name: Release

on:
  push:
    tags:
      - "*.*.*"

permissions:
  contents: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Set up Android SDK
        uses: android-actions/setup-android@v4
        with:
          packages: "platform-tools platforms;android-35 build-tools;35.0.0"

      # Optional — only produces a properly release-signed APK if these repo secrets are set:
      # KEYSTORE_BASE64 (base64 of a release .jks), KEYSTORE_PASSWORD, KEY_ALIAS, KEY_PASSWORD.
      # Without them, the build falls back to debug signing (still installable, just not
      # signed with a dedicated release key).
      - name: Set up release signing
        env:
          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: |
          if [ -n "$KEYSTORE_BASE64" ]; then
            echo "$KEYSTORE_BASE64" | base64 -d > release.jks
            cat > keystore.properties <<EOF
          storeFile=release.jks
          storePassword=$KEYSTORE_PASSWORD
          keyAlias=$KEY_ALIAS
          keyPassword=$KEY_PASSWORD
          EOF
          else
            echo "No KEYSTORE_BASE64 secret set — release APK will be debug-signed."
          fi

      - name: Build release APK
        run: ./gradlew assembleRelease

      - name: Package artifact
        run: |
          mkdir -p dist
          cp app/build/outputs/apk/release/app-release.apk "dist/veil-${GITHUB_REF_NAME}.apk"

      - name: Publish GitHub release
        uses: softprops/action-gh-release@v2
        with:
          files: dist/*.apk