# Release automation for git.comunes.org (Forgejo Actions).
#
# Password-free: pushing a tag `v*` builds a signed AAB + per-ABI APKs, uploads
# the AAB to Google Play's internal track via fastlane, and attaches the signed
# per-ABI APKs to the Forgejo release (the reference binaries F-Droid verifies
# for reproducible, developer-signed publishing). All credentials come from repo
# secrets (Settings > Actions > Secrets), never typed:
#   TANE_KEYSTORE_BASE64   base64 of the dedicated tane-upload.jks
#   TANE_KEYSTORE_PASSWORD store password
#   TANE_KEY_ALIAS         tane-upload
#   TANE_KEY_PASSWORD      key password
#   SUPPLY_JSON_KEY_DATA   Google Play service-account JSON (reused from Ğ1nkgo)
#
# Build + deploy live in ONE job so the AAB never has to cross a job boundary.
# NOTE: `runs-on` must match a label your Forgejo runner registered with; adjust
# if the Comunes runner uses something other than `docker`.

name: release

on:
  push:
    tags:
      - 'v*'

jobs:
  android:
    runs-on: docker
    container:
      image: ghcr.io/cirruslabs/flutter:3.41.9
    steps:
      # Manual git checkout (no Node): the flutter image has no node, so JS
      # actions like actions/checkout@v4 fail with "exec: node: not found".
      - name: Checkout
        env:
          TOKEN: ${{ github.token }}
        run: |
          git config --global --add safe.directory '*'
          git init -q .
          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
          git fetch -q --depth 1 origin "${GITHUB_SHA}"
          git checkout -q FETCH_HEAD

      - name: Generate code (i18n + Drift)
        working-directory: apps/app_seeds
        run: |
          flutter pub get
          dart run slang
          dart run build_runner build --delete-conflicting-outputs

      - name: Materialize signing material from secrets
        working-directory: apps/app_seeds
        env:
          TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
          TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
          TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
          TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
        run: |
          echo "$TANE_KEYSTORE_BASE64" | base64 -d > "$GITHUB_WORKSPACE/tane-upload.jks"
          cat > android/key.properties <<EOF
          storeFile=$GITHUB_WORKSPACE/tane-upload.jks
          storePassword=$TANE_KEYSTORE_PASSWORD
          keyAlias=$TANE_KEY_ALIAS
          keyPassword=$TANE_KEY_PASSWORD
          EOF

      - name: Build tesseract4android from source (match F-Droid for reproducibility)
        working-directory: apps/app_seeds
        run: |
          set -eu
          # F-Droid forbids the prebuilt AAR that ships in flutter_tesseract_ocr, so
          # its recipe rebuilds tesseract4android@4.9.0 from source and swaps the AAR
          # into the pub cache. We do the SAME here so our published reference APK is
          # byte-for-byte reproducible against F-Droid's build (keeps AllowedAPKSigningKeys
          # + binary: valid — see metadata/org.comunes.tane.yml in fdroiddata).
          t4a="$GITHUB_WORKSPACE/tesseract4android-src"
          git clone --depth 1 -b 4.9.0 https://github.com/adaptech-cz/Tesseract4Android.git "$t4a"
          # Install the exact NDK the project pins, if the image lacks it.
          ndkv=$(grep -RhoE 'ndkVersion[^0-9]*[0-9][0-9.]+' "$t4a" | grep -oE '[0-9]+\.[0-9.]+' | head -1 || true)
          [ -n "${ndkv:-}" ] && (yes | sdkmanager "ndk;$ndkv" >/dev/null 2>&1 || true)
          ( cd "$t4a/tesseract4android" && ./gradlew --no-daemon assembleStandardRelease )
          aar_dst=$(find ${PUB_CACHE:+$PUB_CACHE} "$HOME/.pub-cache" /root/.pub-cache /sdks 2>/dev/null \
            -path '*flutter_tesseract_ocr-0.4.31/android/libs/tesseract4android-release.aar' | head -1)
          cp "$t4a/tesseract4android/build/outputs/aar/tesseract4android-standard-release.aar" "$aar_dst"
          echo "swapped source-built tesseract AAR -> $aar_dst"

      - name: Build signed AAB + per-ABI APKs
        working-directory: apps/app_seeds
        run: |
          flutter build appbundle --release
          # Per-ABI splits: these are the reference binaries F-Droid rebuilds and
          # verifies against (see docs/fdroid/org.comunes.tane.yml, binary:).
          flutter build apk --release --split-per-abi

      - name: Publish signed per-ABI APKs to the Forgejo release
        working-directory: apps/app_seeds
        env:
          TOKEN: ${{ github.token }}
        run: |
          apt-get update -qq && apt-get install -y -qq curl jq
          api="http://forgejo:3000/api/v1/repos/${GITHUB_REPOSITORY}"
          tag="${GITHUB_REF_NAME}"
          # Create the release for this tag if it does not exist yet, then get its id.
          curl -sf -X POST "$api/releases" \
            -H "Authorization: token ${TOKEN}" -H 'Content-Type: application/json' \
            -d "{\"tag_name\":\"${tag}\",\"name\":\"${tag}\"}" >/dev/null || true
          rid=$(curl -sf -H "Authorization: token ${TOKEN}" "$api/releases/tags/${tag}" | jq -r .id)
          for abi in armeabi-v7a arm64-v8a x86_64; do
            f="build/app/outputs/flutter-apk/app-${abi}-release.apk"
            curl -sf -X POST "$api/releases/${rid}/assets?name=app-${abi}-release.apk" \
              -H "Authorization: token ${TOKEN}" \
              -F "attachment=@${f};type=application/vnd.android.package-archive"
          done

      - name: Install fastlane
        working-directory: apps/app_seeds
        run: |
          apt-get update -qq
          apt-get install -y -qq ruby ruby-dev build-essential
          gem install bundler --no-document
          bundle install

      - name: Publish to Google Play (internal track)
        working-directory: apps/app_seeds
        env:
          SUPPLY_JSON_KEY_DATA: ${{ secrets.SUPPLY_JSON_KEY_DATA }}
        run: bundle exec fastlane deploy_play

      - name: Scrub signing material
        if: always()
        working-directory: apps/app_seeds
        run: rm -f android/key.properties "$GITHUB_WORKSPACE/tane-upload.jks"