name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

env:
  NIX_CONFIG: experimental-features = nix-command flakes

jobs:
  release:
    runs-on: ubuntu-26.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v7
      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
      - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
        with:
          primary-key: nix-v2-${{ hashFiles('flake.lock', '**/*.nix') }}
          restore-prefixes-first-match: nix-v2-
          gc-max-store-size-linux: 6G
      - name: Decode signing material
        id: signing
        env:
          KEYSTORE_BASE64: ${{ secrets.SUBTRACKS_KEYSTORE_BASE64 }}
          KEYPROPERTIES_BASE64: ${{ secrets.SUBTRACKS_KEYPROPERTIES_BASE64 }}
        run: |
          echo "$KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.keystore"
          alias=$(printf '%s' "$KEYPROPERTIES_BASE64" | base64 -d | sed -n 's/^keyAlias=//p' | tr -d '\r')
          test -n "$alias" || { echo "no keyAlias found in SUBTRACKS_KEYPROPERTIES_BASE64" >&2; exit 1; }
          echo "alias=$alias" >> "$GITHUB_OUTPUT"
      - name: Build APK and bundle
        env:
          RELEASE_KEYSTORE: ${{ runner.temp }}/release.keystore
          RELEASE_KEYSTORE_PASSWORD: ${{ secrets.SUBTRACKS_UPLOAD_STORE_PASSWORD }}
          RELEASE_KEY_ALIAS: ${{ steps.signing.outputs.alias }}
          RELEASE_KEY_PASSWORD: ${{ secrets.SUBTRACKS_UPLOAD_KEY_PASSWORD }}
        run: nix develop --command gradle :app:assembleRelease :app:bundleRelease --no-daemon
      - name: Read version code
        id: version
        run: echo "code=$(grep -oP 'versionCode = \K\d+' app/build.gradle.kts)" >> "$GITHUB_OUTPUT"
      - name: Upload to Google Play
        env:
          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
        run: |
          nix develop .#release --command fastlane supply \
            --aab app/build/outputs/bundle/release/app-release.aab \
            --package_name com.subtracks \
            --track "${{ vars.PLAY_TRACK || 'internal' }}" \
            --release_status completed \
            --json_key_data "$PLAY_SERVICE_ACCOUNT_JSON" \
            --metadata_path metadata \
            --mapping app/build/outputs/mapping/release/mapping.txt
      - name: Collect release APK
        run: cp app/build/outputs/apk/release/app-release.apk subtracks.apk
      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "$GITHUB_REF_NAME" subtracks.apk \
            --verify-tag \
            --title "$GITHUB_REF_NAME" \
            --notes-file "metadata/en-US/changelogs/${{ steps.version.outputs.code }}.txt"