release.yml

name: Build and Release

on:
  push:
    branches:
      - main

permissions:
  contents: write
  checks: write

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  test-gate:
    name: Test Gate
    runs-on: ubuntu-latest
    if: "!startsWith(github.event.head_commit.message, 'chore: bump version')"
    steps:
      - uses: actions/checkout@v4

      - name: Setup Java 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'
          cache: gradle

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Run unit tests
        run: ./gradlew test --continue

      - name: Run lint
        run: ./gradlew lintRelease

      - name: Verify FreeRDP AAR exists
        run: |
          if [ ! -f core/rdp/libs/freerdp-android.aar ]; then
            echo "::error::FreeRDP AAR missing - trigger Build FreeRDP AAR workflow and pull the auto-commit"
            exit 1
          fi
          SIZE=$(stat -c %s core/rdp/libs/freerdp-android.aar)
          if [ "$SIZE" -lt 1000000 ]; then
            echo "::error::AAR too small ($SIZE bytes) - likely corrupt"
            exit 1
          fi

      - name: Upload test results on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: "**/build/test-results/test/*.xml"

  build:
    name: Build and Publish
    runs-on: ubuntu-latest
    needs: test-gate
    if: "!startsWith(github.event.head_commit.message, 'chore: bump version')"
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Java 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'
          cache: gradle

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Determine version bump
        id: bump
        shell: bash
        env:
          COMMIT_MSG: ${{ github.event.head_commit.message }}
        run: |
          CURRENT=$(grep 'versionName' app/build.gradle.kts | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
          IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT"
          FIRST_LINE=$(echo "$COMMIT_MSG" | head -1)
          if echo "$FIRST_LINE" | grep -qE "^feat(\(.+\))?:"; then
            MINOR=$((MINOR + 1))
            PATCH=0
            BUMP="minor"
          else
            PATCH=$((PATCH + 1))
            BUMP="patch"
          fi
          NEW="${MAJOR}.${MINOR}.${PATCH}"
          echo "current=$CURRENT" >> "$GITHUB_OUTPUT"
          echo "new=$NEW" >> "$GITHUB_OUTPUT"
          echo "bump=$BUMP" >> "$GITHUB_OUTPUT"
          echo "tag=v$NEW" >> "$GITHUB_OUTPUT"
          echo "Version: $CURRENT -> $NEW ($BUMP)"

      - name: Check if tag already exists
        id: check_tag
        shell: bash
        env:
          TAG: ${{ steps.bump.outputs.tag }}
        run: |
          if git rev-parse "$TAG" >/dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Update version in build.gradle.kts
        if: steps.check_tag.outputs.exists == 'false'
        shell: bash
        env:
          NEW_VERSION: ${{ steps.bump.outputs.new }}
        run: |
          IFS='.' read -r MAJOR MINOR PATCH <<< "$NEW_VERSION"
          NEW_VERSION_CODE=$(( MAJOR * 10000 + MINOR * 100 + PATCH ))
          sed -i "s/versionName = \"[0-9]*\.[0-9]*\.[0-9]*\"/versionName = \"$NEW_VERSION\"/" app/build.gradle.kts
          sed -i "s/versionCode = [0-9]*/versionCode = $NEW_VERSION_CODE/" app/build.gradle.kts
          echo "Updated versionName=$NEW_VERSION versionCode=$NEW_VERSION_CODE"

      - name: Update CHANGELOG
        if: steps.check_tag.outputs.exists == 'false'
        shell: bash
        env:
          NEW_VERSION: ${{ steps.bump.outputs.new }}
          COMMIT_MSG: ${{ github.event.head_commit.message }}
        run: |
          FIRST_LINE=$(echo "$COMMIT_MSG" | head -1)
          DATE=$(date +%Y-%m-%d)
          if echo "$FIRST_LINE" | grep -qE "^feat"; then
            SECTION="Features"
            ENTRY=$(echo "$FIRST_LINE" | sed 's/^feat[^:]*: //')
          elif echo "$FIRST_LINE" | grep -qE "^fix"; then
            SECTION="Fixes"
            ENTRY=$(echo "$FIRST_LINE" | sed 's/^fix[^:]*: //')
          else
            SECTION="Changes"
            ENTRY=$(echo "$FIRST_LINE" | sed 's/^[a-z]*[^:]*: //')
          fi
          if [ -f CHANGELOG.md ]; then
            TEMP=$(mktemp)
            awk -v block="## [$NEW_VERSION] - $DATE\n\n### $SECTION\n- $ENTRY\n\n---" '
              /^# Changelog/ { print; print ""; print block; next }
              { print }
            ' CHANGELOG.md > "$TEMP"
            mv "$TEMP" CHANGELOG.md
          fi

