release.yml

name: Release

# Runs when a Release is published on GitHub (which creates/points at a tag).
# The tag name (e.g. "v1.4") is used to name the produced artifacts and is
# attached to the same GitHub Release as downloadable assets.
on:
  release:
    types: [published]

# Allow the workflow to upload assets onto the triggering Release.
permissions:
  contents: write

env:
  DOTNET_VERSION: '10.0.x'
  # win-x64 self-contained builds so the artifacts run without a preinstalled .NET runtime.
  WIN_RID: win-x64

jobs:
  release:
    # Windows is required: the MAUI WinUI target and the net10.0-windows
    # Service/Tray projects can only be built on Windows. Android builds here too.
    runs-on: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up .NET ${{ env.DOTNET_VERSION }}
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      # JDK 17 is required for signing/packaging the Android APK.
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      - name: Install MAUI workloads
        run: dotnet workload install maui-android maui-windows

      # Derives three values from the tag:
      #   tag      -> raw tag (e.g. v1.0.1), used for asset upload
      #   version  -> versionName / display version (1.0.1), used in file names
      #   code     -> Android versionCode, a strictly increasing integer
      #               computed as major*10000 + minor*100 + patch (1.0.1 -> 10001).
      #               Android refuses updates unless versionCode increases.
      - name: Resolve version from tag
        id: ver
        shell: pwsh
        run: |
          $tag = "${{ github.event.release.tag_name }}"
          $version = $tag -replace '^v', ''
          $parts = ($version -split '[.-]')
          $major = [int]($parts[0]); $minor = [int]($parts[1]); $patch = [int]($parts[2])
          $code = $major * 10000 + $minor * 100 + $patch
          "tag=$tag"         | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          "version=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          "code=$code"       | Out-File -FilePath $env:GITHUB_OUTPUT -Append

      # Decode the base64 keystore secret into a real file for signing.
      - name: Decode Android keystore
        id: keystore
        shell: pwsh
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: |
          $path = Join-Path $env:RUNNER_TEMP 'serverremote.keystore'
          [IO.File]::WriteAllBytes($path, [Convert]::FromBase64String($env:ANDROID_KEYSTORE_BASE64))
          "path=$path" | Out-File -FilePath $env:GITHUB_OUTPUT -Append

      # --- ServerRemote.App : Android (signed APK) ---
      # Signing properties are overridden on the command line so the four
      # GitHub secrets are used instead of the placeholder values in the .csproj.
      - name: Publish App (Android APK)
        shell: pwsh
        env:
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: >
          dotnet publish src/ServerRemote.App
          -f net10.0-android
          -c Release
          -t:Rebuild
          -p:ApplicationDisplayVersion=${{ steps.ver.outputs.version }}
          -p:ApplicationVersion=${{ steps.ver.outputs.code }}
          -p:AndroidKeyStore=true
          "-p:AndroidSigningKeyStore=${{ steps.keystore.outputs.path }}"
          "-p:AndroidSigningStorePass=$env:ANDROID_KEYSTORE_PASSWORD"
          "-p:AndroidSigningKeyAlias=$env:ANDROID_KEY_ALIAS"
          "-p:AndroidSigningKeyPass=$env:ANDROID_KEY_PASSWORD"
          -o publish/app-android

      - name: Collect signed APK
        shell: pwsh
        run: |
          $apk = Get-ChildItem publish/app-android -Filter '*-Signed.apk' -Recurse | Select-Object -First 1
          if (-not $apk) { throw 'No signed APK (*-Signed.apk) found.' }
          New-Item -ItemType Directory -Force -Path dist | Out-Null
          Copy-Item $apk.FullName "dist/ServerRemote.App-android-${{ steps.ver.outputs.version }}.apk"

      # --- ServerRemote.App : Windows (unpackaged, self-contained) ---
      # MAUI/WinUI must use RuntimeIdentifierOverride instead of -r; passing
      # -r win-x64 makes the build resolve a non-existent Mono runtime pack
      # (Microsoft.NETCore.App.Runtime.Mono.win-x64) and fail to restore.
      - name: Publish App (Windows)
        shell: pwsh
        run: >
          dotnet publish src/ServerRemote.App
          -f net10.0-windows10.0.19041.0
          -c Release
          -p:RuntimeIdentifierOverride=win10-x64
          --self-contained
          -p:WindowsPackageType=None
          -p:ApplicationDisplayVersion=${{ steps.ver.outputs.version }}
          -p:ApplicationVersion=${{ steps.ver.outputs.code }}
          -o publish/app-windows

      # --- ServerRemote.Service : Windows ---
      - name: Publish Service (Windows)
        shell: pwsh
        run: >
          dotnet publish src/ServerRemote.Service
          -c Release
          -r ${{ env.WIN_RID }}
          --self-contained
          -o publish/service

      # --- ServerRemote.Tray : Windows ---
      - name: Publish Tray (Windows)
        shell: pwsh
        run: >
          dotnet publish src/ServerRemote.Tray
          -c Release
          -r ${{ env.WIN_RID }}
          --self-contained
          -o publish/tray

      - name: Package Windows artifacts
        shell: pwsh
        run: |
          $v = "${{ steps.ver.outputs.version }}"
          New-Item -ItemType Directory -Force -Path dist | Out-Null
          Compress-Archive -Path publish/app-windows/* -DestinationPath "dist/ServerRemote.App-windows-$v.zip" -Force
          Compress-Archive -Path publish/service/*     -DestinationPath "dist/ServerRemote.Service-windows-$v.zip" -Force
          Compress-Archive -Path publish/tray/*        -DestinationPath "dist/ServerRemote.Tray-windows-$v.zip" -Force

      # Keep the builds available as workflow run artifacts...
      - name: Upload workflow artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ServerRemote-${{ steps.ver.outputs.version }}
          path: dist/*

      # ...and attach them to the GitHub Release that triggered the run.
      - name: Attach assets to Release
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release upload "${{ steps.ver.outputs.tag }}" (Get-ChildItem dist/*).FullName --clobber