release.yml

name: Release

on:
  push:
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'

permissions:
  contents: read

jobs:
  validate:
    name: Validate tag
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.check.outputs.version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Validate tag against master and VERSION
        id: check
        run: |
          set -euo pipefail

          TAG="${GITHUB_REF_NAME}"
          VERSION="$(tr -d '[:space:]' < VERSION)"

          if [[ ! "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::Tag '${TAG}' is not a semver X.Y.Z version"
            exit 1
          fi

          if [[ "$TAG" != "$VERSION" ]]; then
            echo "::error::Tag '${TAG}' does not match VERSION file ('${VERSION}')"
            exit 1
          fi

          git fetch origin master
          if ! git merge-base --is-ancestor "${GITHUB_SHA}" origin/master; then
            echo "::error::Tag '${TAG}' (commit ${GITHUB_SHA}) is not on master"
            exit 1
          fi

          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
          echo "Validated tag ${TAG} matches VERSION and is on master"

  test:
    name: Test
    needs: validate
    uses: ./.github/workflows/checks.yml

  build-server:
    name: Build server
    needs: [validate, test]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: '3.44.6'
          channel: stable
          cache: true

      - name: Install zip
        run: sudo apt-get update && sudo apt-get install -y zip

      - name: Build embedded web UI
        run: make web

      - name: Cross-compile and package server binaries
        env:
          VERSION: ${{ needs.validate.outputs.version }}
        run: |
          set -euo pipefail

          LDFLAGS="-X github.com/solargate/grom/internal/version.Version=${VERSION}"
          mkdir -p dist

          build_and_package() {
            local goos="$1"
            local goarch="$2"
            local archive_ext="$3"
            local bin_name="grom"
            if [[ "$goos" == "windows" ]]; then
              bin_name="grom.exe"
            fi

            local pkg="grom-${VERSION}-${goos}-${goarch}"
            local outdir="build/${pkg}"
            rm -rf "${outdir}"
            mkdir -p "${outdir}"

            echo "Building ${pkg}..."
            CGO_ENABLED=0 GOOS="${goos}" GOARCH="${goarch}" \
              go build -ldflags "${LDFLAGS}" -o "${outdir}/${bin_name}" ./cmd/grom

            cp -a cmd/grom/config-examples "${outdir}/config-examples"

            if [[ "$archive_ext" == "tar.gz" ]]; then
              tar -C build -czf "dist/${pkg}.tar.gz" "${pkg}"
            else
              (cd build && zip -r "../dist/${pkg}.zip" "${pkg}")
            fi
          }

          build_and_package linux   amd64 tar.gz
          build_and_package darwin  arm64 zip
          build_and_package darwin  amd64 zip
          build_and_package windows amd64 zip

          ls -la dist/

      - name: Upload server packages
        uses: actions/upload-artifact@v6
        with:
          name: server-packages
          path: dist/
          if-no-files-found: error

  resolve-android-version:
    name: Resolve Android version code
    needs: [validate, test]
    runs-on: ubuntu-latest
    outputs:
      version_code: ${{ steps.resolve.outputs.version_code }}
    steps:
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.12'

      - name: Install Google API client
        run: pip install --quiet google-api-python-client google-auth

      - name: Resolve next versionCode from Play
        id: resolve
        env:
          GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
          PACKAGE_NAME: com.solargate.grom
        run: |
          set -euo pipefail
          : "${GOOGLE_PLAY_SERVICE_ACCOUNT_JSON:?GOOGLE_PLAY_SERVICE_ACCOUNT_JSON secret is required}"

          CREDENTIALS_FILE="$(mktemp)"
          trap 'rm -f "${CREDENTIALS_FILE}"' EXIT
          printf '%s' "${GOOGLE_PLAY_SERVICE_ACCOUNT_JSON}" > "${CREDENTIALS_FILE}"
          export CREDENTIALS_FILE

          python - <<'PY'
          import os

          from google.oauth2 import service_account
          from googleapiclient.discovery import build

          package_name = os.environ["PACKAGE_NAME"]
          credentials_file = os.environ["CREDENTIALS_FILE"]

          credentials = service_account.Credentials.from_service_account_file(
              credentials_file,
              scopes=["https://www.googleapis.com/auth/androidpublisher"],
          )
          service = build("androidpublisher", "v3", credentials=credentials, cache_discovery=False)

