sync-and-release.yml

name: Sync upstream and release

on:
  schedule:
    - cron: "0 */6 * * *"
  workflow_dispatch:
    inputs:
      force_build:
        description: "强制编译一次（忽略是否有新提交）"
        type: boolean
        default: false

permissions:
  contents: write

jobs:
  sync:
    runs-on: ubuntu-latest
    outputs:
      has_changes: ${{ steps.merge.outputs.has_changes }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Merge upstream
        id: merge
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git remote add upstream https://github.com/chen2he/orange-cloud.git
          git fetch upstream
          BEFORE=$(git rev-parse HEAD)
          git merge upstream/main --no-edit
          AFTER=$(git rev-parse HEAD)
          if [ "$BEFORE" != "$AFTER" ]; then
            git push origin HEAD:main
            echo "has_changes=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_changes=false" >> "$GITHUB_OUTPUT"
          fi

  build:
    needs: sync
    if: needs.sync.outputs.has_changes == 'true' || inputs.force_build == true
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/android
    steps:
      - uses: actions/checkout@v4
        with:
          ref: main

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17

      - name: Set up Android SDK
        uses: android-actions/setup-android@v3

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Remove daemon JVM pin (CI has no JetBrains JBR)
        run: rm -f gradle/gradle-daemon-jvm.properties

      - name: Decode keystore
        run: |
          echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > app/release.jks
          cat > keystore.properties <<EOF
          storeFile=release.jks
          storePassword=${{ secrets.KEYSTORE_PASSWORD }}
          keyAlias=${{ secrets.KEY_ALIAS }}
          keyPassword=${{ secrets.KEY_PASSWORD }}
          EOF

      - name: Build OSS release APK
        run: ./gradlew :app:assembleOssRelease -POAUTH_CLIENT_ID=${{ secrets.OAUTH_CLIENT_ID }}

      - name: Read version from build.gradle.kts
        id: version
        run: |
          BASE_VERSION=$(grep -oP 'versionName\s*=\s*"\K[^"]+' app/build.gradle.kts | head -n1)
          if [ -z "$BASE_VERSION" ]; then
            echo "Could not find versionName in app/build.gradle.kts" >&2
            exit 1
          fi
          # oss flavor 有 versionNameSuffix（如 "-oss"），拼到 base 版本号后面，
          # 与实际打出来的 APK 版本号保持一致
          OSS_SUFFIX=$(awk '/create\("oss"\)/,/^\s*}/' app/build.gradle.kts \
            | grep -oP 'versionNameSuffix\s*=\s*"\K[^"]+' | head -n1)
          echo "name=${BASE_VERSION}${OSS_SUFFIX}" >> "$GITHUB_OUTPUT"

      - name: Compute tag
        id: tag
        run: echo "tag=oss-v${{ steps.version.outputs.name }}-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.tag.outputs.tag }}
          name: OSS build v${{ steps.version.outputs.name }}
          files: apps/android/app/build/outputs/apk/oss/release/*.apk
          body: |
            自动同步自 chen2he/orange-cloud 上游更新，OSS 风味 release 签名构建。
            版本: ${{ steps.version.outputs.name }}
            Commit: ${{ github.sha }}