build.yml

name: APK Build

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

env:
  OPENSSL_VERSION: "3.0.15"

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ secrets.SUBMODULE_TOKEN }}

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'jetbrains'

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3

      - name: Install Android NDK
        run: |
          sdkmanager --install "ndk;29.0.14206865"
          echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/29.0.14206865" >> $GITHUB_ENV

      - name: Cache Rust/Cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo
            ~/.rustup
            app/src/main/rust/slipstream-rust/target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android

      - name: Install cargo-ndk
        run: cargo install cargo-ndk --locked

      - name: Cache OpenSSL
        id: cache-openssl
        uses: actions/cache@v4
        with:
          path: ~/android-openssl
          key: openssl-android-${{ env.OPENSSL_VERSION }}

      - name: Build OpenSSL for Android
        if: steps.cache-openssl.outputs.cache-hit != 'true'
        run: |
          chmod +x app/scripts/build-openssl-android.sh
          OUTPUT_DIR=$HOME/android-openssl/android-ssl \
          OPENSSL_VERSION=${{ env.OPENSSL_VERSION }} \
          ./app/scripts/build-openssl-android.sh

      - name: Verify OpenSSL installation
        run: |
          for abi in arm64-v8a armeabi-v7a x86_64; do
            for lib in libssl.a libcrypto.a; do
              test -f ~/android-openssl/android-ssl/$abi/lib/$lib || { echo "Missing $abi/lib/$lib"; exit 1; }
            done
          done
          echo "OpenSSL verification passed"

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: gomobile-build/go.mod
          cache-dependency-path: gomobile-build/go.sum

      - name: Install gomobile
        run: go install golang.org/x/mobile/cmd/gomobile@latest && gomobile init

      - name: Build Go mobile libraries
        working-directory: gomobile-build
        run: make build

      - name: Cache Gradle packages
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Decode Keystore
        env:
          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
        run: |
          if [ -n "$KEYSTORE_BASE64" ]; then
            echo "$KEYSTORE_BASE64" | base64 -d > slipnet-release.keystore
            echo "KEYSTORE_DECODED=true" >> $GITHUB_ENV
          fi

      - name: Create keystore.properties
        if: env.KEYSTORE_DECODED == 'true'
        env:
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: |
          cat > keystore.properties <<EOF
          storeFile=../slipnet-release.keystore
          storePassword=$KEYSTORE_PASSWORD
          keyAlias=$KEY_ALIAS
          keyPassword=$KEY_PASSWORD
          EOF
          # Strip leading whitespace from heredoc indentation
          sed -i 's/^[[:space:]]*//' keystore.properties

      - name: Set up local.properties
        env:
          CONFIG_ENCRYPTION_KEY: ${{ secrets.CONFIG_ENCRYPTION_KEY }}
        run: |
          echo "sdk.dir=$ANDROID_HOME" > local.properties
          echo "CONFIG_ENCRYPTION_KEY=$CONFIG_ENCRYPTION_KEY" >> local.properties

      - name: Build Full Release APK
        run: ./gradlew assembleFullRelease --no-daemon

      - name: Build Lite Release APK
        run: ./gradlew assembleLiteRelease --no-daemon

      - name: Collect release APKs
        run: |
          mkdir -p release-apks
          cp app/build/outputs/apk/full/release/SlipNet-*-full-*.apk release-apks/ 2>/dev/null || true
          cp app/build/outputs/apk/lite/release/SlipNet-*-lite-*.apk release-apks/ 2>/dev/null || true

      - name: Upload Release APKs
        uses: actions/upload-artifact@v4
        with:
          name: app-release
          path: release-apks/*.apk
          retention-days: 5

  release:
    needs: build
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: write

    steps:
      - name: Download Release APK
        uses: actions/download-artifact@v4
        with:
          name: app-release
          path: ./artifacts

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          files: ./artifacts/*.apk
          generate_release_notes: true
          prerelease: ${{ contains(github.ref, 'beta') || contains(github.ref, 'alpha') || contains(github.ref, 'rc') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}