release-mobile.yml

name: Release Mobile

# Builds the hosted PWA and the signed native store artifacts. Store upload is
# automatic when the corresponding publisher credentials are configured.

on:
  workflow_dispatch:
    inputs:
      web:
        description: "Release the hosted PWA to Vercel"
        type: boolean
        default: false
      android:
        description: "Build the signed Android App Bundle"
        type: boolean
        default: false
      ios:
        description: "Build and upload the iOS app to TestFlight"
        type: boolean
        default: false
  push:
    tags:
      - "mobile-v*"

permissions:
  contents: read

concurrency:
  group: release-mobile-${{ github.ref }}
  cancel-in-progress: false

jobs:
  setup:
    name: Resolve release
    runs-on: ubuntu-latest
    outputs:
      web: ${{ steps.release.outputs.web }}
      android: ${{ steps.release.outputs.android }}
      ios: ${{ steps.release.outputs.ios }}
      version: ${{ steps.release.outputs.version }}
      build_number: ${{ steps.release.outputs.build_number }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
      - id: release
        shell: bash
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "web=${{ inputs.web }}" >> "$GITHUB_OUTPUT"
            echo "android=${{ inputs.android }}" >> "$GITHUB_OUTPUT"
            echo "ios=${{ inputs.ios }}" >> "$GITHUB_OUTPUT"
            version="$(node -p "require('./package.json').version")"
          else
            echo "web=true" >> "$GITHUB_OUTPUT"
            echo "android=true" >> "$GITHUB_OUTPUT"
            echo "ios=true" >> "$GITHUB_OUTPUT"
            version="${GITHUB_REF_NAME#mobile-v}"
          fi

          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Invalid mobile version: $version" >&2
            exit 1
          fi

          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "build_number=$((GITHUB_RUN_NUMBER * 100 + GITHUB_RUN_ATTEMPT))" >> "$GITHUB_OUTPUT"

  web:
    name: Web (Vercel)
    needs: setup
    if: needs.setup.outputs.web == 'true'
    runs-on: ubuntu-latest
    environment: mobile-web
    env:
      VERCEL_ORG_ID: ${{ vars.VERCEL_ORG_ID }}
      VERCEL_PROJECT_ID: ${{ vars.VERCEL_PROJECT_ID }}
      PORACODE_MOBILE_APP_HOST: ${{ vars.PORACODE_MOBILE_APP_HOST }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: "24"
          cache: pnpm
      - name: Validate Vercel configuration
        shell: bash
        env:
          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
        run: |
          for name in VERCEL_ORG_ID VERCEL_PROJECT_ID; do
            if [ -z "${!name}" ]; then
              echo "Missing mobile-web variable: $name" >&2
              exit 1
            fi
          done
          if [ -z "$VERCEL_TOKEN" ]; then
            echo "Missing mobile-web secret: VERCEL_TOKEN" >&2
            exit 1
          fi
      - name: Install Vercel CLI
        run: npm install --global vercel@54.21.1
      - name: Pull Vercel environment
        env:
          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
        run: vercel pull --yes --environment=production --token="$VERCEL_TOKEN"
      - name: Build
        env:
          PORACODE_MOBILE_ANDROID_SHA256_CERT_FINGERPRINTS: ${{ secrets.PORACODE_MOBILE_ANDROID_SHA256_CERT_FINGERPRINTS }}
          PORACODE_MOBILE_APPLE_TEAM_ID: ${{ secrets.PORACODE_MOBILE_APPLE_TEAM_ID || secrets.APPLE_TEAM_ID }}
          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
        run: vercel build --prod --token="$VERCEL_TOKEN"
      - name: Deploy
        env:
          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
        run: vercel deploy --prebuilt --prod --token="$VERCEL_TOKEN"

  android:
    name: Android (Play)
    needs: setup
    if: needs.setup.outputs.android == 'true'
    runs-on: ubuntu-latest
    environment: mobile-android
    env:
      PORACODE_MOBILE_APP_HOST: ${{ vars.PORACODE_MOBILE_APP_HOST }}
      PORACODE_MOBILE_BUILD_NUMBER: ${{ needs.setup.outputs.build_number }}
      PORACODE_MOBILE_VERSION_NAME: ${{ needs.setup.outputs.version }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: "24"
          cache: pnpm
      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
        with:
          distribution: temurin
          java-version: "21"
      - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3

