release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

jobs:
  build-and-release:
    name: Build Signed Release and Publish
    runs-on: ubuntu-latest
    permissions:
      contents: write

    env:
      KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
      KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
      KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
      KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}

    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

      - name: Setup JDK 17
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: 'gradle'

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Validate signing secrets
        shell: bash
        run: |
          set -euo pipefail
          missing=()
          [ -n "$KEYSTORE_BASE64" ] || missing+=("KEYSTORE_BASE64")
          [ -n "$KEYSTORE_PASSWORD" ] || missing+=("KEYSTORE_PASSWORD")
          [ -n "$KEY_ALIAS" ] || missing+=("KEY_ALIAS")
          [ -n "$KEY_PASSWORD" ] || missing+=("KEY_PASSWORD")

          if [ ${#missing[@]} -gt 0 ]; then
            echo "Release signing is required. Missing secrets: ${missing[*]}"
            exit 1
          fi

      - name: Decode keystore
        shell: bash
        run: |
          set -euo pipefail
          KEYSTORE_PATH="$RUNNER_TEMP/release.keystore"
          echo "$KEYSTORE_BASE64" | base64 --decode > "$KEYSTORE_PATH"
          echo "KEYSTORE_FILE=$KEYSTORE_PATH" >> "$GITHUB_ENV"

      - name: Build signed release APK
        run: ./gradlew assembleRelease --no-daemon
        env:
          KEYSTORE_FILE: ${{ env.KEYSTORE_FILE }}
          KEYSTORE_PASSWORD: ${{ env.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ env.KEY_ALIAS }}
          KEY_PASSWORD: ${{ env.KEY_PASSWORD }}

      - name: Upload release artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: AppControlX-release
          path: app/build/outputs/apk/release/*.apk
          if-no-files-found: error
          retention-days: 30

      - name: Publish GitHub release
        uses: softprops/action-gh-release@26994186c0ac3ef5cae75ac16aa32e8153525f77
        with:
          name: AppControlX ${{ github.ref_name }}
          files: app/build/outputs/apk/release/*.apk
          generate_release_notes: true
          draft: false
          prerelease: false