android-publish.yml

name: Android — Publish to Maven Central

on:
  release:
    types:
      - published
  workflow_dispatch:

jobs:
  build:
    # Only run for Android releases. Android releases are tagged `android/X.Y.Z`;
    # Swift releases use bare semver (`X.Y.Z`).
    if: ${{ github.event_name == 'workflow_dispatch' || startsWith(github.event.release.tag_name, 'android/') }}
    environment:
      name: Central Repository Deployment

    runs-on: ubuntu-latest
    permissions:
      contents: read

    env:
      OSSRH_API_BASE_URL: https://ossrh-staging-api.central.sonatype.com

    defaults:
      run:
        working-directory: platforms/android

    steps:
      - name: Checkout Repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          submodules: true

      - name: Validate release tag matches Android version
        id: release
        working-directory: ${{ github.workspace }}
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          set -euo pipefail
          if [ "$GITHUB_EVENT_NAME" = "release" ]; then
            TAG="$RELEASE_TAG"
          else
            TAG="$GITHUB_REF_NAME"
          fi

          .github/scripts/validate-release-version Android "" "$TAG" >> "$GITHUB_OUTPUT"

      - name: Verify Embedded Checkout Protocol is published
        env:
          PROTOCOL_VERSION: ${{ steps.release.outputs.android_protocol_version }}
        run: |
          set -euo pipefail
          POM_URL="https://repo.maven.apache.org/maven2/com/shopify/embedded-checkout-protocol/${PROTOCOL_VERSION}/embedded-checkout-protocol-${PROTOCOL_VERSION}.pom"

          if ! curl -fsSL --retry 5 --retry-delay 10 --retry-all-errors -o /dev/null "$POM_URL"; then
            echo "::error::com.shopify:embedded-checkout-protocol:${PROTOCOL_VERSION} is not available on Maven Central. Publish embedded-checkout-protocol/${PROTOCOL_VERSION} before releasing Android Kit."
            exit 1
          fi

          echo "::notice::Found com.shopify:embedded-checkout-protocol:${PROTOCOL_VERSION} on Maven Central."

      - name: Install JDK 1.17
        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
        with:
          distribution: zulu
          java-version: 17

      - name: Publish Package
        run: |
          ./gradlew \
            :lib:publishReleasePublicationToOssrh-staging-apiRepository
        env:
          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
          OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
          ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.OSSRH_GPG_SECRET_KEY_ID }}
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.OSSRH_GPG_SECRET_KEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }}

      - name: Find OSSRH Repository
        id: find-repo
        run: |
          TOKEN=$(echo -n "${{ secrets.OSSRH_USERNAME }}:${{ secrets.OSSRH_PASSWORD }}" | base64)
          RESPONSE=$(curl -s -H "Authorization: Bearer $TOKEN" \
            "${OSSRH_API_BASE_URL}/manual/search/repositories?ip=any&state=open")
          echo "Response: $RESPONSE"

          # Extract repository key from JSON response
          REPO_KEY=$(echo "$RESPONSE" | jq -r \
            '.repositories[] | .key' | head -1)
          echo "Repository key: $REPO_KEY"

          if [ -z "$REPO_KEY" ]; then
            echo "Error: No open repository found"
            exit 1
          fi

          echo "repo_key=$REPO_KEY" >> $GITHUB_OUTPUT

      - name: Upload Repository to Central Portal
        run: |
          TOKEN=$(echo -n "${{ secrets.OSSRH_USERNAME }}:${{ secrets.OSSRH_PASSWORD }}" | base64)
          REPO_KEY="${{ steps.find-repo.outputs.repo_key }}"

          echo "Uploading repository: $REPO_KEY"
          curl -v -X POST -H "Authorization: Bearer $TOKEN" \
            "${OSSRH_API_BASE_URL}/manual/upload/repository/$REPO_KEY"

          echo "Upload completed successfully"