref_name }}
          # Artifact paths are relative to the repository, not to the
          # working-directory above.
          path: ac_web/ac_web-${{ github.ref_name }}.apk
          if-no-files-found: error