name: Android

on:
  release:
    types: [published]
  workflow_dispatch:

jobs:
  build-android:
    runs-on: debian-latest
    permissions:
      contents: read
      releases: write
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21
      - uses: android-actions/setup-android@v3
      # Gitea's act resolver cannot peel the annotated v4 tag alias.
      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
      - name: Set release version
        if: gitea.event_name == 'release'
        shell: bash
        working-directory: android
        env:
          TRANSUI_RELEASE_TAG: ${{ gitea.event.release.tag_name }}
        run: |
          version="${TRANSUI_RELEASE_TAG#v}"
          if [[ ! "$version" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
            echo "Release tag must use vMAJOR.MINOR.PATCH or MAJOR.MINOR.PATCH" >&2
            exit 1
          fi
          major=$((10#${BASH_REMATCH[1]}))
          minor=$((10#${BASH_REMATCH[2]}))
          patch=$((10#${BASH_REMATCH[3]}))
          if (( minor > 999 || patch > 999 )); then
            echo "Minor and patch versions must be below 1000" >&2
            exit 1
          fi
          version_code=$((major * 1000000 + minor * 1000 + patch))
          if (( version_code < 1 || version_code > 2100000000 )); then
            echo "Release version is outside Android's versionCode range" >&2
            exit 1
          fi
          echo "TRANSUI_VERSION=$version" >> "$GITEA_ENV"
          echo "TRANSUI_VERSION_CODE=$version_code" >> "$GITEA_ENV"
          sed -i -E \
            -e "s/^([[:space:]]*)versionCode .*/\1versionCode $version_code/" \
            -e "s/^([[:space:]]*)versionName .*/\1versionName '$version'/" \
            app/build.gradle
          grep -Fq "        versionCode $version_code" app/build.gradle
          grep -Fq "        versionName '$version'" app/build.gradle
      - name: Install Android SDK packages
        run: sdkmanager "platforms;android-35" "build-tools;35.0.0"
      - name: Lint and test
        working-directory: android
        run: ./gradlew --no-daemon lintDebug testDebugUnitTest
      - name: Build signed release APK
        working-directory: android
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ORG_GRADLE_PROJECT_transuiStorePassword: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ORG_GRADLE_PROJECT_transuiKeyAlias: ${{ secrets.ANDROID_KEY_ALIAS }}
          ORG_GRADLE_PROJECT_transuiKeyPassword: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          if [ -z "$ANDROID_KEYSTORE_BASE64" ]; then
            echo "Release signing secrets are not configured; skipping release APK"
            exit 0
          fi
          keystore="$RUNNER_TEMP/transui-release.jks"
          printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 --decode > "$keystore"
          export ORG_GRADLE_PROJECT_transuiKeystore="$keystore"
          ./gradlew --no-daemon assembleRelease
      - name: Prepare APK artifacts
        working-directory: android
        run: |
          mkdir -p ../artifacts
          if [ -f app/build/outputs/apk/release/app-release.apk ]; then
            cp app/build/outputs/apk/release/app-release.apk ../artifacts/transui-android-release.apk
            cd ../artifacts
            sha256sum ./*.apk > SHA256SUMS-android
          else
            echo "No release APK to publish"
          fi
      - name: Attach APKs to the Gitea release
        if: gitea.event_name == 'release'
        env:
          GITEA_SERVER_URL: ${{ gitea.server_url }}
          GITEA_REPOSITORY: ${{ gitea.repository }}
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          GITEA_RELEASE_TAG: ${{ gitea.event.release.tag_name }}
        run: scripts/publish-release-assets.sh
      - name: Upload APKs
        if: always()
        uses: christopherhx/gitea-upload-artifact@v4
        with:
          name: transui-android
          path: artifacts/
          if-no-files-found: warn