release.yml

name: Release Project Lumen Android

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: write
  packages: read

jobs:
  release-android:
    name: Build release APK
    runs-on: ubuntu-latest
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Set up Java 21
        uses: actions/setup-java@v5
        with:
          distribution: zulu
          java-version: "21"

      - name: Accept Android SDK licenses
        run: |
          NDK_VERSION="$(sed -n 's/^projectLumenNdkVersion=//p' gradle.properties | tail -n 1 | tr -d '[:space:]')"
          CMAKE_VERSION="$(sed -n 's/^projectLumenCmakeVersion=//p' gradle.properties | tail -n 1 | tr -d '[:space:]')"
          if [ -z "$NDK_VERSION" ] || [ -z "$CMAKE_VERSION" ]; then
            echo "::error::projectLumenNdkVersion and projectLumenCmakeVersion must be set in gradle.properties."
            exit 1
          fi
          SDK_MANAGER="$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager"
          if [ ! -f "$SDK_MANAGER" ]; then
            SDK_MANAGER="$ANDROID_HOME/tools/bin/sdkmanager"
          fi
          if [ ! -f "$SDK_MANAGER" ]; then
            SDK_MANAGER="$(command -v sdkmanager || true)"
          fi
          if [ -z "$SDK_MANAGER" ]; then
            echo "::warning::sdkmanager was not found; the Android Gradle Plugin will download the toolchain itself."
            exit 0
          fi
          echo "Accepting Android SDK licenses via $SDK_MANAGER"
          yes | "$SDK_MANAGER" --licenses 2>&1 || true
          # AGP downloads these itself when missing, so a transient install failure must not fail the job.
          "$SDK_MANAGER" --install "ndk;${NDK_VERSION}" "cmake;${CMAKE_VERSION}" 2>&1 || true

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4
        with:
          gradle-version: "9.5.1"
          cache-read-only: false
          cache-cleanup: on-success

      - name: Read app version
        run: |
          FILE_VERSION_NAME=$(tr -d '\r' < app/application.version | sed -n '1{s/^[[:space:]]*//; s/[[:space:]]*$//; p;}')
          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
            TAG_VERSION="${GITHUB_REF_NAME#v}"
            VERSION_NAME="${TAG_VERSION:-$FILE_VERSION_NAME}"
          else
            VERSION_NAME="$FILE_VERSION_NAME"
          fi
          VERSION_CODE="${GITHUB_RUN_NUMBER:-$(date -u +%s)}"
          if ! [[ "$VERSION_CODE" =~ ^[0-9]+$ ]] || [ "$VERSION_CODE" -lt 1 ]; then
            VERSION_CODE="$(date -u +%s)"
          fi
          BUILD_TIME_UTC_MILLIS=$(date -u +%s%3N)
          COMMIT_HASH="${GITHUB_SHA}"
          SHORT_HASH="${GITHUB_SHA::8}"
          echo "PROJECT_LUMEN_VERSION_NAME=${VERSION_NAME:-0.0.0}" >> "$GITHUB_ENV"
          echo "PROJECT_LUMEN_VERSION_CODE=${VERSION_CODE}" >> "$GITHUB_ENV"
          echo "PROJECT_LUMEN_BUILD_TIME_UTC_MILLIS=$BUILD_TIME_UTC_MILLIS" >> "$GITHUB_ENV"
          echo "PROJECT_LUMEN_COMMIT_HASH=$COMMIT_HASH" >> "$GITHUB_ENV"
          echo "PROJECT_LUMEN_SHORT_HASH=$SHORT_HASH" >> "$GITHUB_ENV"

      - name: Run state machine unit tests
        env:
          PROJECT_LUMEN_VERSION_NAME: ${{ env.PROJECT_LUMEN_VERSION_NAME }}
          PROJECT_LUMEN_VERSION_CODE: ${{ env.PROJECT_LUMEN_VERSION_CODE }}
          PROJECT_LUMEN_BUILD_TIME_UTC_MILLIS: ${{ env.PROJECT_LUMEN_BUILD_TIME_UTC_MILLIS }}
          PROJECT_LUMEN_COMMIT_HASH: ${{ env.PROJECT_LUMEN_COMMIT_HASH }}
          PROJECT_LUMEN_SHORT_HASH: ${{ env.PROJECT_LUMEN_SHORT_HASH }}
        run: gradle testDebugUnitTest --no-daemon --warning-mode all

