release.yml

# name of the workflow
name: Android CI Tag Deployment - Release

on:
  push:
    tags:
      - 'v*.*.*'
      - '!v*.*.*-**'

jobs:
  build:

    runs-on: ubuntu-latest

    env:
      SIGNING_KEY_ALIAS: ${{ secrets.SIGNING_KEY_ALIAS }}
      SIGNING_KEY_PASSWORD: ${{ secrets.SIGNING_KEY_PASSWORD }}
      SIGNING_STORE_PASSWORD: ${{ secrets.SIGNING_STORE_PASSWORD }}
      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
      KEY_STORE_FILE: 'android_keystore.jks'
      KEY_STORE_LOCATION: ${{ github.workspace }}/app/keystore/

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '17'
          cache: gradle
      - name: Grant execute permission for gradlew
        run: chmod +x gradlew
      # Native build dependencies
      - name: Setup Go
        uses: actions/setup-go@v5
      - name: Add rust stable toolchain
        uses: dtolnay/rust-toolchain@stable
      - name: Add all targets
        run: |
          rustup target add \
            aarch64-linux-android \
            armv7-linux-androideabi \
            x86_64-linux-android \
            i686-linux-android
      - name: Setup Android SDK
        uses: nttld/setup-ndk@v1
        with:
          ndk-version: r25c
      - name: Add cargo-ndk
        run: |
          cargo install cargo-ndk
      - name: Install Protoc
        uses: arduino/setup-protoc@v3
      # Here we need to decode keystore.jks from base64 string and place it
      # in the folder specified in the release signing configuration
      - name: Decode Keystore
        id: decode_keystore
        uses: timheuer/base64-to-file@v1.2
        with:
          fileName: ${{ env.KEY_STORE_FILE }}
          fileDir: ${{ env.KEY_STORE_LOCATION }}
          encodedString: ${{ secrets.KEYSTORE }}

      # create keystore path for gradle to read
      - name: Create keystore path env var
        run: |
          store_path=${{ env.KEY_STORE_LOCATION }}${{ env.KEY_STORE_FILE }}
          echo "KEY_STORE_PATH=$store_path" >> $GITHUB_ENV

      - name: Create service_account.json
        id: createServiceAccount
        run: echo '${{ secrets.SERVICE_ACCOUNT_JSON }}' > service_account.json

      # Build and sign APK ("-x test" argument is used to skip tests)
      - name: Build Release APK
        run: ./gradlew :app:assembleRelease -x test --stacktrace
        env:
          ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}

      # get release apk path
      # general or fdroid
      - name: Get universal apk path
        id: universal-path
        run: echo "path=$(find . -regex '^.*/build/outputs/apk/fdroid/release/.*\universal.apk$' -type f | head -1)" >> $GITHUB_OUTPUT

      - name: Get armeabi-v7a apk path
        id: armv7-path
        run: echo "path=$(find . -regex '^.*/build/outputs/apk/fdroid/release/.*\armeabi-v7a.apk$' -type f | head -1)" >> $GITHUB_OUTPUT

      - name: Get arm-v8a apk path
        id: armv8-path
        run: echo "path=$(find . -regex '^.*/build/outputs/apk/fdroid/release/.*\arm64-v8a.apk$' -type f | head -1)" >> $GITHUB_OUTPUT

      - name: Get version code
        run: |
          version_code=$(grep "VERSION_CODE" buildSrc/src/main/kotlin/Constants.kt | awk '{print $5}' | tr -d '\n')
          echo "VERSION_CODE=$version_code" >> $GITHUB_ENV
      # Save the APK after the Build job is complete to publish it as a Github release in the next job
      - name: Upload universal APK
        uses: actions/upload-artifact@v4.3.1
        with:
          name: nymvpn-universal
          path: ${{ steps.universal-path.outputs.path }}

      - name: Upload armv7 APK
        uses: actions/upload-artifact@v4.3.1
        with:
          name: nymvpn-armv7
          path: ${{ steps.armv7-path.outputs.path }}

      - name: Upload armv8 APK
        uses: actions/upload-artifact@v4.3.1
        with:
          name: nymvpn-armv8
          path: ${{ steps.armv8-path.outputs.path }}

      - name: Create Release with Fastlane changelog notes
        id: create_release
        uses: softprops/action-gh-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          body_path: ${{ github.workspace }}/fastlane/metadata/android/en-US/changelogs/${{ env.VERSION_CODE }}.txt
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          draft: false
          make_latest: true
          prerelease: false
          files: |
            ${{ github.workspace }}/${{ steps.universal-path.outputs.path }}
            ${{ github.workspace }}/${{ steps.armv8-path.outputs.path }}
            ${{ github.workspace }}/${{ steps.armv7-path.outputs.path }}

      - name: Install apksigner
        run: |
          sudo apt-get update
          sudo apt-get install -y apksigner

      - name: Get checksum
        id: checksum
        run: echo "checksum=$(apksigner verify -print-certs ${{ steps.armv8-path.outputs.path }} | grep -Po "(?<=SHA-256 digest:) .*" | tr -d "[:blank:]")" >> $GITHUB_OUTPUT

      - name: Append checksum
        id: append_checksum
        uses: softprops/action-gh-release@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          body: |
            SHA256 fingerprint:
            ```${{ steps.checksum.outputs.checksum }}```
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          draft: false
          prerelease: false
          append_body: true

      - name: Deploy with fastlane
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.2' # Not needed with a .ruby-version file
          bundler-cache: true
          # deploy to google internal track
      - name: Distribute app to Alpha track 🚀
        run: (cd ${{ github.workspace }} && bundle install && bundle exec fastlane alpha)