# Release automation for git.comunes.org (Forgejo Actions).
#
# Pushing a tag `v*` runs two independent jobs:
#   play            - build the signed AAB and ship it to Google Play (internal).
#   fdroid_reference- build the per-ABI reference APKs the SAME way F-Droid will
#                     (fdroid build inside the fdroidserver buildserver image),
#                     sign them with the tane-upload key, and attach them to the
#                     Forgejo release. F-Droid re-runs `fdroid build` on the same
#                     commit+recipe+image, gets byte-identical output, verifies our
#                     signature (AllowedAPKSigningKeys) and publishes OUR APK — so
#                     F-Droid and Play share the same signing key.
#
# All credentials come from repo secrets (Settings > Actions > Secrets):
#   TANE_KEYSTORE_BASE64   base64 of the dedicated tane-upload.jks
#   TANE_KEYSTORE_PASSWORD store password
#   TANE_KEY_ALIAS         tane-upload
#   TANE_KEY_PASSWORD      key password
#   SUPPLY_JSON_KEY_DATA   Google Play service-account JSON
#
# NOTE: `runs-on` must match a label your Forgejo runner registered with.
# The fdroid_reference job pulls a large image (~2 GB) and builds tesseract from
# source, so it is slow (~20-40 min); the play job is independent and unaffected.

name: release

on:
  push:
    tags:
      - 'v*'
  # Manual trigger to test the fdroid_reference job on a branch without cutting a
  # tag or deploying to Play (the play job below is guarded to tags only).
  workflow_dispatch:

jobs:
  play:
    if: ${{ startsWith(github.ref, 'refs/tags/') }}
    runs-on: docker
    container:
      image: ghcr.io/cirruslabs/flutter:3.41.9
    steps:
      # Manual git checkout (no Node): the flutter image has no node, so JS
      # actions like actions/checkout@v4 fail with "exec: node: not found".
      - name: Checkout
        env:
          TOKEN: ${{ github.token }}
        run: |
          git config --global --add safe.directory '*'
          git init -q .
          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
          git fetch -q --depth 1 origin "${GITHUB_SHA}"
          git checkout -q FETCH_HEAD

      - name: Generate code (i18n + Drift)
        working-directory: apps/app_seeds
        run: |
          flutter pub get
          dart run slang
          dart run build_runner build --delete-conflicting-outputs

      - name: Materialize signing material from secrets
        working-directory: apps/app_seeds
        env:
          TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
          TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
          TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
          TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
        run: |
          echo "$TANE_KEYSTORE_BASE64" | base64 -d > "$GITHUB_WORKSPACE/tane-upload.jks"
          cat > android/key.properties <<EOF
          storeFile=$GITHUB_WORKSPACE/tane-upload.jks
          storePassword=$TANE_KEYSTORE_PASSWORD
          keyAlias=$TANE_KEY_ALIAS
          keyPassword=$TANE_KEY_PASSWORD
          EOF

      - name: Build signed AAB
        working-directory: apps/app_seeds
        run: flutter build appbundle --release

      - name: Install fastlane
        working-directory: apps/app_seeds
        run: |
          apt-get update -qq
          apt-get install -y -qq ruby ruby-dev build-essential
          gem install bundler --no-document
          bundle install

      - name: Publish to Google Play (internal track)
        working-directory: apps/app_seeds
        env:
          SUPPLY_JSON_KEY_DATA: ${{ secrets.SUPPLY_JSON_KEY_DATA }}
        run: bundle exec fastlane deploy_play

      - name: Scrub signing material
        if: always()
        working-directory: apps/app_seeds
        run: rm -f android/key.properties "$GITHUB_WORKSPACE/tane-upload.jks"

  fdroid_reference:
    runs-on: docker
    container:
      image: registry.gitlab.com/fdroid/fdroidserver:buildserver-trixie
    steps:
      - name: Build reference APKs with fdroid, sign, and attach to the release
        env:
          TOKEN: ${{ github.token }}
          TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
          TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
          TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
          TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
        run: |
          set -eu

          # 1) Reproduce F-Droid's build environment (ANDROID_HOME, PATH, NDK...).
          sh /opt/buildserver/setup-env-vars /opt/android-sdk
          . /etc/profile.d/bsenv.sh

          # 2) fdroidserver from master, exactly like the fdroiddata CI.
          fds=/opt/fdroidserver-src
          mkdir -p "$fds"
          curl -sL https://gitlab.com/fdroid/fdroidserver/-/archive/master/fdroidserver-master.tar.gz \
            | tar -xz -C "$fds" --strip-components=1
          export PATH="$fds:$PATH"
          export PYTHONPATH="$fds:$fds/examples"
          git config --global --add safe.directory '*'
          # The job container reaches github.com but not the host's public git.comunes.org
          # (NAT hairpin); redirect the app clone to the internal Forgejo host so
          # `fdroid build` can fetch the source (and SOURCE_DATE_EPOCH from its commit).
          git config --global url."http://x-access-token:${TOKEN}@forgejo:3000/".insteadOf "https://git.comunes.org/"

