name: Release Android

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Java 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"
          cache: gradle

      - name: Set up Android SDK
        uses: android-actions/setup-android@v3

      - name: Accept Android SDK licenses
        run: yes | sdkmanager --licenses >/dev/null

      - name: Install Android SDK packages
        run: sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"

      - name: Ensure scripts are executable
        run: chmod +x gradlew scripts/*.sh

      - name: Build debug APK
        run: ./scripts/build-debug.sh assembleDebug lint

      - name: Decode release keystore
        env:
          RELEASE_KEYSTORE_BASE64: ${{ secrets.RELEASE_KEYSTORE_BASE64 }}
        run: |
          if [ -z "$RELEASE_KEYSTORE_BASE64" ]; then
            echo "::error::RELEASE_KEYSTORE_BASE64 secret is not set; cannot sign the release."
            exit 1
          fi
          echo "$RELEASE_KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.keystore"

      - name: Build release bundle
        env:
          ORG_GRADLE_PROJECT_MYAPP_RELEASE_STORE_FILE: ${{ runner.temp }}/release.keystore
          ORG_GRADLE_PROJECT_MYAPP_RELEASE_STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }}
          ORG_GRADLE_PROJECT_MYAPP_RELEASE_KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
          ORG_GRADLE_PROJECT_MYAPP_RELEASE_KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
        run: ./scripts/build-release.sh bundleRelease lintRelease

      - name: Verify the release bundle is signed
        run: |
          if jarsigner -verify "app/build/outputs/bundle/release/app-release.aab" | grep -q "jar verified"; then
            echo "Release bundle is signed."
          else
            echo "::error::Release bundle is NOT signed."
            exit 1
          fi

      - name: Prepare release assets
        run: |
          mkdir -p dist
          cp app/build/outputs/apk/debug/app-debug.apk "dist/relaytv-${GITHUB_REF_NAME}-debug.apk"
          cp app/build/outputs/bundle/release/app-release.aab "dist/relaytv-${GITHUB_REF_NAME}.aab"

      - name: Upload workflow artifacts
        uses: actions/upload-artifact@v4
        with:
          name: relaytv-${{ github.ref_name }}
          path: dist/*
          if-no-files-found: error

      - name: Publish GitHub release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: |
            dist/relaytv-${{ github.ref_name }}-debug.apk
            dist/relaytv-${{ github.ref_name }}.aab