android-beta.yml

name: Android Beta

on:
  push:
    branches:
      - beta
    paths:
      - 'app/**'
      - 'build-logic/**'
      - 'core/**'
      - 'feature/**'
      - 'player/**'
      - 'baseline-profile/**'
      - 'gradle/**'
      - '*.gradle.kts'
      - 'gradle.properties'
      - 'settings.gradle.kts'
  pull_request:
    branches:
      - beta
    paths:
      - 'app/**'
      - 'build-logic/**'
      - 'core/**'
      - 'feature/**'
      - 'player/**'
      - 'baseline-profile/**'
      - 'gradle/**'
      - '*.gradle.kts'
      - 'gradle.properties'
      - 'settings.gradle.kts'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: android-beta
  cancel-in-progress: false

env:
  CI: true
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
  JAVA_TOOL_OPTIONS: -Djava.awt.headless=true
  GITHUB_REPO: TypeType-Video/TypeType-Android

jobs:
  release:
    runs-on: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && fromJSON('["self-hosted","stack-android"]') || 'ubuntu-latest' }}
    timeout-minutes: 50
    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Java
        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
        with:
          distribution: temurin
          java-version: 21

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
        with:
          cache-disabled: ${{ runner.environment == 'self-hosted' }}

      - name: Install Android SDK platform
        if: ${{ runner.environment == 'github-hosted' }}
        run: |
          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --install \
            "platforms;android-37.0" "build-tools;36.0.0" > /dev/null

      - name: Validate beta release version
        id: version
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          version_name="$(sed -nE 's/^[[:space:]]*versionName = "([^"]+)"/\1/p' app/build.gradle.kts)"
          version_code="$(sed -nE 's/^[[:space:]]*versionCode = ([0-9]+)/\1/p' app/build.gradle.kts)"
          release_tag="v${version_name}"

          [[ "$version_name" =~ ^[0-9]+\.[0-9]+\.[0-9]+-beta\.[1-9][0-9]*$ ]]
          [[ "$version_code" =~ ^[1-9][0-9]*$ ]]

          latest_code="$(
            gh api \
              -H 'Accept: application/vnd.github+json' \
              --paginate "repos/${GITHUB_REPO}/releases" \
              --jq '.[] | select(.draft == false and .prerelease == true) | .assets[]?.name | capture("^dev\\.typetype\\.android_(?<code>[0-9]+)\\.apk$").code' \
              2>/dev/null | sort -nu | tail -n 1
          )"
          latest_code="${latest_code:-0}"

          if [ "$version_code" -le "$latest_code" ]; then
            echo "versionCode $version_code must be greater than latest beta $latest_code" >&2
            exit 1
          fi

          if gh api "repos/${GITHUB_REPO}/git/ref/tags/${release_tag}" > /dev/null 2>&1; then
            echo "Tag ${release_tag} already exists" >&2
            exit 1
          fi

          {
            echo "RELEASE_VERSION=${version_name}"
            echo "RELEASE_CODE=${version_code}"
            echo "RELEASE_TAG=${release_tag}"
          } >> "$GITHUB_ENV"
          {
            echo "version=${version_name}"
            echo "tag=${release_tag}"
          } >> "$GITHUB_OUTPUT"

      - name: Prepare signing
        if: ${{ github.event_name != 'pull_request' }}
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          test -n "$ANDROID_KEYSTORE_BASE64"
          test -n "$ANDROID_KEYSTORE_PASSWORD"
          test -n "$ANDROID_KEY_ALIAS"
          test -n "$ANDROID_KEY_PASSWORD"
          printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 --decode > release.keystore
          {
            printf 'storeFile=%s\n' "$PWD/release.keystore"
            printf 'storePassword=%s\n' "$ANDROID_KEYSTORE_PASSWORD"
            printf 'keyAlias=%s\n' "$ANDROID_KEY_ALIAS"
            printf 'keyPassword=%s\n' "$ANDROID_KEY_PASSWORD"
          } > keystore.properties