          # 3) Fetch our in-repo recipe (the single source of truth) at this commit,
          #    plus the pubspec versionCode base for the per-ABI codes.
          work=/tmp/tane-src
          mkdir -p "$work" && cd "$work"
          git init -q .
          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
          git fetch -q --depth 1 origin "${GITHUB_SHA}"
          git checkout -q FETCH_HEAD
          base=$(sed -n -E 's/^version:.*\+([0-9]+)$/\1/p' apps/app_seeds/pubspec.yaml)
          [ -n "$base" ]

          # 4) Assemble a minimal fdroiddata (config.yml + srclibs + our recipe) from the
          #    in-repo files. No external host needed — the job container reaches
          #    git.comunes.org (via forgejo:3000) but not gitlab.com.
          fdd=/tmp/fdroiddata
          mkdir -p "$fdd/metadata" "$fdd/srclibs"
          cp "$work/fdroid-ci/config.yml" "$fdd/config.yml"
          cp "$work"/fdroid-ci/srclibs/*.yml "$fdd/srclibs/"
          cp "$work/docs/fdroid/org.comunes.tane.yml" "$fdd/metadata/org.comunes.tane.yml"
          cd "$fdd"
          # Build THIS commit; drop binary: (we PRODUCE the reference here, not verify it).
          sed -i "s#^\( *commit: \).*#\1${GITHUB_SHA}#" metadata/org.comunes.tane.yml
          sed -i '/^ *binary: /d' metadata/org.comunes.tane.yml

          # Pre-clone the app into fdroid's build dir: fdroidserver computes
          # SOURCE_DATE_EPOCH from this checkout BEFORE it clones anything — on a
          # fresh dir it falls back to `git log` of the fdroiddata tree, which our
          # assembled skeleton doesn't have, and crashes on None. With the clone in
          # place the primary path pins SOURCE_DATE_EPOCH to the app commit
          # timestamp (deterministic; the public URL is redirected to forgejo:3000
          # by the insteadOf rule above).
          mkdir -p build
          git clone -q https://git.comunes.org/comunes/tane.git build/org.comunes.tane
          git -C build/org.comunes.tane checkout -q "${GITHUB_SHA}"

          # 5) Build the three per-ABI splits with F-Droid's own toolchain.
          fdroid build --verbose --no-tarball \
            "org.comunes.tane:$((base * 10 + 1))" \
            "org.comunes.tane:$((base * 10 + 2))" \
            "org.comunes.tane:$((base * 10 + 3))"

          # `fdroid build` exits 0 even when builds fail — demand the 3 APKs.
          apk_count=$(ls unsigned/org.comunes.tane_*.apk 2>/dev/null | wc -l)
          if [ "$apk_count" -ne 3 ]; then
            echo "expected 3 unsigned APKs, got $apk_count" >&2
            tail -n 80 logs/*.log 2>/dev/null || true
            exit 1
          fi

          # 6) Sign each unsigned APK with tane-upload and attach to the Forgejo release.
          apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
          if [ -z "$apksigner" ]; then
            yes | sdkmanager "build-tools;34.0.0" >/dev/null 2>&1 || true
            apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
          fi
          echo "$TANE_KEYSTORE_BASE64" | base64 -d > /tmp/ks.jks
          api="http://forgejo:3000/api/v1/repos/${GITHUB_REPOSITORY}"
          tag="${GITHUB_REF_NAME}"
          is_tag=false; [ "${GITHUB_REF_TYPE:-}" = tag ] && is_tag=true
          rid=""
          if $is_tag; then
            curl -sf -X POST "$api/releases" \
              -H "Authorization: token ${TOKEN}" -H 'Content-Type: application/json' \
              -d "{\"tag_name\":\"${tag}\",\"name\":\"${tag}\"}" >/dev/null || true
            rid=$(curl -sf -H "Authorization: token ${TOKEN}" "$api/releases/tags/${tag}" \
              | python3 -c 'import sys,json;print(json.load(sys.stdin)["id"])')
          fi
          for f in unsigned/org.comunes.tane_*.apk; do
            vc=$(echo "$f" | sed -E 's/.*_([0-9]+)\.apk/\1/')
            case $((vc % 10)) in
              1) abi=armeabi-v7a ;;
              2) abi=arm64-v8a ;;
              3) abi=x86_64 ;;
              *) echo "unexpected versionCode $vc"; exit 1 ;;
            esac
            out="/tmp/app-${abi}-release.apk"
            "$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
              --ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
              --out "$out" "$f"
            # Prove the signer cert matches AllowedAPKSigningKeys.
            "$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
            if $is_tag; then
              curl -sf -X POST "$api/releases/${rid}/assets?name=app-${abi}-release.apk" \
                -H "Authorization: token ${TOKEN}" \
                -F "attachment=@${out};type=application/vnd.android.package-archive"
              echo "uploaded app-${abi}-release.apk (from ${f##*/})"
            else
              echo "built+signed app-${abi}-release.apk (dispatch: upload skipped)"
            fi
          done
          rm -f /tmp/ks.jks