name: Build Android APK

on:
  push:
    branches:
      - main
    paths:
      - 'apps/web/**'
      - 'apps/tauri/**'
      - 'packages/shared/**'
      - '.github/workflows/android.yml'
  pull_request:
    paths:
      - 'apps/web/**'
      - 'apps/tauri/**'
      - 'packages/shared/**'
      - '.github/workflows/android.yml'
  workflow_dispatch:

env:
  VITE_API_BASE_URL: ${{ vars.VITE_API_BASE_URL || 'https://zeavisedu.asepharyana.tech' }}

jobs:
  build-apk:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: Setup Java 21
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3
        with:
          packages: 'platforms;android-36 build-tools;36.0.0 ndk;28.0.13004108'

      - name: Setup Rust with Android targets
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: >-
            aarch64-linux-android,
            armv7-linux-androideabi,
            i686-linux-android,
            x86_64-linux-android

      - name: Cache Cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            apps/tauri/target
          key: ${{ runner.os }}-cargo-android-${{ hashFiles('apps/tauri/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-android-

      - name: Install Tauri CLI
        run: cd apps/tauri && bun install

      - name: Init Tauri Android project
        working-directory: apps/tauri
        env:
          JAVA_HOME: ${{ env.JAVA_HOME_21_X64 }}
          ANDROID_HOME: ${{ env.ANDROID_SDK_ROOT }}
          NDK_HOME: ${{ env.ANDROID_NDK_HOME }}
        run: bun tauri android init

      - name: Build Tauri Android APK
        working-directory: apps/tauri
        env:
          JAVA_HOME: ${{ env.JAVA_HOME_21_X64 }}
          ANDROID_HOME: ${{ env.ANDROID_SDK_ROOT }}
          NDK_HOME: ${{ env.ANDROID_NDK_HOME }}
        run: bun tauri android build

      - name: Decode keystore
        if: github.event_name != 'pull_request'
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: |
          echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > apps/tauri/zeavis.keystore

      - name: Sign APK
        if: github.event_name != 'pull_request'
        env:
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          APK_UNSIGNED=$(find apps/tauri/gen/android/app/build/outputs/apk -name '*.apk' ! -name '*-signed*' | head -1)
          APK_SIGNED="${APK_UNSIGNED%.apk}-signed.apk"
          $ANDROID_SDK_ROOT/build-tools/36.0.0/apksigner sign \
            --ks apps/tauri/zeavis.keystore \
            --ks-pass "pass:${ANDROID_KEYSTORE_PASSWORD}" \
            --ks-key-alias "${ANDROID_KEY_ALIAS}" \
            --key-pass "pass:${ANDROID_KEY_PASSWORD}" \
            --out "$APK_SIGNED" \
            "$APK_UNSIGNED"
          echo "Signed APK: $APK_SIGNED"
          ls -lh "$APK_SIGNED"

      - name: Upload APK artifact
        uses: actions/upload-artifact@v4
        with:
          name: zeavis-edu-android
          path: |
            apps/tauri/gen/android/app/build/outputs/apk/**/*.apk
            apps/tauri/gen/android/app/build/outputs/bundle/**/*.aab
          retention-days: 30