name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. v1.0.0)"
        required: true

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write
  packages: write

jobs:
  # ── Run full CI before building release ───────────────────────────────
  ci:
    name: CI Checks
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7

      - name: Set up JDK 21
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '21'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v6
        with:
          validate-wrappers: true
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTED_KEY }}

      - name: Grant Execute Permission for Gradlew
        run: chmod +x gradlew

      - name: Cache ktlint
        id: cache-ktlint
        uses: actions/cache@v6
        with:
          path: ~/.local/bin/ktlint
          key: ktlint-1.2.1

      - name: Install ktlint
        if: steps.cache-ktlint.outputs.cache-hit != 'true'
        run: |
          mkdir -p ~/.local/bin
          curl -sSLO https://github.com/pinterest/ktlint/releases/download/1.2.1/ktlint
          chmod +x ktlint
          mv ktlint ~/.local/bin/

      - name: Add local bin to PATH
        run: echo "$HOME/.local/bin" >> $GITHUB_PATH

      - name: ktlintCheck
        run: ./gradlew ktlintCheck

      - name: lintDebug
        run: ./gradlew lintDebug

      - name: test
        run: ./gradlew test

  # ── Build release APK ─────────────────────────────────────────────────
  build-release:
    name: Build Release APK
    needs: ci
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7

      - name: Set up JDK 21
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '21'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v6
        with:
          validate-wrappers: true
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTED_KEY }}

      - name: Grant Execute Permission for Gradlew
        run: chmod +x gradlew

      - name: Determine version
        id: version
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            TAG="${{ github.event.inputs.tag }}"
          else
            TAG="${GITHUB_REF#refs/tags/}"
          fi
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          # Strip leading 'v' for versionName
          VERSION="${TAG#v}"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          # versionCode: strip dots from version, pad to keep sortable
          CODE=$(echo "$VERSION" | tr -d '.' | sed 's/^0*//')
          [ -z "$CODE" ] && CODE=0
          echo "code=$CODE" >> "$GITHUB_OUTPUT"
          echo "Release: tag=$TAG version=$VERSION code=$CODE"

      - name: Decode release keystore
        env:
          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
        run: |
          echo "$KEYSTORE_BASE64" | base64 -d > hermes-mobile-release.keystore.jks
          ls -lh hermes-mobile-release.keystore.jks

      - name: Build Release APK
        env:
          VERSION_NAME: ${{ steps.version.outputs.version }}
          VERSION_CODE: ${{ steps.version.outputs.code }}
          KEYSTORE_PATH: ${{ github.workspace }}/hermes-mobile-release.keystore.jks
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: |
          ./gradlew assembleRelease \
            -PversionName="$VERSION_NAME" \
            -PversionCode="$VERSION_CODE"

      - name: Rename APK and generate version file
        run: |
          mkdir -p release
          cp app/build/outputs/apk/release/app-release.apk \
            release/hermes-mobile-${{ steps.version.outputs.tag }}.apk
          # Write version.txt for F-Droid to extract version info
          cat > release/version.txt <<EOF
          versionName=${{ steps.version.outputs.version }}
          versionCode=${{ steps.version.outputs.code }}
          EOF
          ls -lh release/

      - name: Upload Release Artifacts
        uses: actions/upload-artifact@v7
        with:
          name: hermes-mobile-release
          path: release/*.apk
          retention-days: 90

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          name: Hermes Mobile ${{ steps.version.outputs.tag }}
          generate_release_notes: true
          files: |
            release/hermes-mobile-${{ steps.version.outputs.tag }}.apk
            release/version.txt
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}