mobile-release.yml

name: mobile-release

# Triggered by `mobile-vX.Y.Z` tags. Builds signed Android artifacts
# and an iOS archive ready for TestFlight upload.
#
# Required GitHub secrets (configure under Settings → Secrets and variables → Actions):
#
#   Android:
#     ANDROID_KEYSTORE_BASE64        – base64 of the upload keystore (.jks)
#     ANDROID_KEYSTORE_PASSWORD
#     ANDROID_KEY_ALIAS
#     ANDROID_KEY_PASSWORD
#     PLAY_SERVICE_ACCOUNT_JSON      – (optional, Phase 1.1) Play Console service-account
#                                      JSON for automated internal-track uploads
#
#   iOS / TestFlight:
#     IOS_DIST_CERT_P12_BASE64       – base64 of the .p12 distribution cert
#     IOS_DIST_CERT_PASSWORD
#     IOS_PROVISIONING_PROFILE_BASE64 – base64 of the App Store provisioning profile
#     APP_STORE_CONNECT_API_KEY_ID
#     APP_STORE_CONNECT_API_ISSUER_ID
#     APP_STORE_CONNECT_API_KEY_BASE64 – base64 of the .p8 API key
#
# Until the secrets are populated, the jobs short-circuit with a
# helpful message instead of failing the workflow.

on:
  push:
    tags:
      - 'mobile-v*'
  workflow_dispatch:

defaults:
  run:
    working-directory: mobile

permissions:
  contents: write

jobs:
  android:
    name: Android signed release (AAB + APK)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'
      - uses: gradle/actions/setup-gradle@v4

      - name: Verify signing secrets
        id: check
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: |
          if [ -z "${ANDROID_KEYSTORE_BASE64}" ]; then
            echo "missing=true" >> "$GITHUB_OUTPUT"
            echo "::warning::ANDROID_KEYSTORE_BASE64 secret not set; producing unsigned APK only."
          else
            echo "missing=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Build signed AAB + APK
        if: steps.check.outputs.missing == 'false'
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          ./gradlew :androidApp:bundleRelease :androidApp:assembleRelease \
            -Dorg.gradle.java.home=$JAVA_HOME --stacktrace

      - name: Build unsigned release APK (no signing secrets)
        if: steps.check.outputs.missing == 'true'
        run: ./gradlew :androidApp:assembleRelease -Dorg.gradle.java.home=$JAVA_HOME --stacktrace

      - name: Upload AAB
        if: steps.check.outputs.missing == 'false'
        uses: actions/upload-artifact@v4
        with:
          name: androidApp-release-aab
          path: mobile/androidApp/build/outputs/bundle/release/*.aab

      - name: Upload APK
        uses: actions/upload-artifact@v4
        with:
          name: androidApp-release-apk
          path: mobile/androidApp/build/outputs/apk/release/*.apk

      - name: Attach artifacts to GitHub Release
        if: startsWith(github.ref, 'refs/tags/mobile-v')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            mobile/androidApp/build/outputs/bundle/release/*.aab
            mobile/androidApp/build/outputs/apk/release/*.apk
          fail_on_unmatched_files: false
          generate_release_notes: true

  ios:
    name: iOS archive (TestFlight-ready)
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'
      - uses: gradle/actions/setup-gradle@v4

      - name: Install XcodeGen
        run: brew install xcodegen

      - name: Generate Xcode project
        working-directory: mobile/iosApp
        run: xcodegen generate

      - name: Assemble shared XCFramework (release)
        run: ./gradlew :shared:assembleSharedReleaseXCFramework -Dorg.gradle.java.home=$JAVA_HOME --stacktrace

