release-apk.yml

name: Build & Publish APK

# Restricted to version tags. Signing + upload secrets live in the protected
# "release" GitHub Environment, whose deployment policy only allows v* tags —
# so a push to a branch can never access the signing key or upload token.
on:
  push:
    tags: ['v*']

permissions:
  contents: write   # create GitHub Releases and upload assets
  packages: write   # publish ghcr container images

jobs:
  build:
    runs-on: ubuntu-latest
    environment: release
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'

      - name: Set up Android SDK
        uses: android-actions/setup-android@v3

      - name: Set up Go (for gomobile / wglib.aar)
        uses: actions/setup-go@v5
        with:
          go-version-file: wgmodule/go.mod
          cache-dependency-path: wgmodule/go.sum

      - name: Install Android NDK r25c
        run: sdkmanager "ndk;25.2.9519653"

      - name: Build wglib.aar
        run: |
          go install golang.org/x/mobile/cmd/gomobile@latest
          ANDROID_NDK_HOME="$ANDROID_HOME/ndk/25.2.9519653" gomobile init
          mkdir -p android/app/libs
          cd wgmodule
          ANDROID_NDK_HOME="$ANDROID_HOME/ndk/25.2.9519653" \
            gomobile bind -target android -androidapi 26 \
            -o ../android/app/libs/wglib.aar .

      - name: Decode signing keystore
        run: echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > android/release.keystore

      - name: Determine version
        id: ver
        run: echo "version=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"

      - name: Build release APK
        working-directory: android
        env:
          KEYSTORE_FILE: release.keystore
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: ./gradlew assembleRelease --no-daemon

      - name: Stage named APK
        run: cp android/app/build/outputs/apk/release/app-release.apk "ipv6diag-${{ steps.ver.outputs.version }}.apk"

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: ipv6diag-${{ steps.ver.outputs.version }}.apk
          generate_release_notes: true

      - name: Upload APK to portal
        continue-on-error: true
        run: |
          curl -fsSL --retry 3 -X POST \
            -H "Authorization: Bearer ${{ secrets.APK_UPLOAD_TOKEN }}" \
            -H "X-App-Version: ${{ steps.ver.outputs.version }}" \
            -H "Content-Type: application/vnd.android.package-archive" \
            --data-binary @android/app/build/outputs/apk/release/app-release.apk \
            https://ipv6-diag.r.selvakn.in/upload-apk

  publish-container:
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract container metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository_owner }}/androidipv6diag-server
          tags: |
            type=ref,event=tag
            type=raw,value=latest

      - name: Build and push server container
        uses: docker/build-push-action@v6
        with:
          context: ./server
          file: ./server/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}