      - name: Setup signing
        if: steps.check_tag.outputs.exists == 'false'
        shell: bash
        run: |
          if [ -n "$KEYSTORE_BASE64" ]; then
            echo "$KEYSTORE_BASE64" | base64 -d > keystore.jks
          else
            keytool -genkey -v -keystore keystore.jks -keyalg RSA -keysize 2048 -validity 10000 \
              -alias gatecontrol -storepass android -keypass android \
              -dname "CN=GateControl, OU=Dev, O=GateControl, C=DE"
          fi
          echo "KEYSTORE_PATH=$(pwd)/keystore.jks" >> "$GITHUB_ENV"
        env:
          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}

      - name: Build APK and AAB
        if: steps.check_tag.outputs.exists == 'false'
        shell: bash
        env:
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: |
          ./gradlew assembleRelease bundleRelease assembleDebug

      - name: Verify R8 obfuscation
        if: steps.check_tag.outputs.exists == 'false'
        run: |
          if [ ! -f app/build/outputs/mapping/release/mapping.txt ]; then
            echo "::error::R8 mapping.txt not found — minification may not be active"
            exit 1
          fi
          SIZE=$(wc -c < app/build/outputs/mapping/release/mapping.txt)
          if [ "$SIZE" -lt 1000 ]; then
            echo "::error::R8 mapping.txt is suspiciously small (${SIZE} bytes) — minification may not be working"
            exit 1
          fi
          echo "R8 mapping.txt verified (${SIZE} bytes)"

      - name: Rename and package artifacts
        if: steps.check_tag.outputs.exists == 'false'
        shell: bash
        env:
          NEW_VERSION: ${{ steps.bump.outputs.new }}
        run: |
          mv app/build/outputs/apk/release/app-release.apk "app/build/outputs/apk/release/GateControl-Android-${NEW_VERSION}.apk"
          mv app/build/outputs/bundle/release/app-release.aab "app/build/outputs/bundle/release/GateControl-Android-${NEW_VERSION}.aab"
          # Package R8 mapping file for Play Console
          cp app/build/outputs/mapping/release/mapping.txt "app/build/outputs/mapping/release/GateControl-Android-${NEW_VERSION}-mapping.txt"
          # Package native debug symbols for Play Console
          if [ -d app/build/outputs/native-debug-symbols/release ]; then
            cd app/build/outputs/native-debug-symbols/release
            zip -r "../../../../GateControl-Android-${NEW_VERSION}-native-debug-symbols.zip" .
            cd -
          fi
          # Debug APK for crash diagnosis
          if [ -f app/build/outputs/apk/debug/app-debug.apk ]; then
            mv app/build/outputs/apk/debug/app-debug.apk "app/build/outputs/apk/debug/GateControl-Android-${NEW_VERSION}-debug.apk"
          fi

      - name: Commit version bump
        if: steps.check_tag.outputs.exists == 'false'
        shell: bash
        env:
          TAG: ${{ steps.bump.outputs.tag }}
          NEW_VERSION: ${{ steps.bump.outputs.new }}
        run: |
          git config user.name "github-actions"
          git config user.email "github-actions@github.com"
          git add app/build.gradle.kts CHANGELOG.md
          git commit -m "chore: bump version to $NEW_VERSION"
          git tag "$TAG"
          git push origin main --tags

      - name: Create GitHub Release
        if: steps.check_tag.outputs.exists == 'false'
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.bump.outputs.tag }}
          name: "GateControl Android ${{ steps.bump.outputs.tag }}"
          generate_release_notes: true
          files: |
            app/build/outputs/apk/release/GateControl-Android-*.apk
            app/build/outputs/apk/debug/GateControl-Android-*-debug.apk
            app/build/outputs/bundle/release/GateControl-Android-*.aab
            app/build/outputs/mapping/release/GateControl-Android-*-mapping.txt
            app/GateControl-Android-*-native-debug-symbols.zip