# Tag-driven release. Builds standalone rather than consuming ci.yml
# artifacts: a tag run has no upstream run to pull from, and a release
# should be reproducible from the tagged tree alone.

name: android / release

on:
  push:
    tags: ['v*.*.*']

permissions:
  contents: write

concurrency:
  group: android-release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: ./.github/actions/setup-web

      # ci.yml does not run on tags, so this is the only gate before signing.
      - name: Test web
        run: pnpm test
        working-directory: web

      # Base "" — the APK loads the bundle from the domain root.
      - name: Build web
        run: pnpm build
        working-directory: web

      - uses: ./.github/actions/setup-android

      - name: Sync web bundle into the native project
        run: npm run sync
        working-directory: android

      - name: Decode keystore
        env:
          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
        run: printf '%s' "$KEYSTORE_BASE64" | base64 --decode > "$GITHUB_WORKSPACE/keystore.p12"

      - name: Build signed AAB + APK
        working-directory: android/android
        env:
          LOTO_KEYSTORE_PATH: ${{ github.workspace }}/keystore.p12
          LOTO_KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          LOTO_KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          LOTO_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: ./gradlew :app:bundleRelease :app:assembleRelease

      - name: Upload to GitHub Release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          files: |
            android/android/app/build/outputs/apk/release/*.apk
            android/android/app/build/outputs/bundle/release/*.aab

      # Auto-publish to Google Play (gated on the service-account secret).
      # Skips silently if PLAY_SERVICE_ACCOUNT_JSON is not configured, so
      # tagging a release before Play setup still produces a GH Release.
      # Default track is "internal" — change to alpha/beta/production
      # once you trust the pipeline.
      - name: Check Play Store config
        id: play
        env:
          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
        run: |
          if [ -n "$PLAY_SERVICE_ACCOUNT_JSON" ]; then
            echo "configured=true" >> "$GITHUB_OUTPUT"
          else
            echo "configured=false" >> "$GITHUB_OUTPUT"
            echo "::notice::PLAY_SERVICE_ACCOUNT_JSON not set; skipping Play Store upload."
          fi

      - name: Upload to Google Play (internal track)
        if: steps.play.outputs.configured == 'true'
        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
        with:
          serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
          packageName: com.miti99.loto
          releaseFiles: android/android/app/build/outputs/bundle/release/*.aab
          tracks: internal
          status: completed
          # Bumps versionCode automatically? No — must be incremented
          # manually in android/android/app/build.gradle before tagging.