# Builds the Android app on our own runner (deploy/gitea-runner) and publishes it.
#
#   - Push a tag like v1.1.0: builds the normal and FOSS APKs, signed with the upload key,
#     and attaches them to a Gitea release for that tag.
#   - Actions > Android > Run workflow on a branch: a test build, uploaded to this repo's
#     Packages (generic package "musicshare-android", version = branch + short commit).
#
# Uses only `run` steps (no third-party actions), inside the image from deploy/android-builder.
# Secrets (repo Settings > Actions > Secrets):
#   UPLOAD_KEYSTORE_BASE64  the upload keystore, base64 -w0
#   MUSICSHARE_UPLOAD_STORE_PASSWORD, MUSICSHARE_UPLOAD_KEY_ALIAS, MUSICSHARE_UPLOAD_KEY_PASSWORD
#   RELEASE_TOKEN           an access token with write:repository and write:package
name: Android

on:
  push:
    tags: ['v*']
  workflow_dispatch:

jobs:
  build:
    runs-on: musicshare-android
    container:
      image: musicshare-android-builder
      # Keep Gradle and npm downloads between builds.
      options: -v musicshare-gradle:/root/.gradle -v musicshare-npm:/root/.npm
    timeout-minutes: 150
    env:
      SERVER: ${{ github.server_url }}
      REPO: ${{ github.repository }}
      REF_TYPE: ${{ github.ref_type }}
      REF_NAME: ${{ github.ref_name }}
      SHA: ${{ github.sha }}
      GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx4g -Dorg.gradle.daemon=false
    steps:
      - name: Check out
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git init -q src
          cd src
          git -c http.extraHeader="Authorization: token $TOKEN" fetch -q --depth 1 "$SERVER/$REPO.git" "$SHA"
          git checkout -q FETCH_HEAD

      - name: Check the version
        working-directory: src
        run: |
          version=$(node -p "require('./apps/mobile/app.json').expo.version")
          echo "app.json version: $version"
          if [ "$REF_TYPE" = tag ] && [ "$REF_NAME" != "v$version" ]; then
            echo "Tag $REF_NAME doesn't match app.json version $version; bump it (and android.versionCode) first." >&2
            exit 1
          fi

      - name: Install
        working-directory: src
        run: npm ci --workspace @musicshare/mobile --workspace @musicshare/shared --include-workspace-root --no-audit --no-fund

      - name: Build
        working-directory: src
        env:
          KEYSTORE: ${{ secrets.UPLOAD_KEYSTORE_BASE64 }}
          ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_STORE_FILE: /tmp/upload.keystore
          ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_STORE_PASSWORD: ${{ secrets.MUSICSHARE_UPLOAD_STORE_PASSWORD }}
          ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_ALIAS: ${{ secrets.MUSICSHARE_UPLOAD_KEY_ALIAS }}
          ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_PASSWORD: ${{ secrets.MUSICSHARE_UPLOAD_KEY_PASSWORD }}
          REQUIRE_SIGNED: '1'
        run: |
          printf '%s' "$KEYSTORE" | base64 -d > /tmp/upload.keystore
          trap 'rm -f /tmp/upload.keystore' EXIT
          # Check the signing secrets up front (without printing them) rather than 15 minutes in.
          missing=
          [ -n "$KEYSTORE" ] || missing="$missing UPLOAD_KEYSTORE_BASE64"
          [ -n "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_STORE_PASSWORD" ] || missing="$missing MUSICSHARE_UPLOAD_STORE_PASSWORD"
          [ -n "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_ALIAS" ] || missing="$missing MUSICSHARE_UPLOAD_KEY_ALIAS"
          [ -n "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_PASSWORD" ] || missing="$missing MUSICSHARE_UPLOAD_KEY_PASSWORD"
          if [ -n "$missing" ]; then
            echo "These secrets are empty or missing (repo Settings > Actions > Secrets, not Variables):$missing" >&2
            exit 1
          fi
          if ! keytool -list -keystore /tmp/upload.keystore -storepass "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_STORE_PASSWORD" \
              -alias "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_ALIAS" >/dev/null; then
            echo "The keystore didn't open: check UPLOAD_KEYSTORE_BASE64, MUSICSHARE_UPLOAD_STORE_PASSWORD and MUSICSHARE_UPLOAD_KEY_ALIAS." >&2
            exit 1
          fi
          apps/mobile/scripts/build-android.sh "$PWD/out"

      - name: Publish
        working-directory: src/out
        env:
          TOKEN: ${{ secrets.RELEASE_TOKEN }}
        run: |
          api="$SERVER/api/v1/repos/$REPO"
          auth="Authorization: token $TOKEN"
          if [ "$REF_TYPE" = tag ]; then
            # Reuse the release if this tag was built before.
            id=$(curl -fsS -H "$auth" "$api/releases/tags/$REF_NAME" 2>/dev/null | node -p 'JSON.parse(require("fs").readFileSync(0)).id' || true)
            if [ -z "$id" ]; then
              body=$(node -e 'console.log(JSON.stringify({ tag_name: process.argv[1], name: process.argv[1], body: "Android builds. musicshare-*-foss.apk has no closed-source code (no Google ML Kit)." }))' "$REF_NAME")
              id=$(curl -fsS -X POST -H "$auth" -H 'Content-Type: application/json' -d "$body" "$api/releases" | node -p 'JSON.parse(require("fs").readFileSync(0)).id')
            fi
            for f in *.apk SHA256SUMS; do
              old=$(curl -fsS -H "$auth" "$api/releases/$id/assets" | node -p 'JSON.parse(require("fs").readFileSync(0, "utf8") || "[]").find(a => a.name === process.argv[1])?.id ?? ""' "$f")
              [ -n "$old" ] && curl -fsS -X DELETE -H "$auth" "$api/releases/$id/assets/$old"
              curl -fsS -X POST -H "$auth" -F "attachment=@$f" "$api/releases/$id/assets?name=$f" > /dev/null
              echo "Attached $f"
            done
            echo "Release: $SERVER/$REPO/releases/tag/$REF_NAME"
          else
            owner=${REPO%%/*}
            version="$(echo "$REF_NAME" | tr -c 'A-Za-z0-9._-\n' '-')-${SHA::8}"
            for f in *.apk SHA256SUMS; do
              curl -fsS -X PUT -H "$auth" --upload-file "$f" "$SERVER/api/packages/$owner/generic/musicshare-android/$version/$f"
              echo "Uploaded $f"
            done
            echo "Package: $SERVER/$owner/-/packages/generic/musicshare-android/$version"
          fi