name: Android production candidate

on:
  workflow_dispatch:
    inputs:
      version_name:
        description: Public release version, for example 1.2.3
        required: true
        type: string

permissions:
  contents: read

jobs:
  build:
    name: Signed Android APK and AAB
    runs-on: ubuntu-24.04
    # Same environment, key, and version sequence as prerelease APKs.
    environment: android-release
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
        with:
          distribution: temurin
          java-version: "21"
      - name: Restore shared app signing key
        env:
          FLECTAR_ANDROID_KEYSTORE_BASE64: ${{ secrets.FLECTAR_ANDROID_KEYSTORE_BASE64 }}
          FLECTAR_ANDROID_KEYSTORE_PASSWORD: ${{ secrets.FLECTAR_ANDROID_KEYSTORE_PASSWORD }}
          FLECTAR_ANDROID_KEY_ALIAS: ${{ secrets.FLECTAR_ANDROID_KEY_ALIAS }}
          FLECTAR_ANDROID_KEY_PASSWORD: ${{ secrets.FLECTAR_ANDROID_KEY_PASSWORD }}
        run: bash scripts/restore-android-keystore.sh

      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: stable
          targets: aarch64-linux-android
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          workspaces: platform/android -> ../../target
          key: android-production-arm64
          # Every pull request can restore caches saved on main. Caches saved by
          # pull requests or tags only serve those, and they push main's out of
          # the 10 GB cache limit.
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4

      - name: Configure Android NDK compiler
        run: |
          toolchain="$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin"
          test -x "$toolchain/aarch64-linux-android26-clang"
          {
            echo "CC_aarch64_linux_android=$toolchain/aarch64-linux-android26-clang"
            echo "CXX_aarch64_linux_android=$toolchain/aarch64-linux-android26-clang++"
            echo "AR_aarch64_linux_android=$toolchain/llvm-ar"
            echo "CARGO_TARGET_AARCH64_LINUX_ANDROID_LINKER=$toolchain/aarch64-linux-android26-clang"
          } >> "$GITHUB_ENV"

      - name: Build and validate production candidate
        env:
          FLECTAR_ANDROID_VERSION_NAME: ${{ inputs.version_name }}
          FLECTAR_GOOGLE_ANDROID_CLIENT_ID: ${{ secrets.FLECTAR_GOOGLE_ANDROID_CLIENT_ID }}
          FLECTAR_MICROSOFT_ANDROID_CLIENT_ID: ${{ secrets.FLECTAR_MICROSOFT_ANDROID_CLIENT_ID }}
          FLECTAR_MICROSOFT_ANDROID_REDIRECT_URI: ${{ secrets.FLECTAR_MICROSOFT_ANDROID_REDIRECT_URI }}
          FLECTAR_ANDROID_KEYSTORE_PASSWORD: ${{ secrets.FLECTAR_ANDROID_KEYSTORE_PASSWORD }}
          FLECTAR_ANDROID_KEY_ALIAS: ${{ secrets.FLECTAR_ANDROID_KEY_ALIAS }}
          FLECTAR_ANDROID_KEY_PASSWORD: ${{ secrets.FLECTAR_ANDROID_KEY_PASSWORD }}
        run: ./scripts/build-android-release.sh

      - name: Record public signing identities
        run: |
          ./scripts/android-signing-identities.sh \
            target/android/release/flectar-mail.apk \
            > target/android/release/signing-identities.txt

      - name: Remove restored signing key
        if: always()
        run: |
          if [[ -n "${FLECTAR_ANDROID_KEYSTORE:-}" ]]; then rm -f "$FLECTAR_ANDROID_KEYSTORE"; fi

      - name: Enable Android emulator acceleration
        run: sudo chmod a+rw /dev/kvm

      - name: Exercise packaged JNI callbacks
        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2
        env:
          # The instrumentation APK uses the local debug key; production
          # credentials are only supplied to the production build step above.
          FLECTAR_ANDROID_KEYSTORE: ""
        with:
          # Google APIs ARM64 translation tests the release Rust library.
          api-level: 30
          target: google_apis
          arch: x86_64
          disable-animations: true
          script: ./platform/android/gradle/gradlew --no-daemon -p platform/android/gradle :app:connectedDebugAndroidTest

      - name: Upload JNI test results
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: android-production-jni-test-results
          path: |
            target/android/gradle/app/reports/androidTests/
            target/android/gradle/app/outputs/androidTest-results/

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: flectar-mail-android-production-${{ inputs.version_name }}
          path: |
            target/android/release/flectar-mail.apk
            target/android/release/flectar-mail.aab
            target/android/release/signing-identities.txt
          if-no-files-found: error
          retention-days: 30