      - name: Run Android lint
        env:
          PROJECT_LUMEN_VERSION_NAME: ${{ env.PROJECT_LUMEN_VERSION_NAME }}
          PROJECT_LUMEN_VERSION_CODE: ${{ env.PROJECT_LUMEN_VERSION_CODE }}
          PROJECT_LUMEN_BUILD_TIME_UTC_MILLIS: ${{ env.PROJECT_LUMEN_BUILD_TIME_UTC_MILLIS }}
          PROJECT_LUMEN_COMMIT_HASH: ${{ env.PROJECT_LUMEN_COMMIT_HASH }}
          PROJECT_LUMEN_SHORT_HASH: ${{ env.PROJECT_LUMEN_SHORT_HASH }}
        run: gradle lintDebug --no-daemon --warning-mode all

      - name: Upload verification reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: project-lumen-verification-reports
          path: |
            app/build/reports/tests/**
            app/build/reports/lint-results-debug.html
            app/build/reports/lint-results-debug.xml
            build/reports/problems/**
          retention-days: 14

      - name: Write signing config
        env:
          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: |
          set -euo pipefail

          KEY_ALIAS="$(printf '%s' "${KEY_ALIAS:-}" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
          KEYSTORE_PASSWORD="$(printf '%s' "${KEYSTORE_PASSWORD:-}" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
          KEY_PASSWORD="$(printf '%s' "${KEY_PASSWORD:-}" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
          KEYSTORE_BASE64="$(printf '%s' "${KEYSTORE_BASE64:-}" | tr -d '[:space:]')"

          echo "=== Release signing secret presence (values redacted) ==="
          echo "KEYSTORE_BASE64 present: $([ -n "$KEYSTORE_BASE64" ] && echo yes || echo no)"
          echo "KEYSTORE_BASE64 length: ${#KEYSTORE_BASE64}"
          echo "KEYSTORE_PASSWORD present: $([ -n "$KEYSTORE_PASSWORD" ] && echo yes || echo no)"
          echo "KEY_ALIAS present: $([ -n "$KEY_ALIAS" ] && echo yes || echo no)"
          echo "KEY_ALIAS value: ${KEY_ALIAS:-<empty>}"
          echo "KEY_PASSWORD present: $([ -n "$KEY_PASSWORD" ] && echo yes || echo no)"

          if [ -f "gradle.properties" ]; then
            sed -i 's/\r$//' gradle.properties
            sed -i '/^PROJECT_LUMEN_USE_DEBUG_SIGNING=/d' gradle.properties
            sed -i '/^PROJECT_LUMEN_STORE_FILE=/d' gradle.properties
            sed -i '/^PROJECT_LUMEN_STORE_PASSWORD=/d' gradle.properties
            sed -i '/^PROJECT_LUMEN_KEY_ALIAS=/d' gradle.properties
            sed -i '/^PROJECT_LUMEN_KEY_PASSWORD=/d' gradle.properties
            [ -n "$(tail -c 1 gradle.properties)" ] && echo "" >> gradle.properties
          fi

          if [ -z "$KEYSTORE_BASE64" ] || [ -z "$KEYSTORE_PASSWORD" ] || [ -z "$KEY_ALIAS" ] || [ -z "$KEY_PASSWORD" ]; then
            echo "::error::Release signing secrets are incomplete. Required repository secrets: KEYSTORE_BASE64, KEYSTORE_PASSWORD, KEY_ALIAS, KEY_PASSWORD."
            exit 1
          fi

