name: Build APK

# Builds a signed release APK on every version tag (v0.1.0, …) and on manual trigger.
on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

jobs:
  build:
    # Dedicated x86_64 runner (LXC on Proxmox) — the global ARM64 runners don't have
    # this label, so they won't pick up this job.
    runs-on: paperscan
    # Let the automatic Actions token create a release + upload assets.
    permissions:
      contents: write
    # Image with Android SDK + JDK 17 + Gradle preinstalled.
    container:
      image: mingc/android-build-box:latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Restore signing keystore from secret
        run: |
          echo "$SIGNING_KEYSTORE_BASE64" | base64 -d > "$GITHUB_WORKSPACE/release.jks"
        env:
          SIGNING_KEYSTORE_BASE64: ${{ secrets.SIGNING_KEYSTORE_BASE64 }}

      - name: Generate Gradle wrapper if needed
        run: |
          if [ ! -f gradle/wrapper/gradle-wrapper.jar ]; then
            gradle wrapper --gradle-version 8.11.1
          fi

      - name: Build release APK
        run: |
          chmod +x ./gradlew
          ./gradlew --no-daemon assembleRelease
        env:
          SIGNING_STORE_FILE: ${{ github.workspace }}/release.jks
          SIGNING_STORE_PASSWORD: ${{ secrets.SIGNING_STORE_PASSWORD }}
          SIGNING_KEY_ALIAS: ${{ secrets.SIGNING_KEY_ALIAS }}
          SIGNING_KEY_PASSWORD: ${{ secrets.SIGNING_KEY_PASSWORD }}

      - name: Publish release with APK as a download
        env:
          TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
          API: ${{ github.api_url }}/repos/${{ github.repository }}
        run: |
          set -e
          APK=$(ls app/build/outputs/apk/release/*.apk | head -1)
          AUTH="Authorization: token $TOKEN"

          # Reuse an existing release for this tag, or create it.
          REL_ID=$(curl -sS -H "$AUTH" "$API/releases/tags/$TAG" | grep -oP '"id":\s*\K[0-9]+' | head -1 || true)
          if [ -z "$REL_ID" ]; then
            REL_ID=$(curl -sS -X POST "$API/releases" -H "$AUTH" -H "Content-Type: application/json" \
              -d "{\"tag_name\":\"$TAG\",\"name\":\"PaperScan $TAG\",\"body\":\"Automated build of $TAG.\"}" \
              | grep -oP '"id":\s*\K[0-9]+' | head -1)
          fi
          echo "Release id: $REL_ID"

          # Remove any existing asset with the same name (on re-run/re-tag).
          ASSET_NAME="paperscan-$TAG.apk"
          OLD=$(curl -sS -H "$AUTH" "$API/releases/$REL_ID/assets" \
            | grep -oP "\"id\":\s*\K[0-9]+(?=[^}]*\"name\":\s*\"$ASSET_NAME\")" | head -1 || true)
          if [ -n "$OLD" ]; then curl -sS -X DELETE -H "$AUTH" "$API/releases/$REL_ID/assets/$OLD"; fi

          # Upload the signed APK as a downloadable asset.
          curl -sS -X POST "$API/releases/$REL_ID/assets?name=$ASSET_NAME" \
            -H "$AUTH" -H "Content-Type: application/octet-stream" \
            --data-binary @"$APK" | grep -oP '"browser_download_url":\s*"\K[^"]+' || true