      - name: Validate Android release configuration
        shell: bash
        env:
          ANDROID_GOOGLE_SERVICES_JSON_BASE64: ${{ secrets.ANDROID_GOOGLE_SERVICES_JSON_BASE64 }}
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
          PORACODE_MOBILE_ANDROID_SHA256_CERT_FINGERPRINTS: ${{ secrets.PORACODE_MOBILE_ANDROID_SHA256_CERT_FINGERPRINTS }}
        run: |
          required=(
            ANDROID_KEYSTORE_BASE64
            ANDROID_KEYSTORE_PASSWORD
            ANDROID_KEY_ALIAS
            ANDROID_KEY_PASSWORD
            ANDROID_GOOGLE_SERVICES_JSON_BASE64
            PORACODE_MOBILE_APP_HOST
          )
          for name in "${required[@]}"; do
            if [ -z "${!name}" ]; then
              echo "Missing mobile-android secret or variable: $name" >&2
              exit 1
            fi
          done
          if [ -z "$PORACODE_MOBILE_ANDROID_SHA256_CERT_FINGERPRINTS" ]; then
            echo "Play app-signing fingerprint is not available yet; assetlinks.json will remain empty for the first AAB."
          fi

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts
      - name: Decode Android release files
        shell: bash
        env:
          ANDROID_GOOGLE_SERVICES_JSON_BASE64: ${{ secrets.ANDROID_GOOGLE_SERVICES_JSON_BASE64 }}
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: |
          echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > "$RUNNER_TEMP/poracode-release.keystore"
          echo "$ANDROID_GOOGLE_SERVICES_JSON_BASE64" | base64 --decode > "$RUNNER_TEMP/google-services.json"
          echo "PORACODE_ANDROID_GOOGLE_SERVICES_JSON=$RUNNER_TEMP/google-services.json" >> "$GITHUB_ENV"
      - name: Build web assets
        env:
          PORACODE_MOBILE_ANDROID_SHA256_CERT_FINGERPRINTS: ${{ secrets.PORACODE_MOBILE_ANDROID_SHA256_CERT_FINGERPRINTS }}
        run: pnpm run build:mobile
      - name: Sync Capacitor
        env:
          PORACODE_MOBILE_ANDROID_SHA256_CERT_FINGERPRINTS: ${{ secrets.PORACODE_MOBILE_ANDROID_SHA256_CERT_FINGERPRINTS }}
        run: |
          pnpm exec cap sync android
          pnpm run cap:configure
      - name: Lint Android release
        working-directory: android
        run: ./gradlew lintRelease
      - name: Build signed AAB
        working-directory: android
        env:
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          ./gradlew bundleRelease \
            -Pandroid.injected.signing.store.file="$RUNNER_TEMP/poracode-release.keystore" \
            -Pandroid.injected.signing.store.password="$ANDROID_KEYSTORE_PASSWORD" \
            -Pandroid.injected.signing.key.alias="$ANDROID_KEY_ALIAS" \
            -Pandroid.injected.signing.key.password="$ANDROID_KEY_PASSWORD"
      - name: Upload AAB artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: poracode-android-${{ needs.setup.outputs.version }}-${{ needs.setup.outputs.build_number }}
          path: android/app/build/outputs/bundle/release/*.aab
          if-no-files-found: error
      - name: Check Play publishing credentials
        id: play
        shell: bash
        env:
          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
        run: |
          if [ -n "$PLAY_SERVICE_ACCOUNT_JSON" ]; then
            echo "configured=true" >> "$GITHUB_OUTPUT"
          else
            echo "configured=false" >> "$GITHUB_OUTPUT"
          fi
      - name: Publish to Google Play
        if: steps.play.outputs.configured == 'true'
        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1
        with:
          serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
          packageName: com.lightcodeapp.mobile
          releaseFiles: android/app/build/outputs/bundle/release/*.aab
          track: ${{ vars.PLAY_TRACK || 'internal' }}
          status: completed

  ios:
    name: iOS (TestFlight)
    needs: setup
    if: needs.setup.outputs.ios == 'true'
    runs-on: macos-26
    environment: mobile-ios
    env:
      PORACODE_MOBILE_APP_HOST: ${{ vars.PORACODE_MOBILE_APP_HOST }}
      PORACODE_MOBILE_BUILD_NUMBER: ${{ needs.setup.outputs.build_number }}
      PORACODE_MOBILE_VERSION_NAME: ${{ needs.setup.outputs.version }}
      PORACODE_MOBILE_REQUIRE_IOS_LINKS: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: "24"
          cache: pnpm

