name: Build Android (Google Play)

on:
  workflow_dispatch:

jobs:
  build-android:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '17'
          cache: 'gradle'
      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: '3.44.3'
          channel: 'stable'
          cache: true

      - name: Setup Rust
        uses: ./.github/actions/setup-rust
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android

      - name: Get dependencies
        run: flutter pub get

      - name: Verify formatting
        run: dart format --output=none --set-exit-if-changed lib test

      - name: Flutter analyze
        run: flutter analyze --no-fatal-infos lib test

      - name: Install native plugin build dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libclang-dev

      - name: Prepare native plugin runtime for tests
        run: dart run tool/prepare_plugin_runtime.dart

      - name: Build E2EE test library
        uses: ./.github/actions/setup-e2ee

      - name: Build native crypto test library
        run: cargo build --locked --manifest-path native/qlyra_crypto/rust/Cargo.toml

      - name: Flutter tests
        run: flutter test

      - name: Configure Gradle
        run: |
          mkdir -p ~/.gradle
          echo "org.gradle.jvmargs=-Xmx4096m -XX:MaxMetaspaceSize=1024m" >> ~/.gradle/gradle.properties
          echo "kotlin.daemon.jvmargs=-Xmx1536m" >> ~/.gradle/gradle.properties
          echo "org.gradle.caching=true" >> ~/.gradle/gradle.properties
          echo "org.gradle.parallel=true" >> ~/.gradle/gradle.properties
          echo "org.gradle.configureondemand=true" >> ~/.gradle/gradle.properties

      - name: Setup release signing
        env:
          KEYSTORE_BASE64: ${{ secrets.PLAY_KEYSTORE_BASE64 || secrets.KEYSTORE_BASE64 }}
          KEYSTORE_PASSWORD: ${{ secrets.PLAY_KEYSTORE_PASSWORD || secrets.KEYSTORE_PASSWORD }}
          KEY_PASSWORD: ${{ secrets.PLAY_KEY_PASSWORD || secrets.KEY_PASSWORD }}
          KEY_ALIAS: ${{ secrets.PLAY_KEY_ALIAS || secrets.KEY_ALIAS }}
        run: |
          if [ -z "$KEYSTORE_BASE64" ]; then
            echo "Release signing secrets are required."
            exit 1
          fi
          echo "$KEYSTORE_BASE64" | base64 -d > android/app/qlyra-release.jks
          {
            echo "storePassword=$KEYSTORE_PASSWORD"
            echo "keyPassword=$KEY_PASSWORD"
            echo "keyAlias=$KEY_ALIAS"
            echo "storeFile=qlyra-release.jks"
          } > android/key.properties
          echo "Release signing configured."

      - name: Build Universal APK
        run: flutter build apk --release --flavor store --obfuscate --split-debug-info=build/symbols

      - name: Verify store manifest
        shell: bash
        run: |
          set -euo pipefail
          manifest=$(find build/app/intermediates -path '*storeRelease*' -path '*merged_manifests*' -name AndroidManifest.xml -print -quit)
          test -n "$manifest"
          if grep -Eq 'REQUEST_INSTALL_PACKAGES|android:host="(www\.)?max\.ru"|firebaseinitprovider' "$manifest"; then
            echo '::error::Store manifest contains forbidden entries'
            exit 1
          fi

      - name: Build Split APKs
        run: flutter build apk --release --split-per-abi --flavor store --obfuscate --split-debug-info=build/symbols

      - name: Verify APK release certificates
        env:
          KEYSTORE_PASSWORD: ${{ secrets.PLAY_KEYSTORE_PASSWORD || secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.PLAY_KEY_ALIAS || secrets.KEY_ALIAS }}
        run: bash scripts/verify_android_signing.sh

      - name: Upload Universal APK
        uses: actions/upload-artifact@v4
        with:
          name: qlyra-play-universal
          path: build/app/outputs/flutter-apk/app-store-release.apk
          if-no-files-found: error
          retention-days: 30

      - name: Upload arm64-v8a APK
        uses: actions/upload-artifact@v4
        with:
          name: qlyra-play-arm64-v8a
          path: build/app/outputs/flutter-apk/app-arm64-v8a-store-release.apk
          if-no-files-found: error
          retention-days: 30

      - name: Upload armeabi-v7a APK
        uses: actions/upload-artifact@v4
        with:
          name: qlyra-play-armeabi-v7a
          path: build/app/outputs/flutter-apk/app-armeabi-v7a-store-release.apk
          if-no-files-found: error
          retention-days: 30

      - name: Upload x86_64 APK
        uses: actions/upload-artifact@v4
        with:
          name: qlyra-play-x86_64
          path: build/app/outputs/flutter-apk/app-x86_64-store-release.apk
          if-no-files-found: error
          retention-days: 30

      - name: Build App Bundle
        run: flutter build appbundle --release --flavor store --obfuscate --split-debug-info=build/symbols

      - name: Verify App Bundle release certificate
        env:
          KEYSTORE_PASSWORD: ${{ secrets.PLAY_KEYSTORE_PASSWORD || secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.PLAY_KEY_ALIAS || secrets.KEY_ALIAS }}
        run: bash scripts/verify_android_signing.sh

      - name: Upload App Bundle artifact
        uses: actions/upload-artifact@v4
        with:
          name: qlyra-play-aab
          path: build/app/outputs/bundle/storeRelease/app-store-release.aab
          if-no-files-found: error
          retention-days: 30

      - name: Upload debug symbols
        uses: actions/upload-artifact@v4
        with:
          name: qlyra-play-symbols
          path: build/symbols
          if-no-files-found: error
          retention-days: 90