develop-builds.yml

name: Development build

on:
  push:
    branches:
      - main

jobs:
  build-android:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v3

      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: 'stable'

      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: Install Android SDK 35
        uses: android-actions/setup-android@v2
        with:
          api-level: 35
          build-tools: 35.0.0
          ndk: 27.0.12077973

      - name: Decode Android keystore
        run: |
          echo "${{ secrets.ANDROID_KEYSTORE_B64 }}" | base64 --decode > android/app/debug.keystore

      - name: Cache Flutter & Gradle
        uses: actions/cache@v3
        with:
          path: |
            ~/.pub-cache
            ~/.gradle
          key: ${{ runner.os }}-flutter-${{ hashFiles('**/pubspec.yaml') }}

      - name: Install dependencies
        run: flutter pub get

      - name: Build Android APK
        run: ./flutter_with_commit.sh build apk --release

      - name: Upload Android APK
        uses: actions/upload-artifact@v4
        with:
          name: android-apk
          path: build/app/outputs/flutter-apk/app-release.apk

  build-macos:
    runs-on: macos-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v3

      - name: Install automake and libtool
        run: brew install automake libtool

      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: 'stable'

      - name: Install FlutterFire CLI
        run: dart pub global activate flutterfire_cli

      - name: Install dependencies
        run: flutter pub get

      # ---- Import signing certificate ----
      - name: Import signing certificate
        env:
          CERTIFICATE_P12: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12 }}
          CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
          
          # Create temporary keychain
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          
          # Decode and import certificate
          echo "$CERTIFICATE_P12" | base64 --decode > certificate.p12
          security import certificate.p12 \
            -k "$KEYCHAIN_PATH" \
            -P "$CERTIFICATE_PASSWORD" \
            -T /usr/bin/codesign
          
          # Allow codesign to access keychain
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          
          # Make this keychain the default
          security list-keychain -d user -s "$KEYCHAIN_PATH"
          
          # Clean up
          rm certificate.p12

      # ---- Build ----
      - name: Build macOS app
        run: ./flutter_with_commit.sh build macos --release

      - name: Codesign app (hardened runtime)
        run: |
          APP="build/macos/Build/Products/Release/Streamline-Bridge.app"
          codesign --deep --force \
            --options runtime \
            --sign "Developer ID Application" \
            "$APP"

      # ---- Notarize ----
      - name: Zip app for notarization
        run: |
          cd build/macos/Build/Products/Release
          ditto -c -k --keepParent Streamline-Bridge.app Streamline-Bridge.zip

      - name: Notarize app
        env:
          APPLE_ID: ${{ secrets.APPLE_ID }}
          TEAM_ID: ${{ secrets.TEAM_ID }}
          APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }}
        run: |
          xcrun notarytool submit \
            build/macos/Build/Products/Release/Streamline-Bridge.zip \
            --apple-id "$APPLE_ID" \
            --team-id "$TEAM_ID" \
            --password "$APP_SPECIFIC_PASSWORD" \
            --wait

      - name: Staple notarization ticket
        run: |
          xcrun stapler staple build/macos/Build/Products/Release/Streamline-Bridge.app

      # ---- Upload ----
      - name: Create development ZIP
        run: |
          cd build/macos/Build/Products/Release
          ditto -c -k --keepParent Streamline-Bridge.app ../../../../../streamline-bridge-macos-develop.zip

      - name: Upload macOS app
        uses: actions/upload-artifact@v4
        with:
          name: macos-app
          path: streamline-bridge-macos-develop.zip

  build-linux:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v3

      - name: Install GTK+ 3.0
        run: sudo apt-get update && sudo apt-get install -y libgtk-3-dev

      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: 'stable'

      - name: Install dependencies
        run: flutter pub get

      - name: Build Linux app (unsigned)
        run: ./flutter_with_commit.sh build linux --release

      - name: Upload Linux app
        uses: actions/upload-artifact@v4
        with:
          name: linux-app
          path: build/linux/x64/release/bundle

  build-raspberrypi:
    name: Build for Raspberry Pi (ARM64 / Pi 4+)
    runs-on: ubuntu-22.04-arm     # ARM64 hosted runner label
    steps:
      - name: Check out repository
        uses: actions/checkout@v3

      - name: Install GTK+ 3.0
        run: sudo apt-get update && sudo apt-get install -y libgtk-3-dev

      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: master
          flutter-version: 3.38.5
      
      - name: Run git safe dir
        run: git config --global --add safe.directory /opt/hostedtoolcache/flutter/${{ steps.flutter-action.outputs.CHANNEL }}-${{ steps.flutter-action.outputs.VERSION }}-${{ steps.flutter-action.outputs.ARCHITECTURE }}

      - name: Install dependencies
        run: flutter pub get

      - name: Build Linux app (ARM64)
        run: ./flutter_with_commit.sh build linux --release 

      - name: Upload Raspberry Pi build (ARM64)
        uses: actions/upload-artifact@v4
        with:
          name: raspberrypi-linux-arm64-app
          path: build/linux/arm64/release/bundle

  build-windows:
    runs-on: windows-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v3

      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: 'stable'

      - name: Install dependencies
        run: flutter pub get

      - name: Build Windows app (unsigned)
        run: flutter build windows --release

      - name: Upload Windows app
        uses: actions/upload-artifact@v4
        with:
          name: windows-app
          path: build/windows/x64/runner/Release