      - name: Validate iOS release configuration
        shell: bash
        env:
          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
          APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
          APP_STORE_CONNECT_PRIVATE_KEY: ${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY }}
          PORACODE_MOBILE_APPLE_TEAM_ID: ${{ secrets.PORACODE_MOBILE_APPLE_TEAM_ID || secrets.APPLE_TEAM_ID }}
        run: |
          required=(
            APP_STORE_CONNECT_KEY_ID
            APP_STORE_CONNECT_ISSUER_ID
            APP_STORE_CONNECT_PRIVATE_KEY
            PORACODE_MOBILE_APP_HOST
            PORACODE_MOBILE_APPLE_TEAM_ID
          )
          for name in "${required[@]}"; do
            if [ -z "${!name}" ]; then
              echo "Missing mobile-ios secret or variable: $name" >&2
              exit 1
            fi
          done
      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts
      - name: Build web assets
        env:
          PORACODE_MOBILE_APPLE_TEAM_ID: ${{ secrets.PORACODE_MOBILE_APPLE_TEAM_ID || secrets.APPLE_TEAM_ID }}
        run: pnpm run build:mobile
      - name: Sync Capacitor
        env:
          PORACODE_MOBILE_APPLE_TEAM_ID: ${{ secrets.PORACODE_MOBILE_APPLE_TEAM_ID || secrets.APPLE_TEAM_ID }}
        run: |
          pnpm exec cap sync ios
          pnpm run cap:configure
      - name: Prepare App Store Connect key
        shell: bash
        env:
          APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
          APP_STORE_CONNECT_PRIVATE_KEY: ${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY }}
        run: |
          key_path="$RUNNER_TEMP/AuthKey_${APP_STORE_CONNECT_KEY_ID}.p8"
          printf '%s' "$APP_STORE_CONNECT_PRIVATE_KEY" > "$key_path"
          chmod 600 "$key_path"
          echo "APP_STORE_CONNECT_KEY_PATH=$key_path" >> "$GITHUB_ENV"
      - name: Archive and export IPA
        working-directory: ios/App
        shell: bash
        env:
          APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
          APP_STORE_CONNECT_KEY_ID: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
          PORACODE_MOBILE_APPLE_TEAM_ID: ${{ secrets.PORACODE_MOBILE_APPLE_TEAM_ID || secrets.APPLE_TEAM_ID }}
        run: |
          xcodebuild \
            -project App.xcodeproj \
            -scheme App \
            -configuration Release \
            -destination 'generic/platform=iOS' \
            -archivePath "$RUNNER_TEMP/App.xcarchive" \
            -allowProvisioningUpdates \
            -authenticationKeyPath "$APP_STORE_CONNECT_KEY_PATH" \
            -authenticationKeyID "$APP_STORE_CONNECT_KEY_ID" \
            -authenticationKeyIssuerID "$APP_STORE_CONNECT_ISSUER_ID" \
            DEVELOPMENT_TEAM="$PORACODE_MOBILE_APPLE_TEAM_ID" \
            CODE_SIGN_STYLE=Automatic \
            MARKETING_VERSION="$PORACODE_MOBILE_VERSION_NAME" \
            CURRENT_PROJECT_VERSION="$PORACODE_MOBILE_BUILD_NUMBER" \
            archive
          xcodebuild \
            -exportArchive \
            -archivePath "$RUNNER_TEMP/App.xcarchive" \
            -exportPath "$RUNNER_TEMP/export" \
            -exportOptionsPlist exportOptions.plist \
            -allowProvisioningUpdates \
            -authenticationKeyPath "$APP_STORE_CONNECT_KEY_PATH" \
            -authenticationKeyID "$APP_STORE_CONNECT_KEY_ID" \
            -authenticationKeyIssuerID "$APP_STORE_CONNECT_ISSUER_ID"
      - name: Upload IPA artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: poracode-ios-${{ needs.setup.outputs.version }}-${{ needs.setup.outputs.build_number }}
          path: ${{ runner.temp }}/export/*.ipa
          if-no-files-found: error
      - name: Upload to TestFlight
        uses: apple-actions/upload-testflight-build@9fd28d4e690396e43caca69cef54cccccce77034 # v3
        with:
          app-path: ${{ runner.temp }}/export/App.ipa
          issuer-id: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
          api-key-id: ${{ secrets.APP_STORE_CONNECT_KEY_ID }}
          api-private-key: ${{ secrets.APP_STORE_CONNECT_PRIVATE_KEY }}