draft-release-flutter.yml

name: draft release / flutter

# See docs/flutter.md for required `signing` environment variables and secrets.
on:
  workflow_call:
    inputs:
      slug:
        description: Asset slug name
        required: true
        type: string
      build_android_aab:
        description: Build Android App Bundle (AAB) release artifact
        required: false
        type: boolean
        default: true
      build_ios_ipa:
        description: Build iOS IPA release artifact
        required: false
        type: boolean
        default: true
      android_app_signing_key_alias:
        description: >
          Alias name of the app signing key inside the Android keystore.
        required: false
        type: string
        default: appsigning
      android_upload_key_alias:
        description: >
          Alias name of the upload key inside the Android keystore.
        required: false
        type: string
        default: upload
    secrets:
      ANDROID_APP_SIGNING_KEYSTORE_B64:
        description: >
          Base64-encoded Android app signing keystore (PKCS12 or JKS) used by
          Gradle to sign release APKs in CI.
        required: true
      ANDROID_APP_SIGNING_KEYSTORE_PASSWORD:
        description: >
          Password protecting the Android app signing keystore file.
        required: true
      ANDROID_APP_SIGNING_KEY_PASSWORD:
        description: >
          Password for the app signing key alias within the Android keystore.
        required: true
      ANDROID_UPLOAD_KEYSTORE_B64:
        description: >
          Base64-encoded Android upload keystore (PKCS12 or JKS) used by
          Gradle to sign release App Bundles in CI.
        required: false
      ANDROID_UPLOAD_KEYSTORE_PASSWORD:
        description: >
          Password protecting the Android upload keystore file.
        required: false
      ANDROID_UPLOAD_KEY_PASSWORD:
        description: >
          Password for the upload key alias within the Android keystore.
        required: false
      IOS_SIGNING_CERT_B64:
        description: >
          Base64-encoded iOS distribution signing certificate (P12) used for App Store builds.
        required: false
      IOS_SIGNING_CERT_PASSWORD:
        description: >
          Password protecting the iOS signing certificate.
        required: false
      IOS_PROVISIONING_PROFILE_B64:
        description: >
          Base64-encoded iOS provisioning profile for App Store builds.
        required: false

permissions:
  contents: read

jobs:
  create_draft_release:
    name: create draft release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      upload_url: ${{ steps.gh_release.outputs.upload_url }}
      url: ${{ steps.gh_release.outputs.url }}
    steps:
      - name: Checkout source code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          persist-credentials: false

      - id: gh_release
        name: Create a new GitHub draft release
        if: github.ref_type == 'tag'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "${GITHUB_REF_NAME}" \
            --draft \
            --generate-notes

      - name: Annotate workflow run with draft release URL
        env:
          INPUTS_SLUG: ${{ inputs.slug }}
          GH_RELEASE_URL: ${{ steps.gh_release.outputs.url }}
        run: 'echo "### :shipit: Opened draft release for: [${INPUTS_SLUG} ${GITHUB_REF_NAME}](${GH_RELEASE_URL})" >> "$GITHUB_STEP_SUMMARY"'

  build_android_release_assets:
    name: build android release assets
    needs:
      - create_draft_release
    runs-on: ubuntu-latest
    environment: signing
    steps:
      - name: Checkout source code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          persist-credentials: false

      - name: Add Toolbox Envy to PATH
        uses: EarthmanMuons/toolbox-envy/.github/actions/add-to-path@main
        with:
          include_bins: |
            common
            flutter

      - name: Set up Flutter
        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
        with:
          channel: stable
          flutter-version-file: pubspec.yaml
          cache: true

