name: Release App

on:
  push:
    # Cannot filter on both branches (release) and tags - it's ORed
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-rc\.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-rc\.[0-9]+\.[0-9]+'

env:
  # Our build metadata
  BUILD_USER: android-builder
  BUILD_HOST: github.syncthing.net

jobs:
  release:
    name: Release Build and Publish
    runs-on: ubuntu-latest
    container: ghcr.io/catfriend1/syncthing-android-builder
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0

      - name: Ensure release branch
        run: |
          git config --system --add safe.directory '*'
          if ! git branch -a --contains $(git rev-parse HEAD) | grep release >/dev/null; then
            echo "Tag is not part of release branch - aborting..."
            exit 1
          fi

      - name: Get app version from build.gradle.kts
        id: get_version
        run: |
          set -eu
          VERSION_MAJOR=$(grep 'set("versionMajor"' build.gradle.kts | grep -o '[0-9]\+')
          VERSION_MINOR=$(grep 'set("versionMinor"' build.gradle.kts | grep -o '[0-9]\+')
          VERSION_PATCH=$(grep 'set("versionPatch"' build.gradle.kts | grep -o '[0-9]\+')
          VERSION_WRAPPER=$(grep 'set("versionWrapper"' build.gradle.kts | grep -o '[0-9]\+')
          VERSION="$VERSION_MAJOR.$VERSION_MINOR.$VERSION_PATCH.$VERSION_WRAPPER"
          echo "VERSION=$VERSION" >> $GITHUB_ENV

      - name: Get commit hash
        id: get_commit_hash
        run: |
          set -eu
          COMMIT_HASH=$(git rev-parse --short --verify HEAD)
          echo "COMMIT_HASH=$COMMIT_HASH" >> $GITHUB_ENV

      - name: build_release
        env:
          SYNCTHING_RELEASE_KEY_ALIAS: Syncthing-Fork
          SIGNING_PASSWORD: '${{ secrets.SIGNING_PASSWORD }}'
          SYNCTHING_RELEASE_STORE_FILE: '${{ runner.temp }}/signing-keystore.jks'
        shell: bash
        run: |
          set -eu
          echo '${{ secrets.SIGNING_KEYSTORE_JKS_BASE64 }}' | base64 -d > "$SYNCTHING_RELEASE_STORE_FILE"
          java -version
          ./gradlew --no-daemon buildNative lintRelease assembleRelease bundlegplay
          rm "$SYNCTHING_RELEASE_STORE_FILE"

      - name: prepare-artifacts
        shell: bash
        run: |
          set -eu
          #
          mv "app/build/outputs/apk/release/app-release.apk" "app/build/outputs/apk/release/com.github.catfriend1.syncthingandroid_release_v${{ env.VERSION }}_${{ env.COMMIT_HASH }}.apk"
          mv "app/build/outputs/bundle/gplay/app-gplay.aab" "app/build/outputs/bundle/gplay/com.github.catfriend1.syncthingandroid_gplay_v${{ env.VERSION }}_${{ env.COMMIT_HASH }}.aab"
          #
          cd "app/build/outputs/apk/release"
          echo '${{ secrets.GNUPG_SIGNING_KEY_BASE64 }}' | base64 -d | gpg --import
          sha256sum "com.github.catfriend1.syncthingandroid_release_v${{ env.VERSION }}_${{ env.COMMIT_HASH }}.apk" | gpg --clearsign > sha256sum.txt.asc

      - uses: ncipollo/release-action@v1
        with:
          artifacts: "app/build/outputs/apk/release/*.apk,app/build/outputs/apk/release/*.asc,app/build/outputs/bundle/gplay/*.aab"
          artifactErrorsFailBuild: true
          name: Syncthing-Fork v${{ env.VERSION }}
          bodyFile: "app/src/main/play/release-notes/en-US/default.txt"
          prerelease: ${{ contains('-rc.', github.ref_name) }}
          draft: true
