android-ci.yml

name: Android CI

on:
  workflow_dispatch:

jobs:
  release-build:
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Check out sources
        uses: actions/checkout@v4

      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "21"
          cache: gradle

      - name: Set up Android SDK
        uses: android-actions/setup-android@v3

      - name: Install Android SDK packages
        run: |
          yes | sdkmanager --licenses > /dev/null
          sdkmanager "platform-tools" "platforms;android-36" "build-tools;36.0.0"

      - name: Validate signing secrets
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          RELEASE_KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
          RELEASE_KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
          RELEASE_STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }}
        run: |
          for secret_name in ANDROID_KEYSTORE_BASE64 RELEASE_KEY_ALIAS RELEASE_KEY_PASSWORD RELEASE_STORE_PASSWORD; do
            if [ -z "${!secret_name}" ]; then
              echo "$secret_name is not configured" >&2
              exit 1
            fi
          done

      - name: Decode release keystore
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: |
          echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > "$RUNNER_TEMP/release.keystore"
          echo "RELEASE_KEYSTORE_PATH=$RUNNER_TEMP/release.keystore" >> "$GITHUB_ENV"

      - name: Build release APK
        env:
          RELEASE_KEYSTORE_PATH: ${{ env.RELEASE_KEYSTORE_PATH }}
          RELEASE_KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
          RELEASE_KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
          RELEASE_STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }}
        run: ./gradlew --stacktrace app:assembleRelease

      - name: Prepare release APK artifact
        id: artifact
        shell: bash
        run: |
          set -euo pipefail
          version_name="$(sed -n 's/.*versionName = "\([^"]*\)".*/\1/p' app/build.gradle.kts | head -n 1)"
          if [ -z "$version_name" ]; then
            echo "Failed to read versionName from app/build.gradle.kts" >&2
            exit 1
          fi

          short_sha="${GITHUB_SHA::7}"
          apk_name="MaterialXray-v${version_name}-${short_sha}.apk"
          apk_path="app/build/outputs/apk/release/${apk_name}"
          cp app/build/outputs/apk/release/app-release.apk "$apk_path"

          echo "apk_name=$apk_name" >> "$GITHUB_OUTPUT"
          echo "apk_path=$apk_path" >> "$GITHUB_OUTPUT"
          echo "version_tag=v$version_name" >> "$GITHUB_OUTPUT"

      - name: Upload release APK
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.artifact.outputs.apk_name }}
          path: ${{ steps.artifact.outputs.apk_path }}
          if-no-files-found: error

      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION_TAG: ${{ steps.artifact.outputs.version_tag }}
          APK_PATH: ${{ steps.artifact.outputs.apk_path }}
          APK_NAME: ${{ steps.artifact.outputs.apk_name }}
        run: |
          set -euo pipefail
          if gh release view "$VERSION_TAG" >/dev/null 2>&1; then
            gh release upload "$VERSION_TAG" "$APK_PATH#${APK_NAME}" --clobber
          else
            gh release create "$VERSION_TAG" "$APK_PATH#${APK_NAME}" \
              --target "$GITHUB_SHA" \
              --title "$VERSION_TAG" \
              --generate-notes
          fi