android-release.yml

name: Android Release Build

# Triggers:
#   - Automatically on push to the release branch (alongside the desktop release)
#   - Manually via workflow_dispatch (useful to re-run after desktop release is created)
#
# Required GitHub secrets:
#   ANDROID_KEYSTORE        — base64-encoded .jks keystore file
#   ANDROID_KEY_ALIAS       — key alias (e.g. "key0")
#   ANDROID_STORE_PASSWORD  — keystore password
#   ANDROID_KEY_PASSWORD    — key password (can be same as store password)
#   POSTHOG_API_KEY         — analytics key (same as desktop release)
#
# Optional — only needed for automated Google Play uploads:
#   GOOGLE_PLAY_SERVICE_ACCOUNT_JSON — contents of the service account JSON file
#                                      (see CONTRIBUTING.md for setup instructions)

on:
  push:
    branches:
      - release
      - beta
  workflow_dispatch:
    inputs:
      upload_to_play_store:
        description: 'Upload AAB to Google Play (internal track)'
        type: boolean
        default: false

jobs:
  android:
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4

      - name: Setup Java 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install Rust stable + Android targets
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android

      - name: Install Android NDK r27
        run: |
          "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager" --install "ndk;27.0.12077973"
          echo "NDK_HOME=$ANDROID_SDK_ROOT/ndk/27.0.12077973" >> $GITHUB_ENV

      - name: Install frontend dependencies
        run: yarn install

      - name: Create cargo-tauri wrapper
        run: |
          printf '#!/bin/sh\nshift\nexec yarn tauri "$@"\n' > ~/.cargo/bin/cargo-tauri
          chmod +x ~/.cargo/bin/cargo-tauri

      - name: Get version from package.json
        id: version
        run: echo "VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT

      - name: Decode keystore
        run: echo "${{ secrets.ANDROID_KEYSTORE }}" | base64 --decode > "$RUNNER_TEMP/release.keystore"

      - name: Set build variant (beta vs release)
        id: variant
        run: |
          if [ "${{ github.ref }}" = "refs/heads/beta" ]; then
            echo "IS_BETA=true" >> $GITHUB_ENV
            echo "RELEASE_TAG=v${{ steps.version.outputs.VERSION }}-beta" >> $GITHUB_ENV
            echo "ANDROID_APP_ID=com.volthawk.dota_keeper_beta" >> $GITHUB_ENV
          else
            echo "IS_BETA=false" >> $GITHUB_ENV
            echo "RELEASE_TAG=v${{ steps.version.outputs.VERSION }}" >> $GITHUB_ENV
            echo "ANDROID_APP_ID=com.volthawk.dota_keeper" >> $GITHUB_ENV
          fi

      # ── AAB (for Google Play Store) ────────────────────────────────────────

      - name: Re-init Android project for beta identifier
        if: env.IS_BETA == 'true'
        env:
          NDK_HOME: ${{ env.NDK_HOME }}
        run: |
          rm -rf src-tauri/gen/android
          yarn tauri android init --config src-tauri/tauri.beta.conf.json

      - name: Build release AAB (all ABIs)
        env:
          NDK_HOME: ${{ env.NDK_HOME }}
          POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
          PUBLIC_SUPABASE_URL: ${{ secrets.PUBLIC_SUPABASE_URL }}
          PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.PUBLIC_SUPABASE_ANON_KEY }}
          PUBLIC_SENTRY_DSN: ${{ secrets.PUBLIC_SENTRY_DSN }}
        run: |
          if [ "$IS_BETA" = "true" ]; then
            yarn tauri android build --aab true --config src-tauri/tauri.beta.conf.json
          else
            yarn tauri android build --aab true
          fi

      - name: Sign AAB
        run: |
          UNSIGNED=$(find src-tauri/gen/android/app/build/outputs/bundle -name "*.aab" | head -1)
          echo "Found unsigned AAB: $UNSIGNED"

          if [ "$IS_BETA" = "true" ]; then
            SIGNED="dota-keeper-${{ steps.version.outputs.VERSION }}-beta-android.aab"
          else
            SIGNED="dota-keeper-${{ steps.version.outputs.VERSION }}-android.aab"
          fi

          jarsigner -verbose \
            -sigalg SHA256withRSA \
            -digestalg SHA-256 \
            -keystore "$RUNNER_TEMP/release.keystore" \
            -storepass "${{ secrets.ANDROID_STORE_PASSWORD }}" \
            -keypass "${{ secrets.ANDROID_KEY_PASSWORD }}" \
            -signedjar "$SIGNED" \
            "$UNSIGNED" \
            "${{ secrets.ANDROID_KEY_ALIAS }}"

          echo "SIGNED_AAB=$SIGNED" >> $GITHUB_ENV

      - name: Upload AAB as workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: dota-keeper-${{ steps.version.outputs.VERSION }}-android
          path: ${{ env.SIGNED_AAB }}
          retention-days: 30

      - name: Attach AAB to GitHub release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "$RELEASE_TAG" "$SIGNED_AAB" --clobber || \
            echo "⚠️  Could not upload to release (may not exist yet). AAB is available as a workflow artifact."

      - name: Upload AAB to Google Play (internal track)
        if: ${{ inputs.upload_to_play_store == true }}
        uses: r0adkll/upload-google-play@v1
        with:
          serviceAccountJsonPlainText: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
          packageName: ${{ env.ANDROID_APP_ID }}
          releaseFiles: ${{ env.SIGNED_AAB }}
          track: internal
          status: completed