          edit = service.edits().insert(packageName=package_name, body={}).execute()
          edit_id = edit["id"]
          max_code = 0
          try:
              tracks_resp = (
                  service.edits()
                  .tracks()
                  .list(packageName=package_name, editId=edit_id)
                  .execute()
              )
              for track in tracks_resp.get("tracks", []):
                  for release in track.get("releases", []):
                      for version_code in release.get("versionCodes", []):
                          max_code = max(max_code, int(version_code))
          finally:
              service.edits().delete(packageName=package_name, editId=edit_id).execute()

          next_code = max_code + 1
          print(f"Max Play versionCode={max_code}; next versionCode={next_code}")
          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fh:
              fh.write(f"version_code={next_code}\n")
          PY

  build-apk:
    name: Build Android APK
    needs: [validate, test, resolve-android-version]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Set up Java
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: '3.44.6'
          channel: stable
          cache: true

      - name: Prepare Android signing
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
        run: |
          set -euo pipefail
          : "${ANDROID_KEYSTORE_BASE64:?ANDROID_KEYSTORE_BASE64 secret is required}"
          : "${ANDROID_KEYSTORE_PASSWORD:?ANDROID_KEYSTORE_PASSWORD secret is required}"
          : "${ANDROID_KEY_PASSWORD:?ANDROID_KEY_PASSWORD secret is required}"
          : "${ANDROID_KEY_ALIAS:?ANDROID_KEY_ALIAS secret is required}"

          KEYSTORE_PATH="ui/grom/android/upload-keystore.jks"
          PROPS_PATH="ui/grom/android/key.properties"

          printf '%s' "${ANDROID_KEYSTORE_BASE64}" | base64 --decode > "${KEYSTORE_PATH}"
          chmod 600 "${KEYSTORE_PATH}"

          {
            printf 'storePassword=%s\n' "${ANDROID_KEYSTORE_PASSWORD}"
            printf 'keyPassword=%s\n' "${ANDROID_KEY_PASSWORD}"
            printf 'keyAlias=%s\n' "${ANDROID_KEY_ALIAS}"
            printf 'storeFile=upload-keystore.jks\n'
          } > "${PROPS_PATH}"
          chmod 600 "${PROPS_PATH}"

      - name: Build release APK
        env:
          VERSION: ${{ needs.validate.outputs.version }}
          VERSION_CODE: ${{ needs.resolve-android-version.outputs.version_code }}
        working-directory: ui/grom
        run: flutter build apk --release --build-name="${VERSION}" --build-number="${VERSION_CODE}"

      - name: Stage APK artifact
        env:
          VERSION: ${{ needs.validate.outputs.version }}
        run: |
          set -euo pipefail
          mkdir -p dist
          cp ui/grom/build/app/outputs/flutter-apk/app-release.apk "dist/grom-${VERSION}.apk"
          ls -la dist/

      - name: Verify APK signature
        env:
          VERSION: ${{ needs.validate.outputs.version }}
        run: |
          set -euo pipefail
          SDK="${ANDROID_HOME:-${ANDROID_SDK_ROOT:-}}"
          if [[ -z "${SDK}" && -f ui/grom/android/local.properties ]]; then
            SDK="$(sed -n 's/^sdk\.dir=//p' ui/grom/android/local.properties | tail -n1 | sed 's/\\:/:/g; s/\\\\/\\/g')"
          fi
          if [[ -z "${SDK}" || ! -d "${SDK}/build-tools" ]]; then
            echo "::error::Android SDK build-tools not found (ANDROID_HOME/ANDROID_SDK_ROOT/local.properties)"
            exit 1
          fi
          APKSIGNER="$(find "${SDK}/build-tools" -type f -name apksigner | sort -V | tail -n1)"
          if [[ -z "${APKSIGNER}" ]]; then
            echo "::error::apksigner not found under ${SDK}/build-tools"
            exit 1
          fi
          echo "Using ${APKSIGNER}"
          "${APKSIGNER}" verify --print-certs "dist/grom-${VERSION}.apk"

      - name: Upload APK
        uses: actions/upload-artifact@v6
        with:
          name: android-apk
          path: dist/grom-*.apk
          if-no-files-found: error

