name: Maintainer release build (never publishes)
on:
  workflow_dispatch:
    inputs:
      sign_android:
        description: Sign APK and AAB using the protected release environment
        type: boolean
        default: false
permissions:
  contents: read
jobs:
  android:
    runs-on: ubuntu-24.04
    environment: release
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3
        with:
          distribution: temurin
          java-version: '17'
      - run: bash android/gradlew -p android testDebugUnitTest lintRelease assembleRelease bundleRelease
      - name: Sign with maintainer-supplied credentials
        if: inputs.sign_android
        env:
          KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
          KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
          KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
        run: |
          set -euo pipefail
          umask 077
          test -n "$KEYSTORE_BASE64" && test -n "$STORE_PASSWORD" && test -n "$KEY_PASSWORD" && test -n "$KEY_ALIAS"
          trap 'rm -f "$RUNNER_TEMP/release.jks"' EXIT
          printf '%s' "$KEYSTORE_BASE64" | base64 --decode > "$RUNNER_TEMP/release.jks"
          tools="$ANDROID_HOME/build-tools/36.0.0"
          "$tools/zipalign" -p -f 4 android/app/build/outputs/apk/release/app-release-unsigned.apk "$RUNNER_TEMP/aligned.apk"
          "$tools/apksigner" sign --ks "$RUNNER_TEMP/release.jks" --ks-key-alias "$KEY_ALIAS" --ks-pass env:STORE_PASSWORD --key-pass env:KEY_PASSWORD --out android/app/build/outputs/apk/release/yuvomi-release-signed.apk "$RUNNER_TEMP/aligned.apk"
          "$tools/apksigner" verify --verbose android/app/build/outputs/apk/release/yuvomi-release-signed.apk
          jarsigner -keystore "$RUNNER_TEMP/release.jks" -storepass:env STORE_PASSWORD -keypass:env KEY_PASSWORD android/app/build/outputs/bundle/release/app-release.aab "$KEY_ALIAS"
          jarsigner -verify android/app/build/outputs/bundle/release/app-release.aab
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: maintainer-android-release-builds
          path: |
            android/app/build/outputs/apk/release/*.apk
            android/app/build/outputs/bundle/release/*.aab
          retention-days: 7