      - name: Install dependencies
        run: flutter pub get --enforce-lockfile

      - name: Validate Android upload key secrets
        if: ${{ inputs.build_android_aab }}
        env:
          ANDROID_UPLOAD_KEYSTORE_B64: ${{ secrets.ANDROID_UPLOAD_KEYSTORE_B64 }}
          ANDROID_UPLOAD_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_UPLOAD_KEYSTORE_PASSWORD }}
          ANDROID_UPLOAD_KEY_PASSWORD: ${{ secrets.ANDROID_UPLOAD_KEY_PASSWORD }}
        run: |
          set -euo pipefail

          if [[ -z "${ANDROID_UPLOAD_KEYSTORE_B64}" ]]; then
            echo "::error::Missing ANDROID_UPLOAD_KEYSTORE_B64 in the signing environment."
            exit 1
          fi
          if [[ -z "${ANDROID_UPLOAD_KEYSTORE_PASSWORD}" ]]; then
            echo "::error::Missing ANDROID_UPLOAD_KEYSTORE_PASSWORD in the signing environment."
            exit 1
          fi
          if [[ -z "${ANDROID_UPLOAD_KEY_PASSWORD}" ]]; then
            echo "::error::Missing ANDROID_UPLOAD_KEY_PASSWORD in the signing environment."
            exit 1
          fi

      - name: Configure Android signing (upload key)
        if: ${{ inputs.build_android_aab }}
        env:
          ANDROID_SIGNING_ROLE: upload
          ANDROID_SIGNING_FORCE_DECODE: 1
          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_UPLOAD_KEYSTORE_B64 }}
          ANDROID_KEYSTORE_FILENAME: upload-keystore.p12
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_UPLOAD_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ inputs.android_upload_key_alias }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_UPLOAD_KEY_PASSWORD }}
        run: android-signing-setup

      - name: Build release App Bundle
        if: ${{ inputs.build_android_aab }}
        run: flutter build appbundle

      - name: Validate Android app signing secrets
        env:
          ANDROID_APP_SIGNING_KEYSTORE_B64: ${{ secrets.ANDROID_APP_SIGNING_KEYSTORE_B64 }}
          ANDROID_APP_SIGNING_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_APP_SIGNING_KEYSTORE_PASSWORD }}
          ANDROID_APP_SIGNING_KEY_PASSWORD: ${{ secrets.ANDROID_APP_SIGNING_KEY_PASSWORD }}
        run: |
          set -euo pipefail

          if [[ -z "${ANDROID_APP_SIGNING_KEYSTORE_B64}" ]]; then
            echo "::error::Missing ANDROID_APP_SIGNING_KEYSTORE_B64 in the signing environment."
            exit 1
          fi
          if [[ -z "${ANDROID_APP_SIGNING_KEYSTORE_PASSWORD}" ]]; then
            echo "::error::Missing ANDROID_APP_SIGNING_KEYSTORE_PASSWORD in the signing environment."
            exit 1
          fi
          if [[ -z "${ANDROID_APP_SIGNING_KEY_PASSWORD}" ]]; then
            echo "::error::Missing ANDROID_APP_SIGNING_KEY_PASSWORD in the signing environment."
            exit 1
          fi

      - name: Configure Android signing (app signing key)
        env:
          ANDROID_SIGNING_ROLE: appsigning
          ANDROID_SIGNING_FORCE_DECODE: 1
          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_APP_SIGNING_KEYSTORE_B64 }}
          ANDROID_KEYSTORE_FILENAME: app-signing-keystore.p12
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_APP_SIGNING_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ inputs.android_app_signing_key_alias }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_APP_SIGNING_KEY_PASSWORD }}
        run: android-signing-setup

      - name: Build release APK
        run: flutter build apk

      - name: Stage assets
        env:
          INPUTS_SLUG: ${{ inputs.slug }}
        run: stage-release-assets --slug "${INPUTS_SLUG}"

      - name: Upload staged artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: release-dist-android
          path: dist/**
          if-no-files-found: error
          retention-days: 7

  build_ios_release_assets:
    name: build ios release assets
    needs:
      - create_draft_release
    if: ${{ inputs.build_ios_ipa }}
    runs-on: macos-26
    environment: signing
    steps:
      - name: Checkout source code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          persist-credentials: false

      - name: Add Toolbox Envy to PATH
        uses: EarthmanMuons/toolbox-envy/.github/actions/add-to-path@main
        with:
          include_bins: |
            common
            flutter

