name: Android APK

on:
  push:
    branches:
      - main
    tags:
      - "v*"
  pull_request:
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      PUBLISH_RELEASE: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set version
        shell: bash
        run: |
          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            VERSION_NAME="${GITHUB_REF_NAME#v}"
          else
            VERSION_NAME="0.1.${GITHUB_RUN_NUMBER}"
          fi
          VERSION_CODE=$((1000 + GITHUB_RUN_NUMBER))
          echo "VERSION_NAME=${VERSION_NAME}" >> "${GITHUB_ENV}"
          echo "VERSION_CODE=${VERSION_CODE}" >> "${GITHUB_ENV}"

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Set up Android SDK
        uses: android-actions/setup-android@v3

      - name: Install Android packages
        shell: bash
        run: sdkmanager "platforms;android-35" "build-tools;35.0.0" "platform-tools"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4
        with:
          gradle-version: "8.10.2"

      - name: Configure signing
        id: signing
        shell: bash
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          if [[ -z "${ANDROID_KEYSTORE_BASE64}" ]]; then
            echo "signed=false" >> "${GITHUB_OUTPUT}"
            exit 0
          fi
          echo "${ANDROID_KEYSTORE_BASE64}" | base64 -d > release.jks
          {
            echo "storeFile=release.jks"
            echo "storePassword=${ANDROID_KEYSTORE_PASSWORD}"
            echo "keyAlias=${ANDROID_KEY_ALIAS}"
            echo "keyPassword=${ANDROID_KEY_PASSWORD}"
          } > signing.properties
          echo "signed=true" >> "${GITHUB_OUTPUT}"

      - name: Build APK
        shell: bash
        run: |
          if [[ "${{ steps.signing.outputs.signed }}" == "true" ]]; then
            BUILD_TASK=":app:assembleRelease"
          else
            BUILD_TASK=":app:assembleDebug"
          fi
          gradle "${BUILD_TASK}" \
            -PversionCode="${VERSION_CODE}" \
            -PversionName="${VERSION_NAME}" \
            -PrepoSlug="${GITHUB_REPOSITORY}"

      - name: Prepare artifacts
        shell: bash
        run: |
          mkdir -p release
          APK_PATH="$(find app/build/outputs/apk -name '*.apk' | sort | tail -n 1)"
          cp "${APK_PATH}" "release/tmux-android.apk"
          cp "${APK_PATH}" "release/tmux-android-${VERSION_NAME}.apk"
          SHA256="$(sha256sum release/tmux-android.apk | awk '{print $1}')"
          APK_URL="https://github.com/${GITHUB_REPOSITORY}/releases/latest/download/tmux-android.apk"
          RELEASE_PAGE_URL="https://github.com/${GITHUB_REPOSITORY}/releases/latest"
          cat > release/latest.json << JSON
          {
            "versionCode": ${VERSION_CODE},
            "versionName": "${VERSION_NAME}",
            "apkUrl": "${APK_URL}",
            "sha256": "${SHA256}",
            "releasePageUrl": "${RELEASE_PAGE_URL}",
            "minSdk": 26
          }
          JSON

      - name: Upload workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: tmux-android-${{ env.VERSION_NAME }}
          path: |
            release/tmux-android.apk
            release/tmux-android-${{ env.VERSION_NAME }}.apk
            release/latest.json

      - name: Require signing for release publishing
        if: env.PUBLISH_RELEASE == 'true' && steps.signing.outputs.signed != 'true'
        shell: bash
        run: |
          echo "Release publishing requires ANDROID_KEYSTORE_BASE64 and signing secrets." >&2
          exit 1

      - name: Publish GitHub Release
        if: env.PUBLISH_RELEASE == 'true'
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          TAG="${GITHUB_REF_NAME}"

          if gh release view "${TAG}" >/dev/null 2>&1; then
            gh release upload "${TAG}" release/tmux-android.apk release/latest.json --clobber
          else
            gh release create "${TAG}" release/tmux-android.apk release/latest.json \
              --latest \
              --title "tmux Android ${VERSION_NAME}" \
              --notes "Android APK for tmux-ui remote testing."
          fi