release.yml

name: release

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      version:
        description: 'Existing tag to rebuild, for example v0.2.0'
        required: true

permissions:
  contents: write

# One release per tag. A re-run replaces the assets and the notes of the same
# release, so two runs for one tag must not overlap.
concurrency:
  group: release-${{ github.event.inputs.version || github.ref_name }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    # The Android project is one workspace of a monorepo; every run step
    # below is relative to it. `uses:` steps are not affected and still take
    # workspace-relative paths.
    defaults:
      run:
        working-directory: android
    steps:
      - uses: actions/checkout@v4
        with:
          # The changelog walks the full history between two tags.
          fetch-depth: 0

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'
          cache: gradle

      # gradle.properties pins the JDK to a path on the author's machine
      # because the system default there is 26, which Gradle 9.3 will not run
      # on. The runner has its own JDK, so the pin has to go.
      - name: Unpin the local JDK
        run: sed -i '/^org\.gradle\.java\.home=/d' gradle.properties

      - name: Install SDK packages
        run: |
          SDKMANAGER="$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager"
          yes | "$SDKMANAGER" --licenses > /dev/null 2>&1 || true
          "$SDKMANAGER" "platforms;android-36" "build-tools;36.0.0" > /dev/null

      # The dispatch input is untrusted text, so it enters the shell through
      # the environment, never through inline expansion.
      - name: Resolve version
        id: v
        env:
          DISPATCH_VERSION: ${{ github.event.inputs.version }}
        run: |
          TAG="${DISPATCH_VERSION:-$GITHUB_REF_NAME}"
          if ! printf '%s' "$TAG" | grep -Eq '^v[0-9][0-9A-Za-z._-]*$'; then
            echo "::error::Tag [$TAG] is not a release tag such as v1.2.3."
            exit 1
          fi
          NAME="${TAG#v}"
          case "$NAME" in
            *-*) PRERELEASE=true ;;
            *)   PRERELEASE=false ;;
          esac
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "name=$NAME" >> "$GITHUB_OUTPUT"
          echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"

      # A tag push always has its tag. A manual run rebuilds a tag that already
      # exists, so refuse to invent a version from a branch.
      - name: Check tag exists
        env:
          TAG: ${{ steps.v.outputs.tag }}
        run: |
          if ! git ls-remote --exit-code --tags origin "refs/tags/$TAG" > /dev/null; then
            echo "::error::Tag $TAG does not exist on origin. Push the tag first."
            exit 1
          fi
          if ! git rev-parse -q --verify "refs/tags/$TAG" > /dev/null; then
            git fetch origin "refs/tags/$TAG:refs/tags/$TAG"
          fi

      - name: Restore keystore
        env:
          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
        run: |
          if [ -z "$KEYSTORE_BASE64" ]; then
            echo "::error::KEYSTORE_BASE64 is not set. A release signed with the" \
                 "debug key cannot be installed over a previous release."
            exit 1
          fi
          printf '%s' "$KEYSTORE_BASE64" | base64 -d > kleeamp-release.jks

      - run: chmod +x gradlew

      - name: Build signed release
        env:
          KEYSTORE_FILE: kleeamp-release.jks
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
          KLEEAMP_VERSION: ${{ steps.v.outputs.name }}
          # monotonic, so every release installs over the last one
          KLEEAMP_VERSION_CODE: ${{ github.run_number }}
        run: ./gradlew :app:assembleRelease --no-daemon --stacktrace

      # A debug-signed APK is the failure this whole pipeline exists to avoid,
      # so refuse to publish one rather than discovering it on someone's phone.
      - name: Verify signature
        id: sig
        run: |
          APKSIGNER=$(ls "$ANDROID_HOME"/build-tools/*/apksigner | sort -V | tail -1)
          APK=app/build/outputs/apk/release/app-release.apk
          "$APKSIGNER" verify --print-certs "$APK" > certs.txt
          cat certs.txt
          if grep -qi "CN=Android Debug" certs.txt; then
            echo "::error::APK is debug signed; refusing to publish."
            exit 1
          fi
          FP=$(grep -m1 "SHA-256 digest" certs.txt | awk '{print $NF}')
          echo "fingerprint=$FP" >> "$GITHUB_OUTPUT"

      - name: Stage artifact
        id: art
        env:
          NAME: ${{ steps.v.outputs.name }}
        run: |
          OUT="kleeamp-$NAME.apk"
          cp app/build/outputs/apk/release/app-release.apk "$OUT"
          sha256sum "$OUT" > checksums.txt
          echo "apk=$OUT" >> "$GITHUB_OUTPUT"
          echo "sha256=$(cut -d' ' -f1 checksums.txt)" >> "$GITHUB_OUTPUT"

