name: Release APK

on:
  push:
    tags:
      - 'v*'

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Android SDK
        uses: android-actions/setup-android@v3

      # Signing material is injected at build time from Gitea Actions secrets — never
      # committed. build.gradle.kts reads app/keystore.properties, so recreate it here.
      - name: Decode signing keystore
        run: |
          if [ -z "${{ secrets.KEYSTORE_BASE64 }}" ]; then
            echo "::error::KEYSTORE_BASE64 secret is not set — cannot build a signed release."
            exit 1
          fi
          echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > app/homelab-mfa-release.keystore

      - name: Write signing credentials
        run: |
          if [ -z "${{ secrets.KEYSTORE_PASSWORD }}" ] || [ -z "${{ secrets.KEY_PASSWORD }}" ]; then
            echo "::error::KEYSTORE_PASSWORD / KEY_PASSWORD secrets not set — cannot sign release."
            exit 1
          fi
          {
            echo "storeFile=homelab-mfa-release.keystore"
            echo "storePassword=${{ secrets.KEYSTORE_PASSWORD }}"
            echo "keyPassword=${{ secrets.KEY_PASSWORD }}"
            echo "keyAlias=${{ secrets.KEY_ALIAS || 'homelab-mfa' }}"
          } > app/keystore.properties

      - name: Build release APK
        run: |
          chmod +x ./gradlew
          ./gradlew :app:assembleRelease --no-daemon
          mkdir -p dist
          cp app/build/outputs/apk/release/app-release.apk "dist/homelab-mfa.apk"

      - name: Generate release notes
        id: notes
        run: |
          TAG="${GITHUB_REF_NAME}"
          PREV=$(git tag --sort=-creatordate | grep -A1 -x "$TAG" | tail -n1)
          if [ -n "$PREV" ] && [ "$PREV" != "$TAG" ]; then
            RANGE="$PREV..$TAG"
          else
            RANGE=""
          fi
          echo "## $TAG" > notes.md
          echo "" >> notes.md
          git log $RANGE --no-merges --pretty=format:'- %s' | grep -viE '^- (merge|wip|fixup)' >> notes.md || true
          echo "" >> notes.md
          echo "" >> notes.md
          echo "**Install:** download \`homelab-mfa.apk\` below." >> notes.md

      - name: Publish release + upload APK
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -e
          TAG="${GITHUB_REF_NAME}"
          API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
          BODY=$(python3 -c "import json,sys; print(json.dumps(open('notes.md').read()))")
          # find existing release for this tag
          REL=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG")
          ID=$(echo "$REL" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('id',''))" 2>/dev/null || echo "")
          if [ -z "$ID" ]; then
            ID=$(curl -s -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
              "$API/releases" -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"body\":$BODY}" \
              | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
          else
            curl -s -X PATCH -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
              "$API/releases/$ID" -d "{\"name\":\"$TAG\",\"body\":$BODY}" >/dev/null
          fi
          # remove existing same-named asset, then upload fresh
          for AID in $(curl -s -H "Authorization: token $TOKEN" "$API/releases/$ID/assets" \
              | python3 -c "import json,sys;[print(a['id']) for a in json.load(sys.stdin) if a['name']=='homelab-mfa.apk']" 2>/dev/null); do
            curl -s -X DELETE -H "Authorization: token $TOKEN" "$API/releases/$ID/assets/$AID" >/dev/null
          done
          curl -s -X POST -H "Authorization: token $TOKEN" \
            "$API/releases/$ID/assets?name=homelab-mfa.apk" \
            -F attachment=@dist/homelab-mfa.apk >/dev/null
          echo "Released $TAG (id $ID) with homelab-mfa.apk"