          KEYSTORE_PATH="${{ github.workspace }}/project_lumen.jks"
          printf '%s' "$KEYSTORE_BASE64" | base64 --decode > "$KEYSTORE_PATH"
          if [ ! -s "$KEYSTORE_PATH" ]; then
            echo "::error::Failed to decode KEYSTORE_BASE64 into a non-empty keystore file."
            exit 1
          fi

          if ! keytool -list -keystore "$KEYSTORE_PATH" -storepass "$KEYSTORE_PASSWORD" -alias "$KEY_ALIAS" >/tmp/keystore-alias.txt 2>/tmp/keystore-alias.err; then
            echo "::error::Keystore validation failed for alias '$KEY_ALIAS'."
            cat /tmp/keystore-alias.err
            exit 1
          fi

          echo "=== Keystore alias validation ==="
          cat /tmp/keystore-alias.txt

          CERT_SHA256="$(keytool -exportcert -alias "$KEY_ALIAS" -keystore "$KEYSTORE_PATH" -storepass "$KEYSTORE_PASSWORD" 2>/dev/null | openssl dgst -sha256 -hex | awk '{print toupper($2)}')"
          CERT_SHA256_COLON="$(printf '%s' "$CERT_SHA256" | sed 's/../&:/g; s/:$//')"
          echo "Release cert SHA-256: $CERT_SHA256"
          echo "Release cert SHA-256 (colon): $CERT_SHA256_COLON"
          echo "PROJECT_LUMEN_RELEASE_CERT_SHA256=${CERT_SHA256}" >> "$GITHUB_ENV"

          printf 'PROJECT_LUMEN_STORE_FILE=%s\n' "$KEYSTORE_PATH" >> gradle.properties
          printf 'PROJECT_LUMEN_STORE_PASSWORD=%s\n' "$KEYSTORE_PASSWORD" >> gradle.properties
          printf 'PROJECT_LUMEN_KEY_ALIAS=%s\n' "$KEY_ALIAS" >> gradle.properties
          printf 'PROJECT_LUMEN_KEY_PASSWORD=%s\n' "$KEY_PASSWORD" >> gradle.properties
          echo "Release signing configured with repository secrets."

      - name: Build release APK
        env:
          PROJECT_LUMEN_VERSION_NAME: ${{ env.PROJECT_LUMEN_VERSION_NAME }}
          PROJECT_LUMEN_VERSION_CODE: ${{ env.PROJECT_LUMEN_VERSION_CODE }}
          PROJECT_LUMEN_BUILD_TIME_UTC_MILLIS: ${{ env.PROJECT_LUMEN_BUILD_TIME_UTC_MILLIS }}
          PROJECT_LUMEN_COMMIT_HASH: ${{ env.PROJECT_LUMEN_COMMIT_HASH }}
          PROJECT_LUMEN_SHORT_HASH: ${{ env.PROJECT_LUMEN_SHORT_HASH }}
          PROJECT_LUMEN_API_BASE_URL: ${{ secrets.PROJECT_LUMEN_API_BASE_URL }}
          PROJECT_LUMEN_API_CERTIFICATE_PINNING_ENABLED: ${{ secrets.PROJECT_LUMEN_API_CERTIFICATE_PINNING_ENABLED }}
          PROJECT_LUMEN_API_CERTIFICATE_PINS: ${{ secrets.PROJECT_LUMEN_API_CERTIFICATE_PINS }}
          PROJECT_LUMEN_TRANSLATION_API_BASE_URL: ${{ secrets.PROJECT_LUMEN_TRANSLATION_API_BASE_URL }}
          PROJECT_LUMEN_TRANSLATION_CERTIFICATE_PINNING_ENABLED: ${{ secrets.PROJECT_LUMEN_TRANSLATION_CERTIFICATE_PINNING_ENABLED }}
          PROJECT_LUMEN_TRANSLATION_CERTIFICATE_PINS: ${{ secrets.PROJECT_LUMEN_TRANSLATION_CERTIFICATE_PINS }}
          PROJECT_LUMEN_TELEMETRY_ACCESS_TOKEN: ${{ secrets.PROJECT_LUMEN_TELEMETRY_ACCESS_TOKEN }}
          PROJECT_LUMEN_REQUEST_SIGNING_SECRET: ${{ secrets.PROJECT_LUMEN_REQUEST_SIGNING_SECRET }}
          PROJECT_LUMEN_RELEASE_CERT_SHA256: ${{ secrets.PROJECT_LUMEN_RELEASE_CERT_SHA256 || env.PROJECT_LUMEN_RELEASE_CERT_SHA256 }}
          PROJECT_LUMEN_OPEN_API_TRUSTED_SIGNATURE_SHA256: ${{ secrets.PROJECT_LUMEN_OPEN_API_TRUSTED_SIGNATURE_SHA256 }}
        run: |
          set -euo pipefail
          if [ -f gradle.properties ]; then
            sed -i '/^PROJECT_LUMEN_USE_DEBUG_SIGNING=/d' gradle.properties
          fi
          if ! grep -q '^PROJECT_LUMEN_STORE_FILE=' gradle.properties || \
             ! grep -q '^PROJECT_LUMEN_STORE_PASSWORD=' gradle.properties || \
             ! grep -q '^PROJECT_LUMEN_KEY_ALIAS=' gradle.properties || \
             ! grep -q '^PROJECT_LUMEN_KEY_PASSWORD=' gradle.properties; then
            echo "::error::Release signing properties missing before assembleRelease."
            exit 1
          fi
          gradle :app:assembleRelease --no-daemon --warning-mode all