      # The commit walk of the desktop release: every commit between the
      # previous tag and this one, resolved to a GitHub account when the
      # commit email belongs to one. Merge commits are skipped because the
      # branch commits already carry the change and the author.
      - name: Generate release notes
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          TAG: ${{ steps.v.outputs.tag }}
          NAME: ${{ steps.v.outputs.name }}
          SHA: ${{ steps.art.outputs.sha256 }}
          FINGERPRINT: ${{ steps.sig.outputs.fingerprint }}
        run: |
          set -euo pipefail

          if [[ "$TAG" == *-* ]]; then
            PREV_TAG=$(git describe --tags --abbrev=0 "${TAG}^" 2>/dev/null || echo "")
          else
            # A stable release covers the full beta-tested change set, so skip
            # prerelease tags when it looks for the previous stable tag.
            PREV_TAG=""
            while IFS= read -r candidate; do
              case "$candidate" in
                v*-*) ;;
                v*) PREV_TAG="$candidate"; break ;;
              esac
            done < <(git tag --merged "${TAG}^" --sort=-version:refname)
          fi

          if [ -n "$PREV_TAG" ]; then
            RANGE="${PREV_TAG}..${TAG}"
          else
            RANGE="$TAG"
          fi

          # Highlights for humans come from the annotated tag body, so each
          # release carries its own user-facing summary above the full commit
          # list. Lightweight tags have no message and keep commits only.
          # The checkout may hold the tag's commit without the tag object,
          # so fetch the tag itself before asking for its type and message.
          HIGHLIGHTS=""
          git fetch origin "+refs/tags/$TAG:refs/tags/$TAG" 2>/dev/null || true
          if git cat-file -t "$TAG" 2>/dev/null | grep -qx tag; then
            HIGHLIGHTS=$(git for-each-ref "refs/tags/$TAG" --format='%(contents:body)' | sed '/^-----BEGIN PGP SIGNATURE-----$/,/^-----END PGP SIGNATURE-----$/d')
          fi

          CHANGELOG=""
          CONTRIBUTORS=""
          declare -A SEEN
          while IFS=$'\x1f' read -r hash title author || [ -n "$hash" ]; do
            [ -n "$hash" ] || continue
            short="${hash:0:7}"
            # .author is null when the commit email is not linked to an
            # account; then the git name stands alone.
            username=$(gh api "repos/${REPO}/commits/${hash}" --jq '.author.login // empty' 2>/dev/null || echo "")
            if [ -n "$username" ]; then
              who="$author ([@$username](https://github.com/$username))"
            else
              who="$author"
            fi
            key="${username:-$author}"
            if [ -z "${SEEN[$key]:-}" ]; then
              SEEN[$key]=1
              CONTRIBUTORS="${CONTRIBUTORS}- $who"$'\n'
            fi
            CHANGELOG="${CHANGELOG}- $title by $who ([\`$short\`](https://github.com/${REPO}/commit/$hash))"$'\n'
          done < <(git log "$RANGE" --no-merges --pretty=format:"%H%x1f%s%x1f%an")

          if [ -z "$CHANGELOG" ]; then
            CHANGELOG="No commits between ${PREV_TAG:-the first commit} and ${TAG}."$'\n'
          fi

          {
            echo "## Contributors"
            echo ""
            printf '%s' "$CONTRIBUTORS"
            echo ""
            echo "## What's Changed"
            echo ""
            if [ -n "$HIGHLIGHTS" ]; then
              printf '%s\n\n' "$HIGHLIGHTS"
            fi
            printf '%s' "$CHANGELOG"
            echo ""
            echo "## Android APK"
            echo ""
            echo "| | |"
            echo "| --- | --- |"
            echo "| Version | \`${NAME}\` (code ${GITHUB_RUN_NUMBER}) |"
            echo "| Min Android | 8.0 (API 26) |"
            echo "| SHA-256 | \`${SHA}\` |"
            echo "| Signing key | \`${FINGERPRINT}\` |"
            echo ""
            echo "The signing key does not change between releases, so this APK"
            echo "installs over the previous one. Sideload it, or run"
            echo "\`adb install -r kleeamp-${NAME}.apk\`."
            if [ -n "$PREV_TAG" ]; then
              echo ""
              echo "**Full Changelog**: https://github.com/${REPO}/compare/${PREV_TAG}...${TAG}"
            fi
          } > notes.md

          cat notes.md

      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.v.outputs.tag }}
          NAME: ${{ steps.v.outputs.name }}
          PRERELEASE: ${{ steps.v.outputs.prerelease }}
          APK: ${{ steps.art.outputs.apk }}
        run: |
          set -euo pipefail
          TITLE="kleeamp $NAME"
          if gh release view "$TAG" > /dev/null 2>&1; then
            # A re-run of the same tag replaces the assets and the notes
            # instead of failing on an existing release.
            gh release edit "$TAG" --title "$TITLE" --notes-file notes.md --prerelease="$PRERELEASE"
            gh release upload "$TAG" "$APK" checksums.txt --clobber
          else
            CREATE_ARGS=()
            if [ "$PRERELEASE" = "true" ]; then CREATE_ARGS+=(--prerelease); fi
            gh release create "$TAG" "$APK" checksums.txt \
              --verify-tag \
              --title "$TITLE" \
              --notes-file notes.md \
              "${CREATE_ARGS[@]}"
          fi