capacitor.yml

name: Capacitor

on:
  pull_request:
    paths:
      # Native shell only wraps the web app; web/server-only changes do not alter the APK.
      - ".github/workflows/capacitor.yml"
      - "android/**"
      - "ios/**"
      - "native_www/**"
      - "capacitor.config.json"
      - "scripts/prepare-native-web.mjs"
  push:
    branches:
      - main
    tags:
      - "v*.*.*"
    paths:
      # Tags still run because GitHub does not evaluate path filters for tag pushes.
      - ".github/workflows/capacitor.yml"
      - "android/**"
      - "ios/**"
      - "native_www/**"
      - "capacitor.config.json"
      - "scripts/prepare-native-web.mjs"
  workflow_dispatch:

# Read-only by default so PR-triggered runs never get a write-scoped token.
# Only the tag-gated release job below is granted contents: write.
permissions:
  contents: read

jobs:
  android:
    name: Build Android APK
    runs-on: ubuntu-latest

    env:
      MISE_ENABLE_TOOLS: android-sdk,aube,java,node

    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up mise tools
        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4
        with:
          install: true
          install_args: android-sdk aube java node
          cache: true
      - name: Install Android SDK packages
        run: mise run setup:android-sdk

      - name: Install JavaScript dependencies
        run: mise exec -- aube install --frozen-lockfile

      - name: Resolve app version
        shell: bash
        run: |
          base_version=$(node -e "const fs = require('fs'); const source = fs.readFileSync('mix.exs', 'utf8'); const match = source.match(/version:\\s*\"([0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][^\"]+)?)\"/); if (!match) process.exit(1); process.stdout.write(match[1]);")
          artifact_version="${base_version}-${GITHUB_SHA::7}"
          if [[ "${GITHUB_REF_TYPE}" == "tag" && "${GITHUB_REF_NAME}" == v* ]]; then
            base_version="${GITHUB_REF_NAME#v}"
            artifact_version="${base_version}"
          fi
          echo "MANAVAULT_VERSION=${base_version}" >> "$GITHUB_ENV"
          echo "MANAVAULT_RELEASE_REPOSITORY=${GITHUB_REPOSITORY}" >> "$GITHUB_ENV"
          echo "ARTIFACT_VERSION=${artifact_version}" >> "$GITHUB_ENV"

      - name: Restore Android release keystore
        if: github.ref_type == 'tag'
        shell: bash
        env:
          MANAVAULT_ANDROID_KEYSTORE_BASE64: ${{ secrets.MANAVAULT_ANDROID_KEYSTORE_BASE64 }}
        run: |
          if [[ -z "${MANAVAULT_ANDROID_KEYSTORE_BASE64}" ]]; then
            echo "Missing MANAVAULT_ANDROID_KEYSTORE_BASE64 secret. Run: mise exec -- aube run android:signing:setup" >&2
            exit 1
          fi

          mkdir -p android/release
          printf '%s' "${MANAVAULT_ANDROID_KEYSTORE_BASE64}" | base64 --decode > android/release/manavault-release.jks
          echo "MANAVAULT_ANDROID_KEYSTORE=${GITHUB_WORKSPACE}/android/release/manavault-release.jks" >> "$GITHUB_ENV"

      - name: Validate Android release keystore
        if: github.ref_type == 'tag'
        shell: bash
        env:
          MANAVAULT_ANDROID_KEYSTORE_PASSWORD: ${{ secrets.MANAVAULT_ANDROID_KEYSTORE_PASSWORD }}
          MANAVAULT_ANDROID_KEY_ALIAS: ${{ secrets.MANAVAULT_ANDROID_KEY_ALIAS }}
        run: |
          # -storepass:env reads the password from the env var by name, so the
          # secret never appears in the runner's process table (unlike -storepass).
          keytool -list \
            -keystore "${MANAVAULT_ANDROID_KEYSTORE}" \
            -alias "${MANAVAULT_ANDROID_KEY_ALIAS}" \
            -storepass:env MANAVAULT_ANDROID_KEYSTORE_PASSWORD \
            -v

      - name: Build release APK
        if: github.ref_type == 'tag'
        env:
          MANAVAULT_ANDROID_KEYSTORE_PASSWORD: ${{ secrets.MANAVAULT_ANDROID_KEYSTORE_PASSWORD }}
          MANAVAULT_ANDROID_KEY_ALIAS: ${{ secrets.MANAVAULT_ANDROID_KEY_ALIAS }}
          MANAVAULT_ANDROID_KEY_PASSWORD: ${{ secrets.MANAVAULT_ANDROID_KEYSTORE_PASSWORD }}
        run: mise exec -- aube run android:build:release

      - name: Build debug APK
        if: github.ref_type != 'tag'
        run: mise exec -- aube run android:build:debug

      - name: Stage APK
        shell: bash
        run: |
          mkdir -p dist/native
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            cp android/app/build/outputs/apk/release/app-release.apk "dist/native/manavault-${ARTIFACT_VERSION}-release.apk"
          else
            cp android/app/build/outputs/apk/debug/app-debug.apk "dist/native/manavault-${ARTIFACT_VERSION}-debug.apk"
          fi

      - name: Upload APK artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: manavault-${{ env.ARTIFACT_VERSION }}-${{ github.ref_type == 'tag' && 'release' || 'debug' }}-apk
          path: dist/native/*.apk
          if-no-files-found: error

  # Separate, tag-only job holds the contents: write token so PR/branch builds
  # (which only build and upload the artifact) run read-only.
  release:
    name: Attach APK to release
    needs: android
    if: github.ref_type == 'tag'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download APK artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: dist/native

      - name: Attach APK to GitHub release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
        with:
          generate_release_notes: true
          files: dist/native/**/*.apk