name: Android build

permissions:
  contents: write
  releases: write

on:
  push:
    branches:
      - '**'
  pull_request:
  release:
    types:
      - published
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 90

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Java 17
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '17'

      - name: Install native build prerequisites
        shell: bash
        run: |
          set -euxo pipefail
          sudo apt-get update
          sudo apt-get install -y clang make perl pkg-config file binutils

      - name: Install Rust toolchain
        shell: bash
        run: |
          set -euxo pipefail
          if ! command -v cargo >/dev/null 2>&1; then
            curl https://sh.rustup.rs -sSf | sh -s -- -y --profile minimal
          fi
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
          export PATH="$HOME/.cargo/bin:$PATH"
          cargo --version
          rustc --version
          rustup target add aarch64-linux-android armv7-linux-androideabi i686-linux-android x86_64-linux-android

      - name: Run project build tooling for debug APK
        if: github.event_name != 'release'
        shell: bash
        env:
          CI_VERSION_CODE: ${{ github.run_number }}
          CI_ARTIFACT_TIMESTAMP: ${{ github.run_id }}
        run: |
          set -euxo pipefail
          export PATH="$HOME/.cargo/bin:$PATH"
          chmod +x ./AndroidProjectTooling.sh
          bash ./AndroidProjectTooling.sh --build --no-commit

      - name: Verify debug APK bundles native Git
        if: github.event_name != 'release'
        shell: bash
        run: |
          set -euxo pipefail
          python3 - <<'PY'
          from pathlib import Path
          import zipfile
          apk = next(Path('app/build/outputs/apk/debug').glob('*.apk'))
          with zipfile.ZipFile(apk) as zf:
              names = zf.namelist()
          required = {
              'lib/arm64-v8a/libgit.so',
              'lib/armeabi-v7a/libgit.so',
              'lib/x86/libgit.so',
              'lib/x86_64/libgit.so',
          }
          found = {name for name in names if name in required}
          print('APK_NATIVE_GIT', sorted(found))
          missing = sorted(required - found)
          if missing:
              raise SystemExit(f'Missing native Git libraries in {apk}: {missing}')
          PY

      - name: Run project build tooling for release AAB
        if: github.event_name == 'release'
        shell: bash
        env:
          CI_VERSION_CODE: ${{ github.run_number }}
          CI_ARTIFACT_TIMESTAMP: ${{ github.run_id }}
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          set -euxo pipefail
          export PATH="$HOME/.cargo/bin:$PATH"
          chmod +x ./AndroidProjectTooling.sh
          bash ./AndroidProjectTooling.sh --build-release-aab --no-commit

      - name: Verify release AAB bundles native Git
        if: github.event_name == 'release'
        shell: bash
        run: |
          set -euxo pipefail
          python3 - <<'PY'
          from pathlib import Path
          import zipfile
          aab = next(Path('app/build/outputs/bundle/release').glob('*.aab'))
          with zipfile.ZipFile(aab) as zf:
              names = zf.namelist()
          required = {
              'base/lib/arm64-v8a/libgit.so',
              'base/lib/armeabi-v7a/libgit.so',
              'base/lib/x86/libgit.so',
              'base/lib/x86_64/libgit.so',
          }
          found = {name for name in names if name in required}
          print('AAB_NATIVE_GIT', sorted(found))
          missing = sorted(required - found)
          if missing:
              raise SystemExit(f'Missing native Git libraries in {aab}: {missing}')
          PY

      - name: Upload debug APK
        if: github.event_name != 'release'
        uses: actions/upload-artifact@v3
        with:
          name: debug-apk
          path: app/build/outputs/apk/debug/*.apk
          if-no-files-found: error

      - name: Attach release AAB to Gitea release
        if: github.event_name == 'release'
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          GITHUB_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euxo pipefail
          token="${GITHUB_TOKEN:-${GITEA_TOKEN:-}}"
          if [ -z "$token" ]; then
            echo "::error::No release upload token is available from secrets.GITEA_TOKEN or github.token"
            exit 1
          fi
          release_id="$(python3 -c 'import json, os; print(json.load(open(os.environ["GITHUB_EVENT_PATH"], encoding="utf-8"))["release"]["id"])')"
          aab="$(find app/build/outputs/bundle/release -name '*.aab' | head -n 1)"
          curl --fail-with-body \
            --request POST \
            --header "Authorization: token ${token}" \
            --form "attachment=@${aab}" \
            "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets?name=$(basename "$aab")"