name: build

# Builds the Android app (android/) debug APK on every push/PR, plus
# on-demand via the Gitea "Run workflow" button. Runs inside build-image
# (see ../../build-image/Dockerfile, built/pushed via ../../build-image.sh
# and ../../upload-image.sh), which bundles the JDK, Android SDK, and
# Node.js (needed by the JS-based actions below - see
# build-image/Dockerfile's own comment) so the runner itself doesn't need
# any of that installed. The Gradle build still needs network access at
# job runtime (Gradle/AGP/androidx dependency resolution).
on:
  push:
  pull_request:
  workflow_dispatch:

jobs:
  build:
    # Runner defaults `run:` steps to `sh`, which doesn't understand
    # `set -o pipefail` used below - force bash explicitly.
    defaults:
      run:
        shell: bash
    # Must match a label your act_runner is registered with.
    runs-on: ubuntu-latest

    container:
      image: cr.ladkau.de/fuelish/android-builder:latest
      credentials:
        username: ${{ secrets.REGISTRY_USER }}
        password: ${{ secrets.REGISTRY_PASSWORD }}

    steps:
      - uses: actions/checkout@v4
        with:
          # `make android`'s version comes from `git describe --tags` -
          # needs full history/tags, not actions/checkout's default
          # shallow single-commit clone.
          fetch-depth: 0

      - name: Preflight
        run: |
          set -euo pipefail
          command -v java >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: java not in PATH" >&2; exit 1; }
          command -v make >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: make not in PATH" >&2; exit 1; }
          [ -n "${ANDROID_HOME:-}" ] || { echo "PREFLIGHT FAIL: ANDROID_HOME not set" >&2; exit 1; }

      - name: Build
        run: make android

      - name: Upload build artifact
        # v4 uses the newer @actions/artifact backend, which this Gitea
        # instance's artifact storage doesn't support (GHESNotSupportedError) — v3 works.
        uses: actions/upload-artifact@v3
        with:
          name: fuelish-android
          path: dist/fuelish-*.apk

      - name: Publish to dl.ladkau.de
        # Uploads the APK over SFTP instead of using actions/upload-artifact
        # (whose zip wrapping can't be disabled). Runs on push and on a
        # manual "Run workflow" dispatch (the on-demand way to publish an
        # update without pushing a commit) - excludes pull_request so PR
        # builds from unreviewed branches don't publish.
        if: gitea.event_name == 'push' || gitea.event_name == 'workflow_dispatch'
        run: |
          set -euo pipefail
          APK="$(ls dist/fuelish-*.apk)"
          mkdir -p ~/.ssh
          printf '%s\n' '${{ secrets.DL_SFTP_KEY }}' > ~/.ssh/dl_sftp_key
          chmod 600 ~/.ssh/dl_sftp_key
          # Sanity-check the key is actually loadable before attempting the
          # SFTP connection - fails fast with a clear message instead of
          # SFTP's much less obvious "Permission denied" when the key
          # material itself is malformed (e.g. mangled by how the secret
          # was entered into Gitea - see DL_SFTP_KEY in README.md).
          ssh-keygen -y -f ~/.ssh/dl_sftp_key > /dev/null \
              || { echo "FAIL: ~/.ssh/dl_sftp_key is not a valid private key - re-check the DL_SFTP_KEY secret" >&2; exit 1; }
          sftp -i ~/.ssh/dl_sftp_key -P 2223 \
            -o StrictHostKeyChecking=accept-new \
            uploader@dl.ladkau.de <<EOF
          -mkdir files/fuelish
          put $APK files/fuelish/$(basename "$APK")
          EOF