ci-cd.yml

name: Release — build & publish

on:
  push:
    tags:
      - 'v*'

jobs:
  release:
    name: Build signed APK/AAB & publish
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Validate release tag
        run: |
          git fetch origin master --no-tags
          git merge-base --is-ancestor "$GITHUB_SHA" FETCH_HEAD
          VERSION_CODE=$(sed -nE 's/^def appVersionCode = ([0-9]+)$/\1/p' app/build.gradle)
          VERSION_TEMPLATE=$(sed -nE 's/^def appVersionName = "([^"]+)"$/\1/p' app/build.gradle)
          VERSION=${VERSION_TEMPLATE//\$\{appVersionCode\}/$VERSION_CODE}
          test -n "$VERSION"
          test "$GITHUB_REF_NAME" = "v$VERSION"

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      - name: Cache Gradle
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: ${{ runner.os }}-gradle-

      - name: Accept SDK licenses & install platform
        run: |
          yes | $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager --licenses > /dev/null 2>&1
          $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager \
            --channel=3 \
            "platforms;android-37" \
            "build-tools;35.0.0" \
            > /dev/null 2>&1 || true

      - name: Make gradlew executable
        run: chmod +x ./gradlew

      - name: Decode google-services.json
        env:
          GOOGLE_SERVICES_JSON: ${{ secrets.GOOGLE_SERVICES_JSON }}
        run: |
          # Kept out of the repository and injected here. A fork or a pull request from a fork
          # gets no secrets, and the build is deliberately able to run without the file: sign-in
          # and Drive sync are simply disabled in that case.
          if [ -n "$GOOGLE_SERVICES_JSON" ]; then
            echo "$GOOGLE_SERVICES_JSON" | base64 -d > app/google-services.json
            echo "google-services.json restored from the repository secret."
          else
            echo "GOOGLE_SERVICES_JSON is not available; building without Firebase."
          fi

      - name: Decode keystore
        run: echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > /tmp/release.jks

      - name: Run release safety gate
        run: ./gradlew test lint assembleRelease --no-daemon --stacktrace

      - name: Build signed release APK & AAB
        env:
          KEYSTORE_PATH: /tmp/release.jks
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: ./gradlew assembleRelease bundleRelease --no-daemon

      - name: Collect artifacts
        run: |
          mkdir -p artifacts
          cp app/build/outputs/apk/release/*.apk \
             "artifacts/MyNotes-${{ github.ref_name }}.apk"
          cp app/build/outputs/bundle/release/*.aab \
             "artifacts/MyNotes-${{ github.ref_name }}.aab"

      - name: Generate English release notes from changelog
        id: notes
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          awk -v version="$VERSION" '
            $0 == "## [" version "]" || index($0, "## [" version "] -") == 1 { in_version = 1; next }
            in_version && /^## \[/ { exit }
            in_version { print }
          ' CHANGELOG.md > release-notes.md
          test -s release-notes.md

          mkdir -p distribution/whatsnew
          python3 - <<'PY'
          from pathlib import Path
          import re

          sections = []
          section = None
          bullet = None
          for raw_line in Path("release-notes.md").read_text(encoding="utf-8").splitlines():
              line = raw_line.strip()
              if not line:
                  continue
              heading = re.fullmatch(r"\*\*(.+?)\*\*", line)
              if heading:
                  section = heading.group(1)
                  continue
              if line.startswith("- "):
                  bullet = [line[2:]]
                  sections.append((section, bullet))
              elif bullet is not None:
                  bullet.append(line)

          def shorten(text, limit=140):
              text = re.sub(r"\*\*(.*?)\*\*", r"\1", " ".join(text))
              text = re.sub(r"\s+", " ", text).strip()
              if len(text) <= limit:
                  return text
              return text[: limit - 1].rsplit(" ", 1)[0] + "…"

          seen_sections = set()
          highlights = []
          for category, lines in sections:
              category = category or "Updates"
              if category in seen_sections:
                  continue
              seen_sections.add(category)
              highlights.append(f"• {category} — {shorten(lines)}")

          selected = []
          for highlight in highlights:
              candidate = "\n".join(selected + [highlight])
              if len(candidate) > 500:
                  break
              selected.append(highlight)
          Path("distribution/whatsnew/whatsnew-en-US").write_text(
              "\n".join(selected), encoding="utf-8"
          )
          PY

          {
            echo 'notes<<EOF'
            cat release-notes.md
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"

      - name: Authenticate to Google Cloud
        id: google-auth
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ vars.GOOGLE_CLOUD_PROJECT_ID }}
          workload_identity_provider: ${{ vars.GOOGLE_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ vars.GOOGLE_PLAY_SERVICE_ACCOUNT_EMAIL }}
          create_credentials_file: true

      - name: Publish AAB to Google Play closed testing
        uses: r0adkll/upload-google-play@v1.1.5
        with:
          serviceAccountJson: ${{ steps.google-auth.outputs.credentials_file_path }}
          packageName: com.pasich.mynotes
          releaseFiles: artifacts/MyNotes-${{ github.ref_name }}.aab
          tracks: ${{ vars.GOOGLE_PLAY_CLOSED_TRACK }}
          status: completed
          whatsNewDirectory: distribution/whatsnew

      - name: Create GitHub Release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ github.ref_name }}
          name: "MyNotes ${{ github.ref_name }}"
          body: ${{ steps.notes.outputs.notes }}
          artifacts: "artifacts/*"
          artifactErrorsFailBuild: true
          makeLatest: true
          token: ${{ secrets.GITHUB_TOKEN }}