      - name: Clean up signing materials
        if: always()
        run: |
          set -euo pipefail
          rm -f ui/grom/android/upload-keystore.jks ui/grom/android/key.properties

  build-aab:
    name: Build Android AAB
    needs: [validate, test, resolve-android-version]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Set up Java
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: '3.44.6'
          channel: stable
          cache: true

      - name: Prepare Android signing
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
        run: |
          set -euo pipefail
          : "${ANDROID_KEYSTORE_BASE64:?ANDROID_KEYSTORE_BASE64 secret is required}"
          : "${ANDROID_KEYSTORE_PASSWORD:?ANDROID_KEYSTORE_PASSWORD secret is required}"
          : "${ANDROID_KEY_PASSWORD:?ANDROID_KEY_PASSWORD secret is required}"
          : "${ANDROID_KEY_ALIAS:?ANDROID_KEY_ALIAS secret is required}"

          KEYSTORE_PATH="ui/grom/android/upload-keystore.jks"
          PROPS_PATH="ui/grom/android/key.properties"

          printf '%s' "${ANDROID_KEYSTORE_BASE64}" | base64 --decode > "${KEYSTORE_PATH}"
          chmod 600 "${KEYSTORE_PATH}"

          {
            printf 'storePassword=%s\n' "${ANDROID_KEYSTORE_PASSWORD}"
            printf 'keyPassword=%s\n' "${ANDROID_KEY_PASSWORD}"
            printf 'keyAlias=%s\n' "${ANDROID_KEY_ALIAS}"
            printf 'storeFile=upload-keystore.jks\n'
          } > "${PROPS_PATH}"
          chmod 600 "${PROPS_PATH}"

      - name: Build release AAB
        env:
          VERSION: ${{ needs.validate.outputs.version }}
          VERSION_CODE: ${{ needs.resolve-android-version.outputs.version_code }}
        working-directory: ui/grom
        run: flutter build appbundle --release --build-name="${VERSION}" --build-number="${VERSION_CODE}"

      - name: Stage AAB artifact
        env:
          VERSION: ${{ needs.validate.outputs.version }}
        run: |
          set -euo pipefail
          mkdir -p dist
          cp ui/grom/build/app/outputs/bundle/release/app-release.aab "dist/grom-${VERSION}.aab"
          ls -la dist/

      - name: Upload AAB
        uses: actions/upload-artifact@v6
        with:
          name: android-aab
          path: dist/grom-*.aab
          if-no-files-found: error

      - name: Clean up signing materials
        if: always()
        run: |
          set -euo pipefail
          rm -f ui/grom/android/upload-keystore.jks ui/grom/android/key.properties

  upload-play:
    name: Upload to Google Play
    needs: [validate, build-aab]
    runs-on: ubuntu-latest
    steps:
      - name: Download AAB
        uses: actions/download-artifact@v7
        with:
          name: android-aab
          path: dist

      - name: Upload AAB to Play (internal draft)
        uses: r0adkll/upload-google-play@v1.1.5
        with:
          serviceAccountJsonPlainText: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
          packageName: com.solargate.grom
          releaseFiles: dist/grom-*.aab
          tracks: internal
          status: draft
          releaseName: Grom ${{ needs.validate.outputs.version }}

  release:
    name: Create draft release
    needs: [validate, build-server, build-apk, upload-play]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Extract release notes from CHANGELOG
        env:
          VERSION: ${{ needs.validate.outputs.version }}
        run: |
          set -euo pipefail

          awk -v ver="${VERSION}" '
            /^## \[/ {
              if (in_section) exit
              if ($0 ~ "^## \\[" ver "\\]") in_section = 1
              next
            }
            /^\[[^]]+\]: / { if (in_section) exit }
            in_section { print }
          ' CHANGELOG.md | sed '/./,$!d' > release-notes.md

          if [[ ! -s release-notes.md ]]; then
            echo "::error::No CHANGELOG section found for version ${VERSION}"
            exit 1
          fi

          echo "--- Release notes ---"
          cat release-notes.md

      - name: Download server packages
        uses: actions/download-artifact@v7
        with:
          name: server-packages
          path: artifacts

      - name: Download APK
        uses: actions/download-artifact@v7
        with:
          name: android-apk
          path: artifacts

      - name: List artifacts
        run: ls -la artifacts/

      - name: Create draft GitHub release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ needs.validate.outputs.version }}
          draft: true
          body_path: release-notes.md
          files: artifacts/*
          fail_on_unmatched_files: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}