questshock/.gitea/workflows/build.yml

name: build

# Builds versioned Linux and Windows release packages (see `make
# package`, which builds both - a .tar.gz and a .zip) on every push/PR,
# plus on-demand via the Gitea "Run workflow" button. Runs
# inside the build-image (see ../../build-image/Dockerfile, built/pushed
# via ../../build-image.sh and ../../upload-image.sh), which bundles
# every dependency engine/ needs to compile (for both platforms,
# including the Windows cross-toolchain) - no network access needed at
# job runtime. Since the job's container already *is* the build-image
# (QUESTSHOCK_BUILD_IMAGE=1), `make package`'s `engine`/`engine-win`
# prerequisites compile directly instead of trying to docker-run it
# again, which wouldn't work here (no nested docker).
on:
  push:
  pull_request:
  workflow_dispatch:

jobs:
  build:
    # Runner defaults `run:` steps to `sh`, which doesn't understand
    # `set -o pipefail` used below - force bash explicitly.
    defaults:
      run:
        shell: bash
    # Must match a label your act_runner is registered with.
    runs-on: ubuntu-latest

    container:
      image: cr.ladkau.de/questshock/builder:latest
      credentials:
        username: ${{ secrets.REGISTRY_USER }}
        password: ${{ secrets.REGISTRY_PASSWORD }}

    steps:
      - uses: actions/checkout@v4
        with:
          # `make package`'s version comes from `git describe --tags` -
          # needs full history/tags, not actions/checkout's default
          # shallow single-commit clone.
          fetch-depth: 0

      - name: Preflight
        run: |
          set -euo pipefail
          command -v cc >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: no C compiler (cc) in PATH" >&2; exit 1; }
          command -v cmake >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: cmake not in PATH" >&2; exit 1; }
          [ -n "${QUESTSHOCK_BUILD_IMAGE:-}" ] || { echo "PREFLIGHT FAIL: QUESTSHOCK_BUILD_IMAGE not set - not running inside the questshock build-image?" >&2; exit 1; }
          [ -d /opt/prebuilt/built_sdl ] || { echo "PREFLIGHT FAIL: /opt/prebuilt/built_sdl missing" >&2; exit 1; }
          # gl4es itself is no longer prebuilt here (compiled from source at
          # APK-build time instead - see build-image/Dockerfile's gl4es
          # comment) - openxr was added to this image in the same
          # Android/Quest layer, so it's an equally good marker of that.
          [ -d /opt/prebuilt/android/openxr ] || { echo "PREFLIGHT FAIL: /opt/prebuilt/android/openxr missing - runner is using a build-image older than the Android/Quest layer" >&2; exit 1; }
          [ -d /opt/prebuilt/win/sdl2 ] || { echo "PREFLIGHT FAIL: /opt/prebuilt/win/sdl2 missing - runner is using a build-image older than the Windows cross-build layer" >&2; exit 1; }
          command -v x86_64-w64-mingw32-gcc >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: x86_64-w64-mingw32-gcc not in PATH" >&2; exit 1; }
          command -v zip >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: zip not in PATH (needed by make package-win)" >&2; exit 1; }

      - name: Build package
        run: make package

      - name: Upload build artifacts
        # v4 uses the newer @actions/artifact backend, which this Gitea
        # instance's artifact storage doesn't support (GHESNotSupportedError) - v3 works.
        uses: actions/upload-artifact@v3
        with:
          name: shockolate
          path: |
            dist/shockolate-*-linux-*.tar.gz
            dist/shockolate-*-windows-*.zip

      # The release key is stored base64-encoded in ANDROID_KEYSTORE_BASE64
      # (see README section 4.3). Without it the APK is a debug build.
      - name: Prepare release signing
        env:
          KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: |
          set -euo pipefail
          if [ -z "$KEYSTORE_BASE64" ]; then
            echo "No signing key: the APK will be a debug build"
            exit 0
          fi
          echo "$KEYSTORE_BASE64" | base64 -d > "${RUNNER_TEMP:-/tmp}/questshock-release.jks"
          echo "QUESTSHOCK_KEYSTORE=${RUNNER_TEMP:-/tmp}/questshock-release.jks" >> "$GITHUB_ENV"

      - name: Build Quest APK
        env:
          QUESTSHOCK_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          QUESTSHOCK_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          QUESTSHOCK_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        # QUESTSHOCK_BUILD_IMAGE is already set (see Preflight above), so
        # this runs build-apk.sh directly instead of trying to docker-run
        # the image again - same reasoning as `make package` above.
        # Unlike the fully offline engine/package build, this needs
        # network access for Gradle/AGP's own dependency resolution - a
        # scoped, accepted exception (see build-image/Dockerfile).
        run: make apk

      - name: Upload APK artifact
        uses: actions/upload-artifact@v3
        with:
          name: questshock-quest-apk
          path: dist/questshock-*-android-*.apk

      - name: Publish to dl.ladkau.de
        # Uploads the tarball, zip, and APK over SFTP instead of using
        # actions/upload-artifact (whose zip wrapping can't be disabled).
        # Only runs on push so PR builds don't publish.
        if: gitea.event_name == 'push'
        run: |
          set -euo pipefail
          TARBALL="$(ls dist/shockolate-*-linux-*.tar.gz)"
          ZIP="$(ls dist/shockolate-*-windows-*.zip)"
          APK="$(ls dist/questshock-*-android-*.apk)"
          mkdir -p ~/.ssh
          echo "${{ secrets.DL_SFTP_KEY }}" > ~/.ssh/dl_sftp_key
          chmod 600 ~/.ssh/dl_sftp_key
          sftp -i ~/.ssh/dl_sftp_key -P 2223 \
            -o StrictHostKeyChecking=accept-new \
            uploader@dl.ladkau.de <<EOF
          -mkdir files/questshock
          put $TARBALL files/questshock/$(basename "$TARBALL")
          put $ZIP files/questshock/$(basename "$ZIP")
          put $APK files/questshock/$(basename "$APK")
          EOF