name: release

on:
  workflow_dispatch:

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    uses: ./.github/workflows/build.yml
    secrets: inherit
    permissions:
      contents: read
    with:
      artifact-name: inugram-${{ github.sha }}

  sign:
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    environment: signing
    permissions:
      id-token: write
      attestations: write
      artifact-metadata: write
      contents: read
    steps:
      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
        with:
          distribution: temurin
          java-version: 21

      - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
        with:
          packages: build-tools;35.0.0

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: inugram-${{ github.sha }}-unsigned
          path: out

      - name: decode keystore
        env:
          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
        run: |
          if [ -z "$KEYSTORE_BASE64" ]; then
            echo "::error::KEYSTORE_BASE64 secret missing"
            exit 1
          fi
          umask 077
          echo "$KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.keystore"

      - name: apksigner sign
        env:
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: |
          apk='${{ needs.build.outputs.apk-name }}'
          apksigner=$ANDROID_HOME/build-tools/35.0.0/apksigner
          "$apksigner" sign \
            --ks "$RUNNER_TEMP/release.keystore" \
            --ks-key-alias inugram \
            --ks-pass "pass:$KEYSTORE_PASSWORD" \
            --key-pass "pass:$KEY_PASSWORD" \
            --in "out/$apk" \
            --out "out/$apk.signed"
          "$apksigner" verify --print-certs "out/$apk.signed"
          mv "out/$apk.signed" "out/$apk"

      - name: wipe keystore
        if: always()
        run: rm -f "$RUNNER_TEMP/release.keystore"

      - name: attest signed apk
        uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb # v4
        with:
          subject-path: out/${{ needs.build.outputs.apk-name }}

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: inugram-${{ github.sha }}
          path: out/*
          if-no-files-found: error
          retention-days: 30

  upload:
    needs: [build, sign]
    if: github.repository == 'teidesu/inugram'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 20
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: inugram-${{ github.sha }}
          path: out

      - name: create github release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          tag='${{ needs.build.outputs.tag }}'
          apk='${{ needs.build.outputs.apk-name }}'
          gh release create "$tag" \
            --target "$GITHUB_SHA" \
            --title "$tag" \
            --generate-notes \
            "out/$apk"

      - name: upload to telegram
        env:
          TELEGRAM_API_ID: ${{ secrets.TELEGRAM_API_ID }}
          TELEGRAM_API_HASH: ${{ secrets.TELEGRAM_API_HASH }}
          TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
          TELEGRAM_CHANNEL: ${{ vars.TELEGRAM_CHANNEL || 'InugramCI' }}
          MTPROTO_SESSION: ${{ secrets.MTPROTO_SESSION }}
          GH_VARS_TOKEN: ${{ secrets.INU_VARS_TOKEN }}
        run: pnpm tsx scripts/ci/upload.ts out

      - name: bump INU_BUILD and LAST_RELEASE_SHA variables
        env:
          GH_TOKEN: ${{ secrets.INU_VARS_TOKEN }}
        run: |
          next=$((${{ needs.build.outputs.build-num }} + 1))
          gh variable set INU_BUILD --body "$next"
          gh variable set LAST_RELEASE_SHA --body "$GITHUB_SHA"
