From ad32e731fb9c2190e67de009d683957c4b4b72ce Mon Sep 17 00:00:00 2001
From: Amir Khodak <amir.khodak@gmail.com>
Date: Fri, 19 Jun 2026 09:10:14 +0000
Subject: [PATCH] ci: add Gitea Actions release workflow (build, sign, attach
 APK, auto-notes)

---
 .gitea/workflows/release.yml | 77 ++++++++++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)
 create mode 100644 .gitea/workflows/release.yml

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..42dc67d
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,77 @@
+name: Release APK
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Build release APK
+        run: |
+          chmod +x ./gradlew
+          ./gradlew :app:assembleRelease --no-daemon
+          mkdir -p dist
+          cp app/build/outputs/apk/release/app-release.apk "dist/homelab-mfa.apk"
+
+      - name: Generate release notes
+        id: notes
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          PREV=$(git tag --sort=-creatordate | grep -A1 -x "$TAG" | tail -n1)
+          if [ -n "$PREV" ] && [ "$PREV" != "$TAG" ]; then
+            RANGE="$PREV..$TAG"
+          else
+            RANGE=""
+          fi
+          echo "## $TAG" > notes.md
+          echo "" >> notes.md
+          git log $RANGE --no-merges --pretty=format:'- %s' | grep -viE '^- (merge|wip|fixup)' >> notes.md || true
+          echo "" >> notes.md
+          echo "" >> notes.md
+          echo "**Install:** download \`homelab-mfa.apk\` below." >> notes.md
+
+      - name: Publish release + upload APK
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -e
+          TAG="${GITHUB_REF_NAME}"
+          API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
+          BODY=$(python3 -c "import json,sys; print(json.dumps(open('notes.md').read()))")
+          # find existing release for this tag
+          REL=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG")
+          ID=$(echo "$REL" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('id',''))" 2>/dev/null || echo "")
+          if [ -z "$ID" ]; then
+            ID=$(curl -s -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+              "$API/releases" -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"body\":$BODY}" \
+              | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
+          else
+            curl -s -X PATCH -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+              "$API/releases/$ID" -d "{\"name\":\"$TAG\",\"body\":$BODY}" >/dev/null
+          fi
+          # remove existing same-named asset, then upload fresh
+          for AID in $(curl -s -H "Authorization: token $TOKEN" "$API/releases/$ID/assets" \
+              | python3 -c "import json,sys;[print(a['id']) for a in json.load(sys.stdin) if a['name']=='homelab-mfa.apk']" 2>/dev/null); do
+            curl -s -X DELETE -H "Authorization: token $TOKEN" "$API/releases/$ID/assets/$AID" >/dev/null
+          done
+          curl -s -X POST -H "Authorization: token $TOKEN" \
+            "$API/releases/$ID/assets?name=homelab-mfa.apk" \
+            -F attachment=@dist/homelab-mfa.apk >/dev/null
+          echo "Released $TAG (id $ID) with homelab-mfa.apk"