pediatric-ai-scribe-v3/.forgejo/workflows/android-apk.yml

name: Forgejo Android APK

on:
  workflow_dispatch:
  push:
    branches:
      - '**'
    tags:
      - 'v*'

jobs:
  build:
    name: Build signed APK
    runs-on: forgejo-local
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up JDK 17
        uses: https://github.com/actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Node 20
        uses: https://github.com/actions/setup-node@v4
        with:
          node-version: '20'
          cache: npm
          cache-dependency-path: mobile/package-lock.json

      - name: Set up Android SDK
        uses: https://github.com/android-actions/setup-android@v3

      - name: Install Capacitor dependencies
        working-directory: mobile
        run: |
          npm install --no-audit --no-fund
          npx cap sync android          

      - name: Restore signing keystore
        env:
          KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: |
          test -n "$KEYSTORE_B64"
          CLEAN_KEYSTORE_B64="${KEYSTORE_B64#ANDROID_KEYSTORE_BASE64=}"
          printf '%s' "$CLEAN_KEYSTORE_B64" | tr -d '\r\n' | base64 -d > "$RUNNER_TEMP/pedscribe-release.jks"
          test -s "$RUNNER_TEMP/pedscribe-release.jks"          

      - name: Build signed release APK
        working-directory: mobile/android
        env:
          KS_PASS: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          KEY_PASS: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          ./gradlew assembleRelease \
            -Pandroid.injected.signing.store.file="$RUNNER_TEMP/pedscribe-release.jks" \
            -Pandroid.injected.signing.store.password="$KS_PASS" \
            -Pandroid.injected.signing.key.alias="$KEY_ALIAS" \
            -Pandroid.injected.signing.key.password="$KEY_PASS" \
            --no-daemon --stacktrace          

      - name: Check Google Play secret
        id: play_publish
        run: |
          if [[ "$GITHUB_REF" != refs/tags/v* ]]; then
            echo "enabled=false" >> "$GITHUB_OUTPUT"
          elif [ -z "${GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_B64:-}" ]; then
            echo "enabled=false" >> "$GITHUB_OUTPUT"
          else
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          fi          
        env:
          GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_B64: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_B64 }}

      - name: Build signed release App Bundle
        if: steps.play_publish.outputs.enabled == 'true'
        working-directory: mobile/android
        env:
          KS_PASS: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          KEY_PASS: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          ./gradlew bundleRelease \
            -Pandroid.injected.signing.store.file="$RUNNER_TEMP/pedscribe-release.jks" \
            -Pandroid.injected.signing.store.password="$KS_PASS" \
            -Pandroid.injected.signing.key.alias="$KEY_ALIAS" \
            -Pandroid.injected.signing.key.password="$KEY_PASS" \
            --no-daemon --stacktrace          

      - name: Install fastlane
        if: steps.play_publish.outputs.enabled == 'true'
        working-directory: mobile/android
        run: |
          gem install bundler -N
          bundle install          

      - name: Upload bundle to Google Play (internal track)
        if: steps.play_publish.outputs.enabled == 'true'
        working-directory: mobile/android
        env:
          GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_B64: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_B64 }}
          PLAY_TRACK: internal
        run: |
          test -n "$GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_B64"

          CLEAN_PLAY_JSON_B64="${GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_B64#GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_B64=}"
          printf '%s' "$CLEAN_PLAY_JSON_B64" | tr -d '\r\n' | base64 -d > fastlane/google-play-service-account.json

          AAB=$(find app/build/outputs/bundle/release -name '*.aab' | head -1)
          test -n "$AAB"

          AAB_PATH="$AAB" bundle exec fastlane android publish_internal

          rm -f fastlane/google-play-service-account.json          

      - name: Collect APK
        run: |
          mkdir -p artifacts
          APK=$(find mobile/android/app/build/outputs/apk/release -name '*.apk' | head -1)
          test -n "$APK"
          cp "$APK" "artifacts/pedscribe-${GITHUB_REF_NAME:-manual}.apk"          

      - name: Upload APK artifact
        uses: https://github.com/actions/upload-artifact@v3
        with:
          name: pedscribe-android-apk
          path: artifacts/*.apk
          retention-days: 30

      - name: Publish Forgejo release
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
          TAG_NAME: ${{ github.ref_name }}
          TARGET_COMMIT: ${{ github.sha }}
        run: |
          test -n "$FORGEJO_TOKEN"
          API_URL="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
          APK=$(find artifacts -name '*.apk' | head -1)
          test -n "$APK"

          node - <<'NODE'
          const fs = require('fs');
          fs.writeFileSync('release-payload.json', JSON.stringify({
            tag_name: process.env.TAG_NAME,
            target_commitish: process.env.TARGET_COMMIT,
            name: process.env.TAG_NAME,
            body: 'Signed Android APK for Obtainium updates.',
            draft: false,
            prerelease: false,
          }));
          NODE

          status=$(curl -sS -o release.json -w '%{http_code}' \
            -X POST "$API_URL/releases" \
            -H "Authorization: token $FORGEJO_TOKEN" \
            -H 'Content-Type: application/json' \
            --data-binary @release-payload.json)
          if [ "$status" = "409" ]; then
            curl -fsS "$API_URL/releases/tags/$TAG_NAME" \
              -H "Authorization: token $FORGEJO_TOKEN" > release.json
          elif [ "$status" != "201" ]; then
            cat release.json
            exit 1
          fi

          RELEASE_ID=$(node -e "console.log(JSON.parse(require('fs').readFileSync('release.json', 'utf8')).id)")
          ASSET_NAME=$(basename "$APK")
          export ASSET_NAME
          curl -fsS "$API_URL/releases/$RELEASE_ID/assets" \
            -H "Authorization: token $FORGEJO_TOKEN" > release-assets.json
          EXISTING_ASSET_ID=$(node -e "const fs=require('fs'); const name=process.env.ASSET_NAME; const assets=JSON.parse(fs.readFileSync('release-assets.json','utf8')); const asset=assets.find((item)=>item.name===name); if (asset) console.log(asset.id);" )
          if [ -n "$EXISTING_ASSET_ID" ]; then
            curl -fsS -X DELETE "$API_URL/releases/$RELEASE_ID/assets/$EXISTING_ASSET_ID" \
              -H "Authorization: token $FORGEJO_TOKEN"
          fi

          curl -fsS -X POST "$API_URL/releases/$RELEASE_ID/assets?name=$ASSET_NAME" \
            -H "Authorization: token $FORGEJO_TOKEN" \
            -F "attachment=@$APK" > release-asset.json