      - name: Set up Flutter
        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
        with:
          channel: stable
          flutter-version-file: pubspec.yaml
          cache: true

      - name: Install dependencies
        run: flutter pub get --enforce-lockfile

      - name: Validate iOS signing secrets
        env:
          IOS_SIGNING_CERT_B64: ${{ secrets.IOS_SIGNING_CERT_B64 }}
          IOS_SIGNING_CERT_PASSWORD: ${{ secrets.IOS_SIGNING_CERT_PASSWORD }}
          IOS_PROVISIONING_PROFILE_B64: ${{ secrets.IOS_PROVISIONING_PROFILE_B64 }}
        run: |
          set -euo pipefail

          if [[ -z "${IOS_SIGNING_CERT_B64}" ]]; then
            echo "::error::Missing IOS_SIGNING_CERT_B64 in the signing environment."
            exit 1
          fi
          if [[ -z "${IOS_SIGNING_CERT_PASSWORD}" ]]; then
            echo "::error::Missing IOS_SIGNING_CERT_PASSWORD in the signing environment."
            exit 1
          fi
          if [[ -z "${IOS_PROVISIONING_PROFILE_B64}" ]]; then
            echo "::error::Missing IOS_PROVISIONING_PROFILE_B64 in the signing environment."
            exit 1
          fi

      - id: generate_password
        name: Generate ephemeral password
        run: |
          pw="$(openssl rand -hex 24)"
          echo "::add-mask::$pw"
          echo "password=$pw" >>"$GITHUB_OUTPUT"

      - id: ios_signing
        name: Configure iOS signing
        env:
          IOS_SIGNING_CERT_B64: ${{ secrets.IOS_SIGNING_CERT_B64 }}
          IOS_SIGNING_CERT_PASSWORD: ${{ secrets.IOS_SIGNING_CERT_PASSWORD }}
          IOS_PROVISIONING_PROFILE_B64: ${{ secrets.IOS_PROVISIONING_PROFILE_B64 }}
          IOS_KEYCHAIN_PASSWORD: ${{ steps.generate_password.outputs.password }}
        run: ios-signing-setup

      - name: Build release IPA
        env:
          OTHER_CODE_SIGN_FLAGS: --keychain ${{ steps.ios_signing.outputs.keychain_path }}
        run: flutter build ipa --export-options-plist=ios/ExportOptions.plist

      - name: Stage assets
        env:
          INPUTS_SLUG: ${{ inputs.slug }}
        run: stage-release-assets --slug "${INPUTS_SLUG}"

      - name: Upload staged artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        with:
          name: release-dist-ios
          path: dist/**
          if-no-files-found: error
          retention-days: 7

  upload_release_assets:
    name: upload release assets
    needs:
      - create_draft_release
      - build_android_release_assets
      - build_ios_release_assets
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout source code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          persist-credentials: false

      - name: Download staged Android artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: release-dist-android
          path: dist

      - name: Download staged iOS artifacts
        if: ${{ inputs.build_ios_ipa }}
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: release-dist-ios
          path: dist

      - name: Add Toolbox Envy to PATH
        uses: EarthmanMuons/toolbox-envy/.github/actions/add-to-path@main
        with:
          include_bins: |
            common

      - name: Generate combined checksums
        run: create-checksums --dir dist

      - name: Upload release assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DRAFT_RELEASE_UPLOAD_URL: ${{ needs.create_draft_release.outputs.upload_url }}
        run: |
          set -euo pipefail
          echo "Uploading assets to: ${DRAFT_RELEASE_UPLOAD_URL}"
          ls -la dist/
          gh release upload "$GITHUB_REF_NAME" dist/* --clobber
          {
            printf '### :arrow_up: Uploaded release assets:\n'
            printf '\n'
            find dist -maxdepth 1 -type f -print \
              | sort \
              | sed "s|^dist/|- \`|; s|$|\`|"
          } >>"$GITHUB_STEP_SUMMARY"