name: Build APK

# Bouwt een getekende release-APK op elke versietag (v0.1.0, …) en op handmatige trigger.
on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

jobs:
  build:
    # amd64-runner (gitea.gompstar.com). Pas dit label aan als de runner daar een
    # andere label gebruikt dan de standaard ubuntu-latest.
    runs-on: ubuntu-latest
    # Image met Android SDK + JDK 17 + Gradle voorgeïnstalleerd.
    container:
      image: mingc/android-build-box:latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # Gitea's auto Actions-token returned 403 on the private repo checkout;
          # use an explicit PAT (repo read) provided as the CI_TOKEN secret.
          token: ${{ secrets.CI_TOKEN }}

      - name: Herstel signing keystore uit secret
        run: |
          echo "$SIGNING_KEYSTORE_BASE64" | base64 -d > "$GITHUB_WORKSPACE/release.jks"
        env:
          SIGNING_KEYSTORE_BASE64: ${{ secrets.SIGNING_KEYSTORE_BASE64 }}

      - name: Genereer Gradle wrapper indien nodig
        run: |
          if [ ! -f gradle/wrapper/gradle-wrapper.jar ]; then
            gradle wrapper --gradle-version 8.11.1
          fi

      - name: Build release APK
        run: |
          chmod +x ./gradlew
          ./gradlew --no-daemon assembleRelease
        env:
          SIGNING_STORE_FILE: ${{ github.workspace }}/release.jks
          SIGNING_STORE_PASSWORD: ${{ secrets.SIGNING_STORE_PASSWORD }}
          SIGNING_KEY_ALIAS: ${{ secrets.SIGNING_KEY_ALIAS }}
          SIGNING_KEY_PASSWORD: ${{ secrets.SIGNING_KEY_PASSWORD }}

      - name: Upload APK als artifact
        uses: actions/upload-artifact@v3
        with:
          name: paperscan-release
          path: app/build/outputs/apk/release/*.apk