draft-release-flutter.yml

name: draft release / flutter

on:
  workflow_call:
    inputs:
      slug:
        description: Asset slug name
        required: true
        type: string
      android_app_signing_key_alias:
        description: >
          Alias name of the app signing key inside the Android keystore.
        required: false
        type: string
        default: appsigning
      android_upload_key_alias:
        description: >
          Alias name of the upload key inside the Android keystore.
        required: false
        type: string
        default: upload
    secrets:
      ANDROID_APP_SIGNING_KEYSTORE_B64:
        description: >
          Base64-encoded Android app signing keystore (PKCS12 or JKS) used by
          Gradle to sign release APKs in CI.
        required: true
      ANDROID_APP_SIGNING_KEYSTORE_PASSWORD:
        description: >
          Password protecting the Android app signing keystore file.
        required: true
      ANDROID_APP_SIGNING_KEY_PASSWORD:
        description: >
          Password for the app signing key alias within the Android keystore.
        required: true
      ANDROID_UPLOAD_KEYSTORE_B64:
        description: >
          Base64-encoded Android upload keystore (PKCS12 or JKS) used by
          Gradle to sign release App Bundles in CI.
        required: true
      ANDROID_UPLOAD_KEYSTORE_PASSWORD:
        description: >
          Password protecting the Android upload keystore file.
        required: true
      ANDROID_UPLOAD_KEY_PASSWORD:
        description: >
          Password for the upload key alias within the Android keystore.
        required: true

permissions:
  contents: read

jobs:
  create_draft_release:
    name: create draft release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      upload_url: ${{ steps.gh_release.outputs.upload_url }}
      url: ${{ steps.gh_release.outputs.url }}
    steps:
      - name: Checkout source code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false

      - id: gh_release
        name: Create a new GitHub draft release
        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b
        if: github.ref_type == 'tag'
        with:
          draft: true
          generate_release_notes: true

      - name: Annotate workflow run with draft release URL
        env:
          INPUTS_SLUG: ${{ inputs.slug }}
          GH_RELEASE_URL: ${{ steps.gh_release.outputs.url }}
        run: 'echo "### :shipit: Opened draft release for: [${INPUTS_SLUG} ${GITHUB_REF_NAME}](${GH_RELEASE_URL})" >> "$GITHUB_STEP_SUMMARY"'

  build_release_assets:
    name: build release assets
    needs:
      - create_draft_release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout source code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false

      - name: Add Toolbox Envy to PATH
        uses: EarthmanMuons/toolbox-envy/.github/actions/add-to-path@main
        with:
          include_bins: |
            common
            flutter

      - name: Set up Flutter
        uses: subosito/flutter-action@fd55f4c5af5b953cc57a2be44cb082c8f6635e8e
        with:
          channel: stable
          flutter-version-file: pubspec.yaml
          cache: true

      - name: Install dependencies
        run: flutter pub get --enforce-lockfile

      - name: Configure Android signing (upload key)
        env:
          ANDROID_SIGNING_ROLE: upload
          ANDROID_SIGNING_FORCE_DECODE: 1
          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_UPLOAD_KEYSTORE_B64 }}
          ANDROID_KEYSTORE_FILENAME: upload-keystore.p12
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_UPLOAD_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ inputs.android_upload_key_alias }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_UPLOAD_KEY_PASSWORD }}
        run: android-signing-setup

      - name: Build release App Bundle
        run: flutter build appbundle

      - name: Configure Android signing (app signing key)
        env:
          ANDROID_SIGNING_ROLE: appsigning
          ANDROID_SIGNING_FORCE_DECODE: 1
          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_APP_SIGNING_KEYSTORE_B64 }}
          ANDROID_KEYSTORE_FILENAME: app-signing-keystore.p12
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_APP_SIGNING_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ inputs.android_app_signing_key_alias }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_APP_SIGNING_KEY_PASSWORD }}
        run: android-signing-setup

      - name: Build release APK
        run: flutter build apk

      - name: Stage assets + checksums
        env:
          INPUTS_SLUG: ${{ inputs.slug }}
        run: stage-release-assets --slug "${INPUTS_SLUG}"

      - name: Upload staged dist/ as workflow artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
        with:
          name: release-dist
          path: dist/**
          if-no-files-found: error
          retention-days: 7

  upload_release_assets:
    name: upload release assets
    needs:
      - create_draft_release
      - build_release_assets
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout source code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false

      - name: Download staged dist/ artifact
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
        with:
          name: release-dist
          path: dist

      - name: Upload release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DRAFT_RELEASE_UPLOAD_URL: ${{ needs.create_draft_release.outputs.upload_url }}
        run: |
          set -euo pipefail
          echo "Uploading assets to: ${DRAFT_RELEASE_UPLOAD_URL}"
          ls -la dist/
          gh release upload "$GITHUB_REF_NAME" dist/* --clobber
          echo ":arrow_up: Uploaded release assets" >>"$GITHUB_STEP_SUMMARY"