release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  android:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Check out source
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false

      - name: Validate Gradle wrapper
        uses: gradle/actions/wrapper-validation@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4

      - name: Set up Java
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
        with:
          distribution: temurin
          java-version: "21"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4

      - name: Validate release tag
        shell: bash
        run: |
          if [[ ! "$GITHUB_REF_NAME" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
            echo "Release tag must use the form v1.2.3." >&2
            exit 1
          fi

      - name: Check the app
        run: ./gradlew :app:check --no-daemon

      - name: Restore release signing key
        shell: bash
        env:
          KEYSTORE_BASE64: ${{ secrets.ANDROID_RELEASE_KEYSTORE_BASE64 }}
          STORE_PASSWORD: ${{ secrets.ANDROID_RELEASE_STORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.ANDROID_RELEASE_KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.ANDROID_RELEASE_KEY_PASSWORD }}
        run: |
          for value in "$KEYSTORE_BASE64" "$STORE_PASSWORD" "$KEY_ALIAS" "$KEY_PASSWORD"; do
            if [[ -z "$value" ]]; then
              echo "Android release-signing secrets are not configured." >&2
              exit 1
            fi
          done

          keystore="$RUNNER_TEMP/codeg-release.jks"
          printf '%s' "$KEYSTORE_BASE64" | base64 --decode > "$keystore"
          chmod 600 "$keystore"
          {
            printf 'storeFile=%s\n' "$keystore"
            printf 'storePassword=%s\n' "$STORE_PASSWORD"
            printf 'keyAlias=%s\n' "$KEY_ALIAS"
            printf 'keyPassword=%s\n' "$KEY_PASSWORD"
          } > keystore.properties
          chmod 600 keystore.properties

      - name: Build the signed APK
        run: ./gradlew :app:assembleRelease --no-daemon

      - name: Verify and package the APK
        id: package
        shell: bash
        run: |
          source_apk="app/build/outputs/apk/release/app-release.apk"
          test -f "$source_apk"

          apksigner=$(find "$ANDROID_HOME/build-tools" -type f -name apksigner | sort -V | tail -n 1)
          if [[ -z "$apksigner" ]]; then
            echo "Android apksigner was not found." >&2
            exit 1
          fi
          signature_report=$("$apksigner" verify --verbose --print-certs "$source_apk")
          printf '%s\n' "$signature_report"
          if ! grep -Fqx 'Verified using v2 scheme (APK Signature Scheme v2): true' <<< "$signature_report"; then
            echo "Release APK is not signed with APK Signature Scheme v2." >&2
            exit 1
          fi

          aapt="$(dirname "$apksigner")/aapt"
          version_name=$(
            "$aapt" dump badging "$source_apk" |
              sed -n "s/^package:.*versionName='\([^']*\)'.*/\1/p"
          )
          expected_version="${GITHUB_REF_NAME#v}"
          if [[ "$version_name" != "$expected_version" ]]; then
            echo "Tag $GITHUB_REF_NAME does not match APK version $version_name." >&2
            exit 1
          fi

          release_dir="$RUNNER_TEMP/release"
          release_apk="$release_dir/codeg-android-$GITHUB_REF_NAME.apk"
          checksum="$release_apk.sha256"
          mkdir -p "$release_dir"
          cp "$source_apk" "$release_apk"
          (
            cd "$release_dir"
            sha256sum "$(basename "$release_apk")" > "$(basename "$checksum")"
          )
          printf 'apk=%s\nchecksum=%s\n' "$release_apk" "$checksum" >> "$GITHUB_OUTPUT"

      - name: Remove signing material
        if: always()
        run: rm -f keystore.properties "$RUNNER_TEMP/codeg-release.jks"

      - name: Upload workflow artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: codeg-android-${{ github.ref_name }}
          path: |
            ${{ steps.package.outputs.apk }}
            ${{ steps.package.outputs.checksum }}
          if-no-files-found: error
          retention-days: 30

      - name: Prepare draft GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            gh release edit "$GITHUB_REF_NAME" \
              --repo "$GITHUB_REPOSITORY" \
              --verify-tag \
              --draft \
              --title "Codeg for Android $GITHUB_REF_NAME"
          else
            gh release create "$GITHUB_REF_NAME" \
              --repo "$GITHUB_REPOSITORY" \
              --verify-tag \
              --draft \
              --title "Codeg for Android $GITHUB_REF_NAME" \
              --generate-notes
          fi

      - name: Upload GitHub Release assets
        env:
          GH_TOKEN: ${{ github.token }}
          APK_PATH: ${{ steps.package.outputs.apk }}
          CHECKSUM_PATH: ${{ steps.package.outputs.checksum }}
        run: |
          gh release upload "$GITHUB_REF_NAME" \
            "$APK_PATH#Android APK" \
            "$CHECKSUM_PATH#SHA-256 checksum" \
            --repo "$GITHUB_REPOSITORY" \
            --clobber

      - name: Publish GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release edit "$GITHUB_REF_NAME" \
            --repo "$GITHUB_REPOSITORY" \
            --verify-tag \
            --draft=false \
            --latest=false

      - name: Select latest GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          release_tags=""
          for attempt in {1..13}; do
            if release_tags=$(
              gh api --paginate "repos/$GITHUB_REPOSITORY/releases?per_page=100" \
                --jq '.[] | select(.draft == false and .prerelease == false) | .tag_name'
            ) && grep -Fqx "$GITHUB_REF_NAME" <<< "$release_tags"; then
              break
            fi
            release_tags=""
            if [[ "$attempt" -eq 13 ]]; then
              echo "Published release $GITHUB_REF_NAME did not become visible through the API." >&2
              exit 1
            fi
            sleep 5
          done
          latest_tag=$(
            printf '%s\n' "$release_tags" |
              grep -E '^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$' |
              sort -V |
              tail -n 1
          )
          if [[ -z "$latest_tag" ]]; then
            echo "No published semantic-version release was found." >&2
            exit 1
          fi
          gh release edit "$latest_tag" \
            --repo "$GITHUB_REPOSITORY" \
            --latest