---
name: Build and Submit Android

on:
  workflow_dispatch:
    inputs:
      profile:
        type: choice
        description: Build profile to use
        options:
          - testflight-android
          - production
      submit:
        type: boolean
        description: Submit the build to Google Play (disable to only produce the APK artifact)
        default: true
  workflow_call:
    inputs:
      profile:
        type: string
        description: Build profile to use
        required: true
      submit:
        type: boolean
        description: Submit the build to Google Play (disable to only produce the APK artifact)
        default: true
      runner:
        type: string
        description: Runner for the build job (defaults to Linux-x64-32core)
        required: false
        default: ''
    outputs:
      package-version:
        description: Version from package.json
        value: ${{ jobs.build.outputs.package-version }}
      version-code:
        description: Android version code
        value: ${{ jobs.build.outputs.version-code }}
    secrets:
      EXPO_TOKEN:
        required: true
      ENV_TOKEN:
        required: true
      SENTRY_DSN:
        required: true
      BITDRIFT_API_KEY:
        required: true
      EXPO_PUBLIC_GCP_PROJECT_ID:
        required: true
      GOOGLE_SERVICES_TOKEN:
        required: true
      SENTRY_AUTH_TOKEN:
        required: true
      SLACK_CLIENT_ALERT_WEBHOOK:
        required: true
      ANDROID_KEYSTORE_BASE64:
        required: true
      ANDROID_KEYSTORE_PASSWORD:
        required: true
      ANDROID_KEY_ALIAS:
        required: true
      ANDROID_KEY_PASSWORD:
        required: true

# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
permissions:
  contents: read

jobs:
  build:
    if: github.repository == 'bluesky-social/social-app'
    name: Build Android
    runs-on: ${{ inputs.runner || 'Linux-x64-32core' }}
    concurrency:
      group: android-build
      cancel-in-progress: false
    outputs:
      package-version: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
      version-code: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}
    steps:
      - name: ⬇️ Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 5

      - name: 🔧 Setup Expo project
        uses: ./.github/actions/setup-expo-project
        with:
          expo-token: ${{ secrets.EXPO_TOKEN }}

      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
        with:
          distribution: "temurin"
          java-version: "17"

      - name: 🔤 Compile translations
        uses: ./.github/actions/compile-i18n

      # EXPO_PUBLIC_ENV is handled in eas.json
      - name: ✏️ Write environment variables
        id: env
        uses: ./.github/actions/write-env
        with:
          env-token: ${{ secrets.ENV_TOKEN }}
          sentry-dsn: ${{ secrets.SENTRY_DSN }}
          bitdrift-api-key: ${{ secrets.BITDRIFT_API_KEY }}
          gcp-project-id: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
          google-services-token: ${{ secrets.GOOGLE_SERVICES_TOKEN }}

      - name: 🏗️ EAS Build
        uses: ./.github/actions/eas-local-build
        with:
          platform: android
          profile: ${{ inputs.profile || 'testflight-android' }}
          output: build.aab
          bump-build-number: "true"
          sentry-auth-token: ${{ secrets.SENTRY_AUTH_TOKEN }}
          sentry-release: ${{ steps.env.outputs.release-version }}
          sentry-dist: ${{ steps.env.outputs.bundle-identifier }}

      - name: 📚 Get version from package.json
        id: get-build-info
        run: bash scripts/setGitHubOutput.sh

      # Hands the built bundle off to the submit / universalApk jobs. Retention is
      # deliberately short (1 day) since it's only an intra-run handoff artifact.
      - name: 🚀 Upload AAB artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: android-aab-${{ github.run_id }}
          retention-days: 1
          if-no-files-found: error
          path: build.aab

  submit:
    name: Submit to Google Play
    runs-on: ubuntu-latest
    needs: [build]
    # Submit unless explicitly disabled; on events where inputs is empty this still submits.
    if: ${{ inputs.submit != false }}
    steps:
      # eas submit reads app config from the repo, so we need a checkout.
      - name: ⬇️ Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 5

      - name: 🔧 Setup Expo project
        uses: ./.github/actions/setup-expo-project
        with:
          expo-token: ${{ secrets.EXPO_TOKEN }}

      - name: ⬇️ Download AAB artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: android-aab-${{ github.run_id }}

      - name: 🚀 Submit to Google Play
        env:
          PROFILE: ${{ inputs.profile || 'testflight-android' }}
        run: pnpm eas submit -p android --profile $PROFILE --non-interactive --path build.aab

      - name: 🔔 Notify Slack of Play Store Submission
        if: ${{ inputs.profile == 'production' }}
        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
        with:
          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
          webhook-type: incoming-webhook
          payload-templated: true
          payload: |
            {"text": "Android ${{ inputs.profile || 'testflight-android' }} build submitted to Google Play!\n```Version Number: ${{ needs.build.outputs.package-version }}\nBuild Number: ${{ needs.build.outputs.version-code }}```"}

