android-play-internal.yml

name: Android Play Internal Deploy

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      release_notes:
        description: Optional Google Play release notes for en-US.
        required: false
        type: string

permissions:
  contents: read

jobs:
  deploy_internal:
    name: Build and upload internal testing draft
    runs-on: ubuntu-latest
    environment: staging
    env:
      ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
      ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
      REST_API_URL: ${{ vars.REST_API_URL }}

    steps:
      - name: Require main branch
        run: |
          if [ "$GITHUB_REF" != "refs/heads/main" ]; then
            echo "Android Play Internal Deploy must be run from main." >&2
            exit 1
          fi

      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - uses: subosito/flutter-action@v2
        with:
          flutter-version: "3.32.6"
          channel: stable
          cache: true

      - name: Set Android keystore path
        run: echo "ANDROID_KEYSTORE_PATH=$RUNNER_TEMP/ontime-upload.jks" >> "$GITHUB_ENV"

      - name: Install native test dependencies
        run: sudo apt-get update && sudo apt-get install -y sqlite3 libsqlite3-dev

      - name: Validate release configuration
        env:
          ANDROID_GOOGLE_SERVICES_JSON_B64: ${{ secrets.ANDROID_GOOGLE_SERVICES_JSON_B64 }}
          ANDROID_UPLOAD_KEYSTORE_B64: ${{ secrets.ANDROID_UPLOAD_KEYSTORE_B64 }}
          GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
        run: |
          missing=0
          for name in \
            ANDROID_GOOGLE_SERVICES_JSON_B64 \
            ANDROID_UPLOAD_KEYSTORE_B64 \
            ANDROID_KEYSTORE_PASSWORD \
            ANDROID_KEY_ALIAS \
            ANDROID_KEY_PASSWORD \
            GOOGLE_PLAY_SERVICE_ACCOUNT_JSON \
            REST_API_URL
          do
            if [ -z "${!name}" ]; then
              echo "$name is required for Android Play internal deploy." >&2
              missing=1
            fi
          done
          exit "$missing"

      - name: Decode Android Firebase config
        env:
          ANDROID_GOOGLE_SERVICES_JSON_B64: ${{ secrets.ANDROID_GOOGLE_SERVICES_JSON_B64 }}
        run: |
          mkdir -p android/app/src/release
          printf '%s' "$ANDROID_GOOGLE_SERVICES_JSON_B64" | base64 --decode > android/app/src/release/google-services.json
          test -s android/app/src/release/google-services.json

      - name: Decode Android upload keystore
        env:
          ANDROID_UPLOAD_KEYSTORE_B64: ${{ secrets.ANDROID_UPLOAD_KEYSTORE_B64 }}
        run: |
          printf '%s' "$ANDROID_UPLOAD_KEYSTORE_B64" | base64 --decode > "$ANDROID_KEYSTORE_PATH"
          chmod 600 "$ANDROID_KEYSTORE_PATH"
          test -s "$ANDROID_KEYSTORE_PATH"

      - name: Install Flutter packages
        run: flutter pub get

      - name: Run code generation
        run: dart run build_runner build --delete-conflicting-outputs

      - name: Verify generated files are current
        run: git diff --exit-code

      - name: Analyze
        run: flutter analyze

      - name: Test
        run: flutter test

      - name: Derive Android build name
        run: |
          app_version="$(sed -n 's/^version: *//p' pubspec.yaml | head -n 1)"
          build_name="${app_version%%+*}"
          if [ -z "$build_name" ]; then
            echo "Unable to derive Android build name from pubspec.yaml version." >&2
            exit 1
          fi
          echo "ANDROID_BUILD_NAME=$build_name" >> "$GITHUB_ENV"

      - name: Build Android app bundle
        run: |
          flutter build appbundle --release \
            --build-name="$ANDROID_BUILD_NAME" \
            --build-number="${{ github.run_number }}" \
            --dart-define=ENV=staging \
            --dart-define=REST_API_URL="$REST_API_URL"

      - name: Prepare Play release notes
        if: ${{ github.event_name == 'workflow_dispatch' && inputs.release_notes != '' }}
        env:
          RELEASE_NOTES: ${{ inputs.release_notes }}
        run: |
          mkdir -p distribution/whatsnew
          printf '%s\n' "$RELEASE_NOTES" > distribution/whatsnew/whatsnew-en-US

      - name: Upload signed app bundle artifact
        uses: actions/upload-artifact@v4
        with:
          name: ontime-android-release-aab
          path: build/app/outputs/bundle/release/app-release.aab
          if-no-files-found: error
          retention-days: 14

      - name: Upload internal testing draft with release notes
        if: ${{ github.event_name == 'workflow_dispatch' && inputs.release_notes != '' }}
        uses: r0adkll/upload-google-play@v1
        with:
          serviceAccountJsonPlainText: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
          packageName: club.devkor.ontime
          releaseFiles: build/app/outputs/bundle/release/app-release.aab
          tracks: internal
          status: draft
          whatsNewDirectory: distribution/whatsnew

      - name: Upload internal testing draft
        if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_notes == '' }}
        uses: r0adkll/upload-google-play@v1
        with:
          serviceAccountJsonPlainText: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
          packageName: club.devkor.ontime
          releaseFiles: build/app/outputs/bundle/release/app-release.aab
          tracks: internal
          status: draft