release-android.yml

name: Release Android APK

on:
  push:
    branches: [main]
    paths-ignore:
      - '**/*.md'
      - 'docs/**'

concurrency:
  group: release-android-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
        with:
          node-version: 22
          cache: npm

      - name: Setup Java
        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v5
        with:
          distribution: temurin
          java-version: '21'

      - name: Install dependencies
        run: npm ci

      - name: Build web assets
        env:
          BUILD_TARGET: android
        run: npm run build

      - name: Ensure Android platform exists
        run: |
          if [ ! -d android ]; then
            npx cap add android
          fi

      - name: Generate branded Android app icons
        run: npx @capacitor/assets generate --android --assetPath assets

      - name: Sync Capacitor Android project
        run: |
          npx cap sync android
          npm run cap:copy-alarm-sounds

      - name: Set monotonically increasing Android versionCode
        env:
          VERSION_CODE: ${{ github.run_number }}
        run: |
          APP_GRADLE="android/app/build.gradle"
          if [ ! -f "$APP_GRADLE" ]; then
            echo "Expected $APP_GRADLE to exist after Capacitor sync."
            exit 1
          fi

          PKG_VERSION=$(node -p "require('./package.json').version")
          perl -0pi -e "s/versionCode\\s+\\d+/versionCode $VERSION_CODE/g; s/versionName\\s+\"[^\"]+\"/versionName \"$PKG_VERSION\"/g" "$APP_GRADLE"

          echo "Applied Android versionCode=$VERSION_CODE and versionName=$PKG_VERSION"
          grep -nE "versionCode|versionName" "$APP_GRADLE"

      - name: Decode release signing keystore
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: |
          if [ -z "$ANDROID_KEYSTORE_BASE64" ]; then
            echo "Missing required secret ANDROID_KEYSTORE_BASE64"
            exit 1
          fi

          echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > android/app/tasktrack-release.jks

      - name: Validate release signing secrets
        env:
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          for var in ANDROID_KEYSTORE_PASSWORD ANDROID_KEY_ALIAS ANDROID_KEY_PASSWORD; do
            if [ -z "${!var}" ]; then
              echo "Missing required secret $var"
              exit 1
            fi
          done

      - name: Build signed release APK
        working-directory: android
        env:
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
          ANDROID_KEYSTORE_PATH: ${{ github.workspace }}/android/app/tasktrack-release.jks
        run: |
          ./gradlew assembleRelease \
            -Pandroid.injected.signing.store.file="$ANDROID_KEYSTORE_PATH" \
            -Pandroid.injected.signing.store.password="$ANDROID_KEYSTORE_PASSWORD" \
            -Pandroid.injected.signing.key.alias="$ANDROID_KEY_ALIAS" \
            -Pandroid.injected.signing.key.password="$ANDROID_KEY_PASSWORD"

      - name: Rename APK artifact
        run: cp android/app/build/outputs/apk/release/app-release.apk android/app/build/outputs/apk/release/TaskTrack.apk

      - name: Prepare release metadata
        id: release_meta
        run: |
          VERSION=$(node -p "require('./package.json').version")
          TAG="v${VERSION}-build-${GITHUB_RUN_NUMBER}"
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "name=TaskTrack $TAG" >> "$GITHUB_OUTPUT"

      - name: Keep only latest 3 generated Android releases
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
        with:
          script: |
            const prefix = 'v';
            const buildMarker = '-build-';
            const releases = await github.paginate(github.rest.repos.listReleases, {
              owner: context.repo.owner,
              repo: context.repo.repo,
              per_page: 100,
            });

            const autoAndroidReleases = releases
              .filter((release) => release.tag_name?.startsWith(prefix) && release.tag_name.includes(buildMarker))
              .sort((a, b) => new Date(b.created_at) - new Date(a.created_at));

            const toDelete = autoAndroidReleases.slice(3);

            for (const release of toDelete) {
              core.info(`Deleting release ${release.tag_name} (#${release.id})`);
              await github.rest.repos.deleteRelease({
                owner: context.repo.owner,
                repo: context.repo.repo,
                release_id: release.id,
              });

              core.info(`Deleting tag ref tags/${release.tag_name}`);
              await github.rest.git.deleteRef({
                owner: context.repo.owner,
                repo: context.repo.repo,
                ref: `tags/${release.tag_name}`,
              });
            }

      - name: Create GitHub release and upload APK
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
        with:
          tag_name: ${{ steps.release_meta.outputs.tag }}
          name: ${{ steps.release_meta.outputs.name }}
          generate_release_notes: true
          files: android/app/build/outputs/apk/release/TaskTrack.apk