      - name: Verify and build beta release
        timeout-minutes: 40
        run: |
          ./gradlew --stacktrace \
            :baseline-profile:assemble \
            testDebugUnitTest \
            lintDebug \
            :app:assembleDebug \
            :app:assembleRelease

      - name: Upload lint report
        if: ${{ always() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: typetype-beta-lint-report
          path: |
            **/build/reports/lint-results-debug.html
          if-no-files-found: ignore
          retention-days: 14

      - name: Verify and prepare beta APK
        run: |
          export PATH="$JAVA_HOME/bin:$PATH"
          mkdir -p artifacts
          apk="$(find app/build/outputs/apk/release -name '*.apk' | head -n 1)"
          test -n "$apk"
          build_tools="$(find "$ANDROID_HOME/build-tools" -mindepth 1 -maxdepth 1 -type d | sort -V | tail -n 1)"
          test -n "$build_tools"

          "$build_tools/zipalign" -c -P 16 -v 4 "$apk"
          if [ "$GITHUB_EVENT_NAME" != pull_request ]; then
            "$build_tools/apksigner" verify --verbose --print-certs "$apk"
          fi

          apk_application_id="$("$ANDROID_HOME/cmdline-tools/latest/bin/apkanalyzer" manifest application-id "$apk")"
          apk_version="$("$ANDROID_HOME/cmdline-tools/latest/bin/apkanalyzer" manifest version-name "$apk")"
          apk_code="$("$ANDROID_HOME/cmdline-tools/latest/bin/apkanalyzer" manifest version-code "$apk")"
          test "$apk_application_id" = "dev.typetype.android"
          test "$apk_version" = "$RELEASE_VERSION"
          test "$apk_code" = "$RELEASE_CODE"

          cp "$apk" "artifacts/dev.typetype.android_${RELEASE_CODE}.apk"
          (
            cd artifacts
            sha256sum "dev.typetype.android_${RELEASE_CODE}.apk" \
              > "dev.typetype.android_${RELEASE_CODE}.apk.sha256"
            sha256sum -c "dev.typetype.android_${RELEASE_CODE}.apk.sha256"
          )

      - name: Prepare beta update manifest
        run: |
          apk_name="dev.typetype.android_"$RELEASE_CODE".apk"
          apk_sha256="$(cut -d ' ' -f1 "artifacts/$apk_name.sha256")"
          jq -n \
            --arg channel beta \
            --arg packageName dev.typetype.android \
            --arg versionName "$RELEASE_VERSION" \
            --argjson versionCode "$RELEASE_CODE" \
            --arg apkAsset "$apk_name" \
            --arg sha256 "$apk_sha256" \
            '{schemaVersion:1,channel:$channel,packageName:$packageName,versionName:$versionName,versionCode:$versionCode,apkAsset:$apkAsset,sha256:$sha256}' \
            > artifacts/typetype-update.json

      - name: Upload beta APK
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: typetype-beta-apk
          path: |
            artifacts/*.apk
            artifacts/*.sha256
            artifacts/typetype-update.json
          if-no-files-found: error
          compression-level: 0
          retention-days: 30

  publish:
    needs: release
    if: ${{ github.event_name != 'pull_request' }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write
    env:
      RELEASE_VERSION: ${{ needs.release.outputs.version }}
      RELEASE_TAG: ${{ needs.release.outputs.tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download beta APK
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: typetype-beta-apk
          path: artifacts

      - name: Prepare beta release notes
        env:
          HEAD_MESSAGE: ${{ github.event.head_commit.message }}
        run: |
          if [ -f "release-notes/${RELEASE_TAG}.md" ]; then
            cp "release-notes/${RELEASE_TAG}.md" release-body.md
          else
            printf '%s\n' "${HEAD_MESSAGE:-Beta build from the development branch.}" > release-body.md
          fi

      - name: Publish GitHub prerelease
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          name: TypeType Android ${{ env.RELEASE_VERSION }}
          body_path: release-body.md
          prerelease: true
          make_latest: false
          generate_release_notes: false
          target_commitish: beta
          files: |
            artifacts/*.apk
            artifacts/*.sha256
            artifacts/typetype-update.json
          fail_on_unmatched_files: true