name: release

on:
  push:
    tags: ["v*"]

jobs:
  build:
    runs-on: ubuntu-22.04

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17

      - uses: android-actions/setup-android@v3

      - uses: nttld/setup-ndk@v1
        id: ndk
        with:
          ndk-version: r26d

      - name: System dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y jq libgtk-3-dev libwebkit2gtk-4.1-dev \
            libsoup-3.0-dev libayatana-appindicator3-dev librsvg2-dev

      - run: npm ci

      # Desktop: deb + rpm + AppImage (bundle.targets = "all")
      - name: Build Linux desktop
        run: npm run tauri build

      - name: Build Android APK
        env:
          NDK_HOME: ${{ steps.ndk.outputs.ndk-path }}
        run: |
          npm run tauri android init
          npm run tauri android build -- --apk

      # ponytail: sign the finished APK with apksigner instead of patching
      # gen/android/app/build.gradle.kts — keeps gen/ throwaway, no committed generated code.
      - name: Sign APK
        env:
          KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE }}
          KS_PASS: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
        run: |
          echo "$KEYSTORE_B64" | base64 -d > /tmp/ks.jks
          BT="$ANDROID_HOME/build-tools/$(ls "$ANDROID_HOME/build-tools" | sort -V | tail -1)"
          IN=src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release-unsigned.apk
          "$BT/zipalign" -p -f 4 "$IN" /tmp/aligned.apk
          "$BT/apksigner" sign --ks /tmp/ks.jks --ks-pass "env:KS_PASS" \
            --out "rustification-${GITHUB_REF_NAME}.apk" /tmp/aligned.apk

      - name: Publish release
        env:
          TOKEN: ${{ secrets.GITEA_TOKEN }}
          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
        run: |
          set -eu
          ID=$(curl -sSf -X POST "$API/releases" \
            -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"${GITHUB_REF_NAME}\",\"name\":\"${GITHUB_REF_NAME}\"}" | jq -r .id)
          for f in src-tauri/target/release/bundle/deb/*.deb \
                   src-tauri/target/release/bundle/rpm/*.rpm \
                   src-tauri/target/release/bundle/appimage/*.AppImage \
                   rustification-${GITHUB_REF_NAME}.apk; do
            [ -f "$f" ] || continue
            curl -sSf -X POST "$API/releases/$ID/assets?name=$(basename "$f")" \
              -H "Authorization: token $TOKEN" -F "attachment=@$f"
          done