android.yml

name: Android

# main  -> rolling "preview" pre-release with an arm64 APK (stable download URL)
# v*    -> versioned release with a universal APK + AAB for Google Play
# Each APK comes with update.json, which the app reads to update itself
# (src/lib/app-update.ts): preview builds follow the preview release, tag builds
# the latest versioned one. The AAB never updates itself (Google Play policy).
on:
  push:
    branches: [main]
    tags: ['v*']
    paths-ignore: ['**.md']
  workflow_dispatch:

concurrency:
  group: android-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: write

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      IS_RELEASE: ${{ startsWith(github.ref, 'refs/tags/v') }}
    steps:
      - uses: actions/checkout@v7
        with:
          # Full history and tags: the update notes list the commits since the previous build.
          fetch-depth: 0

      - uses: actions/setup-node@v7
        with:
          node-version: lts/*
          cache: npm

      - uses: actions/setup-java@v6
        with:
          distribution: zulu
          java-version: '17'

      - uses: gradle/actions/setup-gradle@v6

      - run: npm ci

      - name: Typecheck, lint and test
        run: |
          npx tsc --noEmit
          npx expo lint
          npm test -- --ci

      - name: Check tag matches app.json version
        if: env.IS_RELEASE == 'true'
        run: |
          VERSION=$(node -p "require('./app.json').expo.version")
          if [ "v$VERSION" != "$GITHUB_REF_NAME" ]; then
            echo "::error::Tag $GITHUB_REF_NAME does not match app.json version ($VERSION)"
            exit 1
          fi

      - name: Set Android versionCode to the run number
        run: |
          node -e "
            const fs = require('fs');
            const config = JSON.parse(fs.readFileSync('app.json', 'utf8'));
            config.expo.android.versionCode = Number(process.env.GITHUB_RUN_NUMBER);
            fs.writeFileSync('app.json', JSON.stringify(config, null, 2));
          "

      - run: npx expo prebuild --platform android --no-install

      - name: Decode upload keystore
        env:
          KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: |
          if [ -z "$KEYSTORE_BASE64" ]; then
            echo "::error::Missing ANDROID_KEYSTORE_BASE64 secret"
            exit 1
          fi
          echo "$KEYSTORE_BASE64" | base64 --decode > "$RUNNER_TEMP/upload.jks"

      - name: Build
        working-directory: android
        env:
          ORG_GRADLE_PROJECT_PLANTULE_UPLOAD_STORE_FILE: ${{ runner.temp }}/upload.jks
          ORG_GRADLE_PROJECT_PLANTULE_UPLOAD_STORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ORG_GRADLE_PROJECT_PLANTULE_UPLOAD_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ORG_GRADLE_PROJECT_PLANTULE_UPLOAD_KEY_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          # Inlined in the JS bundle by the Gradle build: the update channel the APK follows.
          EXPO_PUBLIC_UPDATE_CHANNEL: ${{ startsWith(github.ref, 'refs/tags/v') && 'stable' || 'preview' }}
        run: |
          if [ "$IS_RELEASE" = "true" ]; then
            ./gradlew app:assembleRelease
            # Google Play forbids apps that update themselves: the AAB has no update
            # channel and no REQUEST_INSTALL_PACKAGES (plugins/with-app-updater.js).
            # Only the JS bundle and the manifest are built again.
            EXPO_PUBLIC_UPDATE_CHANNEL= ./gradlew app:bundleRelease -PplantulePlayBuild=true
          else
            ./gradlew app:assembleRelease -PreactNativeArchitectures=arm64-v8a
          fi

      - name: Publish preview release
        if: env.IS_RELEASE != 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          cp android/app/build/outputs/apk/release/app-release.apk plantule-preview.apk
          CHANNEL=preview APK=plantule-preview.apk \
            APK_URL="https://github.com/$GITHUB_REPOSITORY/releases/download/preview/plantule-preview.apk" \
            node scripts/update-manifest.js > update.json
          gh release delete preview --cleanup-tag --yes || true
          gh release create preview plantule-preview.apk update.json \
            --prerelease \
            --target "$GITHUB_SHA" \
            --title "Preview (main)" \
            --notes "Build #$GITHUB_RUN_NUMBER from ${GITHUB_SHA::7}"

      - name: Publish versioned release
        if: env.IS_RELEASE == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          cp android/app/build/outputs/apk/release/app-release.apk "plantule-$GITHUB_REF_NAME.apk"
          cp android/app/build/outputs/bundle/release/app-release.aab "plantule-$GITHUB_REF_NAME.aab"
          CHANNEL=stable APK="plantule-$GITHUB_REF_NAME.apk" \
            APK_URL="https://github.com/$GITHUB_REPOSITORY/releases/download/$GITHUB_REF_NAME/plantule-$GITHUB_REF_NAME.apk" \
            node scripts/update-manifest.js > update.json
          gh release create "$GITHUB_REF_NAME" \
            "plantule-$GITHUB_REF_NAME.apk" \
            "plantule-$GITHUB_REF_NAME.aab" \
            update.json \
            --title "$GITHUB_REF_NAME" \
            --generate-notes