release.yml

name: Release

# Serialize release builds per tag but NEVER cancel one in flight — a half-built
# release + partial GitHub Release upload is worse than a redundant run.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

# Builds the Android app package when a version tag is pushed, and attaches the
# artifacts to a GitHub Release. Tag with: git tag v0.1.0 && git push --tags
#
# DORMANT UNTIL TAGGED: only runs on v* tags, which won't be pushed until the
# Gradle project exists. Builds an UNSIGNED release by default — add a signing
# keystore (base64) + passwords as repo secrets and a signingConfig before any
# Play Store upload.

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: write   # needed to create the GitHub Release

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Setup JDK
        uses: actions/setup-java@v6.1.0
        with:
          distribution: temurin
          java-version: '17'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v6

      # The tag is the release's public identity, but the APK's identity comes
      # from build.gradle.kts — and those silently drifted apart once (v0.1.22
      # first shipped identifying as 0.1.20/code 21, which would have muted the
      # in-app update prompt entirely). Fail the release loudly when the tag and
      # versionName disagree instead of publishing a mislabeled APK.
      - name: Verify tag matches versionName
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          GRADLE_VERSION=$(sed -n 's/^[[:space:]]*versionName = "\(.*\)"/\1/p' app/build.gradle.kts)
          echo "tag=$TAG_VERSION gradle=$GRADLE_VERSION"
          if [ "$TAG_VERSION" != "$GRADLE_VERSION" ]; then
            echo "::error::Tag v$TAG_VERSION does not match versionName $GRADLE_VERSION in app/build.gradle.kts — bump the version (and versionCode) before tagging."
            exit 1
          fi

      # No signing secret → fail loudly with a clear message rather than a cryptic
      # keystore error. A release genuinely needs the keystore, so this is fatal
      # (unlike the CI APK step, which is optional and skipped on fork PRs).
      - name: Require signing secret
        env:
          DEBUG_KEYSTORE_B64: ${{ secrets.DEBUG_KEYSTORE_B64 }}
        run: |
          if [ -z "$DEBUG_KEYSTORE_B64" ]; then
            echo "::error::DEBUG_KEYSTORE_B64 is not set — a release build needs the signing keystore."
            exit 1
          fi

      - name: Restore debug keystore
        env:
          DEBUG_KEYSTORE_B64: ${{ secrets.DEBUG_KEYSTORE_B64 }}
        run: |
          mkdir -p ~/.android
          echo "$DEBUG_KEYSTORE_B64" | base64 -d > ~/.android/inventory-debug.jks

      - name: Build APK
        run: ./gradlew assembleDebug
        env:
          DEBUG_KEYSTORE_PASSWORD: ${{ secrets.DEBUG_KEYSTORE_PASSWORD }}
          DEBUG_KEY_ALIAS: ${{ secrets.DEBUG_KEY_ALIAS }}
          DEBUG_KEY_PASSWORD: ${{ secrets.DEBUG_KEY_PASSWORD }}

      # This attaches a DEBUG-signed APK, not a Play-ready release. Mark it a
      # prerelease and say so in the notes, so nobody mistakes it for a production
      # build. Real release signing + AAB is tracked in ROADMAP.
      - name: Create GitHub Release (preview)
        uses: softprops/action-gh-release@v3
        with:
          files: app/build/outputs/apk/debug/app-debug.apk
          generate_release_notes: true
          prerelease: true
          body: |
            ⚠️ **Preview build** — this is a **debug-signed** `app-debug.apk` for testing,
            not a Play-ready release. Production release signing + AAB is tracked in `ROADMAP.md`.