name: Build Android

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - master
    paths:
      - 'lib/**'
      - 'android/**'
      - 'pubspec.yaml'
      - 'pubspec.lock'
      - 'native/**'
      - 'third_party/**'
      - 'scripts/verify_android_signing.sh'
      - '.github/workflows/build-android.yml'

jobs:
  build-android:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '17'
          cache: 'gradle'
      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: '3.44.3'
          channel: 'stable'
          cache: true

      - name: Setup Rust
        uses: ./.github/actions/setup-rust
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android

      - name: Get dependencies
        run: flutter pub get

      - name: Verify formatting
        run: dart format --output=none --set-exit-if-changed lib test

      - name: Flutter analyze
        run: flutter analyze --no-fatal-infos lib test

      - name: Install native plugin build dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libclang-dev

      - name: Prepare native plugin runtime for tests
        run: dart run tool/prepare_plugin_runtime.dart

      - name: Build E2EE test library
        uses: ./.github/actions/setup-e2ee

      - name: Build native crypto test library
        run: cargo build --locked --manifest-path native/qlyra_crypto/rust/Cargo.toml

      - name: Flutter tests
        run: flutter test

      - name: Configure Gradle
        run: |
          mkdir -p ~/.gradle
          echo "org.gradle.jvmargs=-Xmx4096m -XX:MaxMetaspaceSize=1024m" >> ~/.gradle/gradle.properties
          echo "kotlin.daemon.jvmargs=-Xmx1536m" >> ~/.gradle/gradle.properties
          echo "org.gradle.caching=true" >> ~/.gradle/gradle.properties
          echo "org.gradle.parallel=true" >> ~/.gradle/gradle.properties
          echo "org.gradle.configureondemand=true" >> ~/.gradle/gradle.properties

      - name: Setup release signing
        env:
          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
        run: |
          if [ -z "$KEYSTORE_BASE64" ]; then
            echo "Release signing secrets are required."
            exit 1
          fi
          echo "$KEYSTORE_BASE64" | base64 -d > android/app/qlyra-release.jks
          {
            echo "storePassword=$KEYSTORE_PASSWORD"
            echo "keyPassword=$KEY_PASSWORD"
            echo "keyAlias=$KEY_ALIAS"
            echo "storeFile=qlyra-release.jks"
          } > android/key.properties
          echo "Release signing configured."

      - name: Build Universal APK
        run: flutter build apk --release --flavor qlyra --obfuscate --split-debug-info=build/symbols

      - name: Build Split APKs
        run: flutter build apk --release --split-per-abi --flavor qlyra --obfuscate --split-debug-info=build/symbols

      - name: Verify APK release certificates
        env:
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
        run: bash scripts/verify_android_signing.sh

      - name: Upload Universal APK
        uses: actions/upload-artifact@v4
        with:
          name: qlyra-android-universal
          path: build/app/outputs/flutter-apk/app-qlyra-release.apk
          if-no-files-found: error
          retention-days: 30

      - name: Upload arm64-v8a APK
        uses: actions/upload-artifact@v4
        with:
          name: qlyra-android-arm64-v8a
          path: build/app/outputs/flutter-apk/app-arm64-v8a-qlyra-release.apk
          if-no-files-found: error
          retention-days: 30

      - name: Upload armeabi-v7a APK
        uses: actions/upload-artifact@v4
        with:
          name: qlyra-android-armeabi-v7a
          path: build/app/outputs/flutter-apk/app-armeabi-v7a-qlyra-release.apk
          if-no-files-found: error
          retention-days: 30

      - name: Upload x86_64 APK
        uses: actions/upload-artifact@v4
        with:
          name: qlyra-android-x86_64
          path: build/app/outputs/flutter-apk/app-x86_64-qlyra-release.apk
          if-no-files-found: error
          retention-days: 30

      - name: Build App Bundle
        run: flutter build appbundle --release --flavor qlyra --obfuscate --split-debug-info=build/symbols

      - name: Verify App Bundle release certificate
        env:
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
        run: bash scripts/verify_android_signing.sh

      - name: Upload App Bundle artifact
        uses: actions/upload-artifact@v4
        with:
          name: qlyra-android-aab
          path: build/app/outputs/bundle/qlyraRelease/app-qlyra-release.aab
          if-no-files-found: error
          retention-days: 30

      - name: Upload debug symbols
        uses: actions/upload-artifact@v4
        with:
          name: qlyra-android-symbols
          path: build/symbols
          if-no-files-found: error
          retention-days: 90