      - name: Verify 16 KB native library alignment
        run: python3 scripts/verify_android_16kb_alignment.py app/build/outputs/apk/release/*.apk

      - name: Upload release mapping
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: project-lumen-release-mapping
          path: app/build/outputs/mapping/**
          retention-days: 14

      - name: Prepare release assets
        run: |
          mkdir -p release-assets
          VERSION="${{ env.PROJECT_LUMEN_VERSION_NAME }}-${{ env.PROJECT_LUMEN_SHORT_HASH }}"
          APK_DIR="app/build/outputs/apk/release"
          AGGREGATED_APK="$(find "$APK_DIR" -maxdepth 1 -type f \( -name "app-universal-release.apk" -o -name "app-release.apk" -o -name "app-release-unsigned.apk" \) | head -n 1)"

          if [ -z "$AGGREGATED_APK" ]; then
            echo "Aggregated release APK was not found."
            ls -lh "$APK_DIR"
            exit 1
          fi

          cp "$AGGREGATED_APK" "release-assets/Project-Lumen_android_${VERSION}.apk"

          for variant in armeabi-v7a arm64-v8a x86 x86_64; do
            VARIANT_APK="$(find "$APK_DIR" -maxdepth 1 -type f -name "app-${variant}-release.apk" | head -n 1)"
            if [ -n "$VARIANT_APK" ]; then
              cp "$VARIANT_APK" "release-assets/Project-Lumen_android_${VERSION}_${variant}.apk"
            fi
          done

          (
            cd release-assets
            sha256sum *.apk > checksums.txt
          )

          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
            TAG_NAME="${GITHUB_REF_NAME}"
          else
            TAG_NAME="v${VERSION}"
          fi
          RELEASE_BASE_URL="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG_NAME}"
          python3 - "$VERSION" "${{ env.PROJECT_LUMEN_VERSION_CODE }}" "$TAG_NAME" "$RELEASE_BASE_URL" "${GITHUB_REPOSITORY}" <<'PY'
          import json
          import pathlib
          import sys

          version_name, version_code, tag_name, release_base_url, repository = sys.argv[1:6]
          asset_dir = pathlib.Path("release-assets")
          checksums = {}
          for line in (asset_dir / "checksums.txt").read_text(encoding="utf-8").splitlines():
              parts = line.split()
              if len(parts) >= 2:
                  checksums[pathlib.Path(parts[-1]).name] = parts[0].lower()

          def abi_for(name):
              for abi in ("armeabi-v7a", "arm64-v8a", "x86", "x86_64"):
                  if name.endswith(f"_{abi}.apk"):
                      return abi
              return "universal"

          assets = []
          for apk in sorted(asset_dir.glob("*.apk")):
              name = apk.name
              assets.append({
                  "abi": abi_for(name),
                  "name": name,
                  "url": f"{release_base_url}/{name}",
                  "sha256": checksums[name],
                  "sizeBytes": apk.stat().st_size,
                  "contentType": "application/vnd.android.package-archive",
              })

