name: Mobile Android Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      release_name:
        description: 'Forgejo release name'
        required: false
        default: 'Manual Android Build'
      release_tag:
        description: 'Forgejo release tag'
        required: false
        default: ''

jobs:
  android-release:
    runs-on: forgejo-local

    steps:
      - name: Checkout
        uses: https://github.com/actions/checkout@v4

      - name: Set up Node
        uses: https://github.com/actions/setup-node@v4
        with:
          node-version: '20'

      - name: Set up Java
        uses: https://github.com/actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Android SDK
        uses: https://github.com/android-actions/setup-android@v3

      - name: Validate Android signing secrets
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          test -n "$ANDROID_KEYSTORE_BASE64"
          test -n "$ANDROID_KEYSTORE_PASSWORD"
          test -n "$ANDROID_KEY_ALIAS"
          test -n "$ANDROID_KEY_PASSWORD"

      - name: Build frontend
        working-directory: frontend
        run: |
          npm ci
          npm run build

      - name: Install mobile dependencies
        working-directory: mobile
        run: npm ci

      - name: Decode Android keystore
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: |
          mkdir -p mobile/android/keystore
          printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 -d > mobile/android/keystore/release.jks

      - name: Sync Capacitor Android
        working-directory: mobile
        run: npx cap sync android

      - name: Build signed release APK
        working-directory: mobile/android
        env:
          ANDROID_KEYSTORE_FILE: ${{ github.workspace }}/mobile/android/keystore/release.jks
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
          RELEASE_TAG: ${{ inputs.release_tag }}
        run: |
          chmod +x gradlew
          ./gradlew assembleRelease
          tag="${RELEASE_TAG:-${GITHUB_REF_NAME:-manual}}"
          mkdir -p ../../dist
          cp app/build/outputs/apk/release/app-release.apk ../../dist/pedshub-${tag}.apk

      - name: Create Forgejo release and upload APK
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_NAME: ${{ inputs.release_name }}
          RELEASE_TAG: ${{ inputs.release_tag }}
        run: |
          set -eu
          tag="${RELEASE_TAG:-${GITHUB_REF_NAME:-manual-${GITHUB_RUN_NUMBER}}}"
          apk="dist/pedshub-${tag}.apk"
          name="${RELEASE_NAME:-PedsHub Android ${tag}}"
          body="Automated signed Android APK build for ${tag}."
          api="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}"

          release_json=$(curl -fsS "${api}/releases/tags/${tag}" \
            -H "Authorization: token ${GITHUB_TOKEN}" || true)
          if [ -z "$release_json" ]; then
            payload=$(python3 - <<PY
          import json
          print(json.dumps({
              "tag_name": "${tag}",
              "target_commitish": "${GITHUB_SHA}",
              "name": "${name}",
              "body": "${body}",
              "draft": False,
              "prerelease": False,
          }))
          PY
          )
            release_json=$(curl -fsS -X POST "${api}/releases" \
              -H "Authorization: token ${GITHUB_TOKEN}" \
              -H "Content-Type: application/json" \
              -d "$payload")
          fi

          release_id=$(printf '%s' "$release_json" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
          curl -fsS -X POST "${api}/releases/${release_id}/assets?name=$(basename "$apk")" \
            -H "Authorization: token ${GITHUB_TOKEN}" \
            -H "Content-Type: application/vnd.android.package-archive" \
            --data-binary "@${apk}"