# Release automation for git.comunes.org (Forgejo Actions).
#
# Password-free: pushing a tag `v*` builds a signed AAB and uploads it to
# Google Play's internal track via fastlane. All credentials come from repo
# secrets (Settings > Actions > Secrets), never typed:
#   FIRES_KEYSTORE_BASE64        base64 of the org.comunes.fires upload keystore
#   FIRES_KEYSTORE_PASSWORD      store password
#   FIRES_KEY_ALIAS              key alias
#   FIRES_KEY_PASSWORD           key password
#   SUPPLY_JSON_KEY_DATA         Google Play service-account JSON (shared Comunes)
#   FIRES_PRIVATE_SETTINGS_JSON  contents of assets/private-settings.json
#   FIRES_GOOGLE_SERVICES_JSON   base64 of android/app/google-services.json
#
# Build + deploy live in ONE job so the AAB never has to cross a job boundary.
# NOTE: `runs-on` must match a label your Forgejo runner registered with.

name: release

on:
  push:
    tags:
      - 'v*'

jobs:
  android:
    runs-on: docker
    container:
      image: ghcr.io/cirruslabs/flutter:3.41.9
    steps:
      # Manual git checkout (no Node): the flutter image has no node, so JS
      # actions like actions/checkout@v4 fail with "exec: node: not found".
      - name: Checkout
        env:
          TOKEN: ${{ github.token }}
        run: |
          git config --global --add safe.directory '*'
          git init -q .
          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
          git fetch -q --depth 1 origin "${GITHUB_SHA}"
          git checkout -q FETCH_HEAD

      - name: Materialize runtime secrets (Firebase + private settings)
        env:
          FIRES_GOOGLE_SERVICES_JSON: ${{ secrets.FIRES_GOOGLE_SERVICES_JSON }}
          FIRES_PRIVATE_SETTINGS_JSON: ${{ secrets.FIRES_PRIVATE_SETTINGS_JSON }}
        run: |
          echo "$FIRES_GOOGLE_SERVICES_JSON" | base64 -d > android/app/google-services.json
          printf '%s' "$FIRES_PRIVATE_SETTINGS_JSON" > assets/private-settings.json

      - name: Materialize signing material from secrets
        env:
          FIRES_KEYSTORE_BASE64: ${{ secrets.FIRES_KEYSTORE_BASE64 }}
          FIRES_KEYSTORE_PASSWORD: ${{ secrets.FIRES_KEYSTORE_PASSWORD }}
          FIRES_KEY_ALIAS: ${{ secrets.FIRES_KEY_ALIAS }}
          FIRES_KEY_PASSWORD: ${{ secrets.FIRES_KEY_PASSWORD }}
        run: |
          echo "$FIRES_KEYSTORE_BASE64" | base64 -d > "$GITHUB_WORKSPACE/fires-upload.jks"
          cat > android/key.properties <<EOF
          storeFile=$GITHUB_WORKSPACE/fires-upload.jks
          storePassword=$FIRES_KEYSTORE_PASSWORD
          keyAlias=$FIRES_KEY_ALIAS
          keyPassword=$FIRES_KEY_PASSWORD
          EOF

      - name: Generate code (json_serializable)
        run: |
          flutter pub get
          dart run build_runner build --delete-conflicting-outputs

      - name: Build signed AAB + APK (production flavor)
        run: |
          flutter build appbundle --release --flavor production -t lib/main_prod.dart
          flutter build apk --release --flavor production -t lib/main_prod.dart

      - name: Install fastlane
        run: |
          apt-get update -qq
          apt-get install -y -qq ruby ruby-dev build-essential
          gem install bundler --no-document
          bundle install

      - name: Publish to Google Play (internal track)
        env:
          SUPPLY_JSON_KEY_DATA: ${{ secrets.SUPPLY_JSON_KEY_DATA }}
        run: bundle exec fastlane deploy_play

      - name: Scrub secrets
        if: always()
        run: |
          rm -f android/key.properties "$GITHUB_WORKSPACE/fires-upload.jks"
          rm -f android/app/google-services.json assets/private-settings.json