          primary = next((asset for asset in assets if asset["abi"] == "universal"), assets[0])
          manifest = {
              "schemaVersion": 1,
              "versionCode": int(version_code),
              "versionName": version_name,
              "tagName": tag_name,
              "channel": "stable",
              "rollout": "100%",
              "forceUpdate": False,
              "releaseUrl": f"https://github.com/{repository}/releases/tag/{tag_name}",
              "sha256": primary["sha256"],
              "fullApkUrl": primary["url"],
              "fullApkSha256": primary["sha256"],
              "fullApkSizeBytes": primary["sizeBytes"],
              "assets": assets,
              "patches": [],
          }
          (asset_dir / "release-manifest.json").write_text(
              json.dumps(manifest, ensure_ascii=False, indent=2) + "\n",
              encoding="utf-8",
          )
          PY

      - name: Upload release artifact
        uses: actions/upload-artifact@v4
        with:
          name: project-lumen-release-apk
          path: release-assets/*
          retention-days: 30

      - name: Create GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          draft: false
          prerelease: ${{ contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') || contains(github.ref_name, 'rc') }}
          generate_release_notes: true
          files: release-assets/*

      - name: Sync release manifest to admin API
        if: success() && startsWith(github.ref, 'refs/tags/')
        env:
          PROJECT_LUMEN_API_BASE_URL: ${{ secrets.PROJECT_LUMEN_API_BASE_URL }}
          PROJECT_LUMEN_ADMIN_ACTIONS_URL: ${{ secrets.PROJECT_LUMEN_ADMIN_ACTIONS_URL }}
          PROJECT_LUMEN_ADMIN_TOKEN: ${{ secrets.PROJECT_LUMEN_ADMIN_TOKEN }}
        run: |
          set -euo pipefail
          if [ -z "$PROJECT_LUMEN_ADMIN_TOKEN" ]; then
            echo "Release sync skipped; PROJECT_LUMEN_ADMIN_TOKEN is not configured."
            exit 0
          fi
          if [ -z "$PROJECT_LUMEN_API_BASE_URL" ] && [ -z "$PROJECT_LUMEN_ADMIN_ACTIONS_URL" ]; then
            echo "Release sync skipped; PROJECT_LUMEN_API_BASE_URL or PROJECT_LUMEN_ADMIN_ACTIONS_URL is not configured."
            exit 0
          fi
          ADMIN_ACTIONS_URL="${PROJECT_LUMEN_ADMIN_ACTIONS_URL%/}"
          if [ -z "$ADMIN_ACTIONS_URL" ]; then
            API_BASE="${PROJECT_LUMEN_API_BASE_URL%/}"
            # The API base ends with /api/lumen, so admin actions are at ${API_BASE}/admin/actions
            ADMIN_ACTIONS_URL="${API_BASE}/admin/actions"
          fi
          python3 - <<'PY'
          import json
          import pathlib

          manifest_path = pathlib.Path("release-assets/release-manifest.json")
          manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
          payload = {"action": "force-update", "payload": manifest}
          pathlib.Path("release-assets/admin-release-action.json").write_text(
              json.dumps(payload, ensure_ascii=False, separators=(",", ":")),
              encoding="utf-8",
          )
          PY
          HTTP_CODE="$(curl -sS \
            -o /tmp/admin-release-action-response.json \
            -w '%{http_code}' \
            -H "Authorization: Bearer ${PROJECT_LUMEN_ADMIN_TOKEN}" \
            -H "Content-Type: application/json" \
            --data-binary @release-assets/admin-release-action.json \
            "$ADMIN_ACTIONS_URL" || true)"
          case "$HTTP_CODE" in
            2*)
              echo "Admin API release sync succeeded (HTTP $HTTP_CODE)."
              ;;
            *)
              echo "::warning::Admin API release sync failed (HTTP ${HTTP_CODE:-no-response}); the release manifest is still published as a GitHub release asset. Verify PROJECT_LUMEN_ADMIN_TOKEN / PROJECT_LUMEN_ADMIN_ACTIONS_URL."
              ;;
          esac