  # Runs in parallel with submit: the QA APK shouldn't be blocked by a Play submission failure.
  universalApk:
    name: Build universal APK
    runs-on: ubuntu-latest
    needs: [build]
    outputs:
      apk-artifact-name: build-${{ steps.timestamp.outputs.time }}.apk
    steps:
      - name: ⬇️ Download AAB artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: android-aab-${{ github.run_id }}

      # bundletool needs a JRE. ubuntu-latest ships a default JDK, but pin it explicitly
      # like the build job so the toolchain is deterministic.
      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
        with:
          distribution: "temurin"
          java-version: "17"

      - name: 🔧 Setup bundletool
        uses: amyu/setup-bundletool@cc2e1857284660bd625e43f2c8a45626f034302f # v1.1
        with:
          version: "1.18.3"

      - name: 🔑 Decode keystore
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > keystore.jks

      - name: 📦 Build signed universal APK
        env:
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          bundletool build-apks \
            --bundle=build.aab \
            --output=universal.apks \
            --mode=universal \
            --ks=keystore.jks \
            --ks-pass=pass:"$ANDROID_KEYSTORE_PASSWORD" \
            --ks-key-alias="$ANDROID_KEY_ALIAS" \
            --key-pass=pass:"$ANDROID_KEY_PASSWORD"

      - name: 📋 Rename to .zip for extraction
        run: mv universal.apks universal.zip

      - name: 📦 Extract universal APK
        run: unzip -p universal.zip universal.apk > build.apk

      - name: ⏰ Get a timestamp
        id: timestamp
        run: echo "time=$(date -u +'%m-%d-%H-%M-%S')" >> "$GITHUB_OUTPUT"

      - name: 🚀 Upload APK Artifact
        id: upload-artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          retention-days: 30
          compression-level: 6
          name: build-${{ steps.timestamp.outputs.time }}.apk
          path: build.apk

      - name: 🔔 Notify Slack of APK Artifact
        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
        with:
          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
          webhook-type: incoming-webhook
          payload-templated: true
          payload: |
            {"text": "Android ${{ inputs.profile || 'testflight-android' }} APK is ready for testing!\n```Artifact: ${{ steps.upload-artifact.outputs.artifact-url }}\nVersion Number: ${{ needs.build.outputs.package-version }}\nBuild Number: ${{ needs.build.outputs.version-code }}```"}

  # Releases are cut from tags named after the version (e.g. "1.124.0"), so when a production
  # build is dispatched against such a tag we attach the APK to the matching release. This runs
  # as a separate job so that `contents: write` is isolated here and the build job stays read-only.
  attachToRelease:
    name: Attach APK to GitHub Release
    runs-on: ubuntu-latest
    needs: [build, universalApk]
    if: ${{ inputs.profile == 'production' && github.ref_type == 'tag' && github.repository == 'bluesky-social/social-app' }}
    permissions:
      contents: write
    steps:
      # We only attach to a release that already exists — never create one.
      - name: 🔎 Check for matching GitHub Release
        id: release-check
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          status=$(curl -sS -o /dev/null -w '%{http_code}' \
            -H "Authorization: Bearer $GH_TOKEN" \
            -H "Accept: application/vnd.github+json" \
            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}")
          if [ "$status" = "200" ]; then
            echo "Found GitHub Release for tag $TAG"
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "No GitHub Release found for tag $TAG (HTTP $status); skipping APK attachment."
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: ⬇️ Download APK artifact
        if: ${{ steps.release-check.outputs.exists == 'true' }}
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.universalApk.outputs.apk-artifact-name }}

      - name: 🏷️ Rename APK for release
        if: ${{ steps.release-check.outputs.exists == 'true' }}
        run: cp build.apk "Bluesky-${{ needs.build.outputs.package-version }}.apk"

      - name: 📎 Attach APK to GitHub Release
        id: attach
        if: ${{ steps.release-check.outputs.exists == 'true' }}
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          TAG: ${{ github.ref_name }}
          APK: Bluesky-${{ needs.build.outputs.package-version }}.apk
        run: |
          gh release upload "$TAG" "$APK" --clobber
          url=$(gh release view "$TAG" --json url --jq .url)
          echo "url=$url" >> "$GITHUB_OUTPUT"

      - name: 🔔 Notify Slack of Release Attachment
        if: ${{ steps.release-check.outputs.exists == 'true' }}
        uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
        with:
          webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
          webhook-type: incoming-webhook
          payload-templated: true
          payload: |
            {"text": "Android APK attached to GitHub Release ${{ github.ref_name }}!\n```Asset: Bluesky-${{ needs.build.outputs.package-version }}.apk\nRelease: ${{ steps.attach.outputs.url }}```"}