      - name: Verify iOS signing secrets
        id: check
        env:
          IOS_DIST_CERT_P12_BASE64: ${{ secrets.IOS_DIST_CERT_P12_BASE64 }}
          IOS_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_PROVISIONING_PROFILE_BASE64 }}
          APP_STORE_CONNECT_API_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_KEY_BASE64 }}
        run: |
          if [ -z "${IOS_DIST_CERT_P12_BASE64}" ] || [ -z "${IOS_PROVISIONING_PROFILE_BASE64}" ]; then
            echo "missing=true" >> "$GITHUB_OUTPUT"
            echo "::warning::iOS distribution cert / profile not configured; building unsigned archive only."
          else
            echo "missing=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Import signing assets
        if: steps.check.outputs.missing == 'false'
        env:
          IOS_DIST_CERT_P12_BASE64: ${{ secrets.IOS_DIST_CERT_P12_BASE64 }}
          IOS_DIST_CERT_PASSWORD: ${{ secrets.IOS_DIST_CERT_PASSWORD }}
          IOS_PROVISIONING_PROFILE_BASE64: ${{ secrets.IOS_PROVISIONING_PROFILE_BASE64 }}
        run: |
          KEYCHAIN_PATH="$RUNNER_TEMP/build.keychain"
          KEYCHAIN_PASSWORD="$(openssl rand -hex 32)"
          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
          security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

          echo "$IOS_DIST_CERT_P12_BASE64" | base64 --decode > "$RUNNER_TEMP/dist.p12"
          security import "$RUNNER_TEMP/dist.p12" \
            -P "$IOS_DIST_CERT_PASSWORD" \
            -A -t cert -f pkcs12 \
            -k "$KEYCHAIN_PATH"
          security list-keychain -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | tr -d '"')

          mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"
          echo "$IOS_PROVISIONING_PROFILE_BASE64" | base64 --decode \
            > "$HOME/Library/MobileDevice/Provisioning Profiles/myfaq.mobileprovision"

      - name: Archive (signed)
        if: steps.check.outputs.missing == 'false'
        working-directory: mobile/iosApp
        run: |
          xcodebuild \
            -project iosApp.xcodeproj \
            -scheme iosApp \
            -configuration Release \
            -destination 'generic/platform=iOS' \
            -archivePath "$RUNNER_TEMP/iosApp.xcarchive" \
            -allowProvisioningUpdates \
            archive

      - name: Export IPA
        if: steps.check.outputs.missing == 'false'
        working-directory: mobile/iosApp
        run: |
          cat > "$RUNNER_TEMP/exportOptions.plist" <<'PLIST'
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
            <key>method</key><string>app-store</string>
            <key>signingStyle</key><string>automatic</string>
            <key>uploadBitcode</key><false/>
            <key>uploadSymbols</key><true/>
          </dict>
          </plist>
          PLIST
          xcodebuild -exportArchive \
            -archivePath "$RUNNER_TEMP/iosApp.xcarchive" \
            -exportOptionsPlist "$RUNNER_TEMP/exportOptions.plist" \
            -exportPath "$RUNNER_TEMP/export"

      - name: Upload to TestFlight
        if: steps.check.outputs.missing == 'false'
        env:
          APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
          APP_STORE_CONNECT_API_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_ISSUER_ID }}
          APP_STORE_CONNECT_API_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_KEY_BASE64 }}
        run: |
          mkdir -p "$HOME/.appstoreconnect/private_keys"
          KEY_PATH="$HOME/.appstoreconnect/private_keys/AuthKey_${APP_STORE_CONNECT_API_KEY_ID}.p8"
          echo "$APP_STORE_CONNECT_API_KEY_BASE64" | base64 --decode > "$KEY_PATH"
          IPA="$(ls "$RUNNER_TEMP/export"/*.ipa | head -1)"
          xcrun altool --upload-app -f "$IPA" -t ios \
            --apiKey "$APP_STORE_CONNECT_API_KEY_ID" \
            --apiIssuer "$APP_STORE_CONNECT_API_ISSUER_ID"

      - name: Build unsigned archive (no signing secrets)
        if: steps.check.outputs.missing == 'true'
        working-directory: mobile/iosApp
        run: |
          xcodebuild \
            -project iosApp.xcodeproj \
            -scheme iosApp \
            -configuration Release \
            -destination 'generic/platform=iOS Simulator' \
            -skipPackagePluginValidation \
            CODE_SIGNING_ALLOWED=NO \
            build