android-release.yml

name: Android Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version name for the APK (e.g. 1.0.0)'
        required: true

permissions:
  contents: write

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      - uses: gradle/actions/setup-gradle@v4

      - name: Resolve version
        id: version
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "name=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
            echo "tag=v${{ inputs.version }}" >> "$GITHUB_OUTPUT"
          else
            TAG="${GITHUB_REF#refs/tags/}"
            echo "name=${TAG#v}" >> "$GITHUB_OUTPUT"
            echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          fi

      - name: Decode keystore
        env:
          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
        run: |
          if [ -z "$KEYSTORE_BASE64" ]; then
            echo "::error::KEYSTORE_BASE64 secret is not set. See CLAUDE.md for setup."
            exit 1
          fi
          echo "$KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.jks"

      - name: Build signed release APK
        working-directory: android
        env:
          KEYSTORE_FILE: ${{ runner.temp }}/release.jks
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: |
          ./gradlew :composeApp:assembleRelease \
            -PappVersionName="${{ steps.version.outputs.name }}" \
            -PappVersionCode="${{ github.run_number }}"

      # Fails loudly rather than publishing an unsigned APK if a secret is missing.
      - name: Verify signature
        run: |
          APK=android/composeApp/build/outputs/apk/release/composeApp-release.apk
          if [ ! -f "$APK" ]; then
            echo "::error::Expected $APK but it does not exist — the build produced an unsigned APK."
            ls -la android/composeApp/build/outputs/apk/release/
            exit 1
          fi
          APKSIGNER=$(ls "$ANDROID_HOME"/build-tools/*/apksigner | tail -1)
          "$APKSIGNER" verify --print-certs "$APK"
          mv "$APK" "wiselens-${{ steps.version.outputs.name }}.apk"

      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "${{ steps.version.outputs.tag }}" \
            --title "WiseLens ${{ steps.version.outputs.name }}" \
            --generate-notes \
            "wiselens-${{ steps.version.outputs.name }}.apk"