release.yml

name: Release Android artifacts

on:
  push:
    tags:
      - "v*"
      - "release-check/*"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    name: Build and verify signed APK
    runs-on: ubuntu-latest
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Validate publication tag
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          version_name="$(sed -nE 's/^[[:space:]]*versionName = "([^"]+)"/\1/p' app/build.gradle.kts)"
          test "$GITHUB_REF_NAME" = "v$version_name"
          git merge-base --is-ancestor HEAD origin/main
          version_code="$(sed -nE 's/^[[:space:]]*versionCode = ([0-9]+)/\1/p' app/build.gradle.kts)"
          test -s "fastlane/metadata/android/en-US/changelogs/$version_code.txt"
          test -s "fastlane/metadata/android/ru-RU/changelogs/$version_code.txt"
      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: "21"
      - uses: gradle/actions/setup-gradle@v4
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: "3.4.10"
          bundler-cache: true
      - name: Install Android SDK components
        run: '"$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" "platforms;android-36" "build-tools;36.0.0"'
      - name: Restore Android signing key
        env:
          SIGNING_KEY_BASE64: ${{ secrets.ANDROID_SIGNING_KEY_BASE64 }}
          KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
        run: |
          test -n "$SIGNING_KEY_BASE64" && test -n "$KEYSTORE_PASSWORD"
          umask 077
          keystore="$RUNNER_TEMP/message487-release.p12"
          password_file="$RUNNER_TEMP/message487-keystore-password"
          printf '%s' "$SIGNING_KEY_BASE64" | base64 --decode > "$keystore"
          printf '%s' "$KEYSTORE_PASSWORD" > "$password_file"
          echo "MESSAGE487_KEYSTORE_PATH=$keystore" >> "$GITHUB_ENV"
          echo "MESSAGE487_KEY_PASSWORD_FILE=$password_file" >> "$GITHUB_ENV"
      - name: Build and verify signed release
        env:
          MESSAGE487_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          MESSAGE487_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: bundle exec fastlane android release_artifacts
      - name: Remove signing files
        if: always()
        run: rm -f "$RUNNER_TEMP/message487-release.p12" "$RUNNER_TEMP/message487-keystore-password"
      - uses: actions/upload-artifact@v7
        with:
          name: message487-signed-release
          path: dist/release/*
          if-no-files-found: error
          retention-days: 14
      - name: Publish test and lint reports
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: release-test-reports
          path: |
            app/build/reports/tests/
            app/build/test-results/
            app/build/reports/lint-results-*
          retention-days: 14

      - name: Upload release JUnit reports
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v7
        with:
          name: junit-Release Android JVM
          path: app/build/test-results/testDebugUnitTest/*.xml
          retention-days: 14

  report-tests:
    name: Publish release Android JVM results
    needs: release
    if: ${{ !cancelled() && needs.release.result != 'skipped' }}
    permissions:
      contents: read
      actions: read
      checks: write
    uses: ./.github/workflows/test-reports.yml
    with:
      artifact: '/^junit-(Release Android JVM)$/'

  publish:
    name: Publish GitHub Release
    needs: release
    if: startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: "3.4.10"
          bundler-cache: true
      - uses: actions/download-artifact@v8
        with:
          name: message487-signed-release
          path: dist/release
      - name: Publish verified artifacts
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          version_code="$(sed -nE 's/^[[:space:]]*versionCode = ([0-9]+)/\1/p' app/build.gradle.kts)"
          notes="$RUNNER_TEMP/release-notes.md"
          en="fastlane/metadata/android/en-US/changelogs/$version_code.txt"
          ru="fastlane/metadata/android/ru-RU/changelogs/$version_code.txt"
          test -s "$en" && test -s "$ru"
          { printf '## English\n\n'; cat "$en"; printf '\n## Русский\n\n'; cat "$ru"; } > "$notes"
          cd dist/release
          sha256sum -c SHA256SUMS
          gh release create "$GITHUB_REF_NAME" ./*.apk mapping.txt SHA256SUMS \
            --repo "$GITHUB_REPOSITORY" --verify-tag --notes-file "$notes" \
            --title "Message487 $GITHUB_REF_NAME"