# Release automation for git.comunes.org (Forgejo Actions).
#
# Password-free: pushing a tag `v*` builds a signed AAB/APK and uploads it to
# Google Play's internal track via fastlane. All credentials come from repo
# secrets (Settings > Actions > Secrets), never typed:
#   TANE_KEYSTORE_BASE64   base64 of the dedicated tane-upload.jks
#   TANE_KEYSTORE_PASSWORD store password
#   TANE_KEY_ALIAS         tane-upload
#   TANE_KEY_PASSWORD      key password
#   SUPPLY_JSON_KEY_DATA   Google Play service-account JSON (reused from Ğ1nkgo)
#
# Build + deploy live in ONE job so the AAB never has to cross a job boundary.
# NOTE: `runs-on` must match a label your Forgejo runner registered with; adjust
# if the Comunes runner uses something other than `docker`.

name: release

on:
  push:
    tags:
      - 'v*'

jobs:
  android:
    runs-on: docker
    container:
      image: ghcr.io/cirruslabs/flutter:3.41.9
    steps:
      # Manual git checkout (no Node): the flutter image has no node, so JS
      # actions like actions/checkout@v4 fail with "exec: node: not found".
      - name: Checkout
        env:
          TOKEN: ${{ github.token }}
        run: |
          git config --global --add safe.directory '*'
          git init -q .
          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
          git fetch -q --depth 1 origin "${GITHUB_SHA}"
          git checkout -q FETCH_HEAD

      - name: Generate code (i18n + Drift)
        working-directory: apps/app_seeds
        run: |
          flutter pub get
          dart run slang
          dart run build_runner build --delete-conflicting-outputs

      - name: Materialize signing material from secrets
        working-directory: apps/app_seeds
        env:
          TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
          TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
          TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
          TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
        run: |
          echo "$TANE_KEYSTORE_BASE64" | base64 -d > "$GITHUB_WORKSPACE/tane-upload.jks"
          cat > android/key.properties <<EOF
          storeFile=$GITHUB_WORKSPACE/tane-upload.jks
          storePassword=$TANE_KEYSTORE_PASSWORD
          keyAlias=$TANE_KEY_ALIAS
          keyPassword=$TANE_KEY_PASSWORD
          EOF

      - name: Build signed AAB + APK
        working-directory: apps/app_seeds
        run: |
          flutter build appbundle --release
          flutter build apk --release

      - name: Install fastlane
        working-directory: apps/app_seeds
        run: |
          apt-get update -qq
          apt-get install -y -qq ruby ruby-dev build-essential
          gem install bundler --no-document
          bundle install

      - name: Publish to Google Play (internal track)
        working-directory: apps/app_seeds
        env:
          SUPPLY_JSON_KEY_DATA: ${{ secrets.SUPPLY_JSON_KEY_DATA }}
        run: bundle exec fastlane deploy_play

      - name: Scrub signing material
        if: always()
        working-directory: apps/app_seeds
        run: rm -f android/key.properties "$GITHUB_WORKSPACE/tane-upload.jks"