release.yml

name: Release APK

on:
  push:
    tags:
      - 'v*'

jobs:
  release:
    name: Build & Release APK
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Build Release APK
        run: ./gradlew assembleRelease

      - name: Decode Keystore
        env:
          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
        run: echo "$SIGNING_KEY" | base64 --decode > keystore.jks

      - name: Align and Sign APK
        env:
          KEY_STORE_PASSWORD: ${{ secrets.KEY_STORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: |
          APK_UNSIGNED=app/build/outputs/apk/release/app-release-unsigned.apk
          APK_ALIGNED=app/build/outputs/apk/release/app-release-aligned.apk
          APK_SIGNED=paperstack-${{ github.ref_name }}.apk

          $ANDROID_SDK_ROOT/build-tools/35.0.0/zipalign -v 4 "$APK_UNSIGNED" "$APK_ALIGNED"
          $ANDROID_SDK_ROOT/build-tools/35.0.0/apksigner sign \
            --ks keystore.jks \
            --ks-pass "pass:$KEY_STORE_PASSWORD" \
            --ks-key-alias "$KEY_ALIAS" \
            --key-pass "pass:$KEY_PASSWORD" \
            --out "$APK_SIGNED" \
            "$APK_ALIGNED"
          echo "APK_PATH=$APK_SIGNED" >> "$GITHUB_ENV"

      - name: Shred Keystore
        if: always()
        run: shred -u keystore.jks 2>/dev/null || rm -f keystore.jks

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: ${{ env.APK_PATH }}
          generate_release_notes: true
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}