ci.yml

# PULSE_KEYSTORE_BASE64 secret exists in THIS repository.
name: CI

on:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  ci:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: android-app

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup JDK 17
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v6
        with:
          gradle-version: '8.13'
          cache-provider: basic

      - name: Install Android SDK 36
        run: |
          SDKMGR="${ANDROID_HOME:-${ANDROID_SDK_ROOT}}/cmdline-tools/latest/bin/sdkmanager"
          if [ ! -x "$SDKMGR" ]; then SDKMGR="$(command -v sdkmanager || true)"; fi
          if [ -z "$SDKMGR" ]; then echo "::error::sdkmanager not found"; exit 1; fi
          yes | "$SDKMGR" --licenses
          yes | "$SDKMGR" "platforms;android-36" "build-tools;36.0.0" "platform-tools"

      - name: Build (test, lint, assemble)
        id: build
        run: |
          set +e
          gradle :app:testDebugUnitTest :app:lintDebug :app:assembleDebug --no-daemon --console=plain --stacktrace 2>&1 | tee "${RUNNER_TEMP}/build.log"
          code=${PIPESTATUS[0]}
          echo "gradle_exit=$code" >> "$GITHUB_OUTPUT"
          exit $code

      - name: Upload APK
        if: success()
        uses: actions/upload-artifact@v4
        with:
          name: app-debug
          path: android-app/**/build/outputs/apk/debug/app-debug.apk
          if-no-files-found: error

      - name: Build signed release (only when the keystore secret exists)
        id: release
        if: success()
        env:
          KS_B64: ${{ secrets.PULSE_KEYSTORE_BASE64 }}
          PULSE_KEYSTORE_PASSWORD: ${{ secrets.PULSE_KEYSTORE_PASSWORD }}
          PULSE_KEY_ALIAS: ${{ secrets.PULSE_KEY_ALIAS }}
          PULSE_KEY_PASSWORD: ${{ secrets.PULSE_KEY_PASSWORD }}
        run: |
          if [ -z "$KS_B64" ]; then
            echo "No keystore secret: skipping the signed release build."
            echo "built=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          export PULSE_KEYSTORE_PATH="${RUNNER_TEMP}/release.jks"
          echo "$KS_B64" | base64 -d > "$PULSE_KEYSTORE_PATH"
          gradle :app:assembleRelease --no-daemon --console=plain --stacktrace 2>&1 | tee -a "${RUNNER_TEMP}/build.log"
          code=${PIPESTATUS[0]}
          rm -f "$PULSE_KEYSTORE_PATH"
          if [ "$code" -ne 0 ]; then exit "$code"; fi
          apk="app/build/outputs/apk/release/app-release.apk"
          if [ ! -f "$apk" ]; then echo "::error::signed APK missing (check alias / passwords)"; exit 1; fi
          BT="${ANDROID_HOME:-${ANDROID_SDK_ROOT}}/build-tools/36.0.0"
          "$BT/apksigner" verify --print-certs "$apk" | tee -a "$GITHUB_STEP_SUMMARY"
          echo "built=true" >> "$GITHUB_OUTPUT"

      - name: Upload signed release APK
        if: steps.release.outputs.built == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: app-release
          path: android-app/app/build/outputs/apk/release/app-release.apk
          if-no-files-found: error

      - name: Upload build log
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: build-log
          path: ${{ runner.temp }}/build.log

      - name: Write failure summary
        if: failure()
        run: |
          {
            echo "## VOID // APPS build failed (gradle exit ${{ steps.build.outputs.gradle_exit }})"
            echo
            echo '```'
            tail -n 40 "${RUNNER_TEMP}/build.log"
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"