name: Pixel 10 APK

on:
  workflow_dispatch:
  push:
    branches:
      - pixel10

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      KEY_JKS: ${{ secrets.PIXEL10_KEY_JKS }}
      KEY_PATH: ${{ github.workspace }}/apps/weblibre/pixel10-release.jks
      KEY_PASSWORD: ${{ secrets.PIXEL10_KEY_PASSWORD }}
      KEY_ALIAS: ${{ secrets.PIXEL10_KEY_ALIAS }}
    steps:
      - uses: actions/checkout@v4

      - name: Install runner prerequisites
        shell: bash
        run: |
          set -euo pipefail
          required_commands=(jq unzip zip xz readelf python3)
          missing_command=false
          for command_name in "${required_commands[@]}"; do
            if ! command -v "$command_name" >/dev/null 2>&1; then
              missing_command=true
              break
            fi
          done
          if [[ "$missing_command" == "true" ]]; then
            sudo_command=()
            if [[ "$EUID" -ne 0 ]]; then
              sudo_command=(sudo)
            fi
            export DEBIAN_FRONTEND=noninteractive
            "${sudo_command[@]}" apt-get update
            "${sudo_command[@]}" apt-get install -y --no-install-recommends \
              jq unzip zip xz-utils binutils python3
          fi

      - name: Validate signing configuration
        shell: bash
        run: |
          set -euo pipefail
          test -n "$KEY_JKS"
          test -n "$KEY_PASSWORD"
          test -n "$KEY_ALIAS"
          printf '%s' "$KEY_JKS" | base64 -d > "$KEY_PATH"
          chmod 600 "$KEY_PATH"

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - uses: actions/setup-go@v5
        with:
          go-version: 1.25.x

      - name: Set up Rust Android toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android

      - uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Set up Android SDK
        uses: android-actions/setup-android@v3

      - uses: subosito/flutter-action@v2
        with:
          channel: stable
          flutter-version: 3.44.5
          # The act_runner cache endpoint is not reachable from job containers
          # in this setup and otherwise adds two ~5 minute timeouts per run.
          cache: false

      - name: Trust Flutter SDK checkout
        shell: bash
        run: |
          set -euo pipefail
          flutter_sdk="$(dirname "$(dirname "$(command -v flutter)")")"
          git config --global --add safe.directory "$flutter_sdk"

      - name: Install Android SDK platform and NDK
        shell: bash
        run: |
          set -euo pipefail
          android_api="$(sed -n 's/^[[:space:]]*compileSdkVersion[[:space:]]*=[[:space:]]*//p' apps/weblibre/android/build.gradle | head -n 1)"
          android_platform="$android_api.0"
          ndk_version="$(sed -n 's/^weblibre\.ndkVersion[[:space:]]*=[[:space:]]*//p' apps/weblibre/android/gradle.properties)"
          test -n "$android_api"
          test -n "$ndk_version"
          yes | sdkmanager --channel=3 --install \
            "platforms;android-24" \
            "platforms;android-$android_platform" \
            "build-tools;36.0.0" \
            "cmake;3.22.1" \
            "ndk;$ndk_version" || test "${PIPESTATUS[1]}" -eq 0
          test -f "$ANDROID_HOME/platforms/android-24/android.jar"
          test -f "$ANDROID_HOME/platforms/android-$android_platform/android.jar"
          test -f "$ANDROID_HOME/build-tools/36.0.0/aapt2"
          test -x "$ANDROID_HOME/cmake/3.22.1/bin/cmake"
          test -f "$ANDROID_HOME/ndk/$ndk_version/source.properties"
          {
            echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/$ndk_version"
            echo "ANDROID_NDK_ROOT=$ANDROID_HOME/ndk/$ndk_version"
            echo "NDK_HOME=$ANDROID_HOME/ndk/$ndk_version"
          } >> "$GITHUB_ENV"

      - name: Install workspace dependencies
        run: |
          dart pub global activate melos 7.8.1
          melos bootstrap

      - name: Generate bundled assets
        run: |
          melos run update-assets --no-select
          melos run build-components --no-select

      - name: Checkout pinned native sources
        shell: bash
        run: |
          set -euo pipefail
          source native/go_mobile_runtime/pins.env
          git clone https://github.com/SagerNet/sing-box.git "$RUNNER_TEMP/sing-box"
          git -C "$RUNNER_TEMP/sing-box" checkout "$SING_BOX_TAG"
          test "$(git -C "$RUNNER_TEMP/sing-box" rev-parse HEAD)" = "$SING_BOX_COMMIT"
          git clone https://github.com/tladesignz/IPtProxy.git "$RUNNER_TEMP/IPtProxy"
          git -C "$RUNNER_TEMP/IPtProxy" checkout "$IPTPROXY_TAG"
          test "$(git -C "$RUNNER_TEMP/IPtProxy" rev-parse HEAD)" = "$IPTPROXY_COMMIT"
          git -C "$RUNNER_TEMP/IPtProxy" submodule update --init dnstt

      - name: Build native runtime
        env:
          SING_BOX_SOURCE: ${{ runner.temp }}/sing-box
          IPTPROXY_SOURCE: ${{ runner.temp }}/IPtProxy
        # Go writes verbose compiler progress to stderr. Gitea's act runner
        # otherwise labels every one of those harmless lines as "ERROR".
        run: melos run build-go-runtime --no-select 2>&1

      - name: Reclaim disk before Android build
        shell: bash
        run: |
          set -euo pipefail

          # These inputs and compiler caches are only needed to create the AAR
          # installed by the previous step. Cargokit, Gradle and artifact upload
          # need the reclaimed space later in the same job container.
          rm -rf \
            "$RUNNER_TEMP/sing-box" \
            "$RUNNER_TEMP/IPtProxy" \
            native/go_mobile_runtime/.work/android
          go clean -cache -modcache

          available_kib="$(df -Pk / | awk 'NR == 2 { print $4 }')"
          minimum_kib=$((8 * 1024 * 1024))
          df -h /
          if (( available_kib < minimum_kib )); then
            echo "At least 8 GiB of free runner disk is required before the Android build; only $((available_kib / 1024 / 1024)) GiB is available." >&2
            exit 1
          fi

      - name: Build and verify Pixel 10 APK
        env:
          GRADLE_OPTS: >-
            -Dorg.gradle.jvmargs=-Xmx2G
            -Dorg.gradle.workers.max=2
            -Dorg.gradle.daemon=false
        run: melos run build-browser-pixel10 --no-select

      - uses: actions/upload-artifact@v4
        with:
          name: mrbweblibre-pixel10
          path: apps/weblibre/build/app/outputs/flutter-apk/app-pixel10-release.apk

      - name: Remove release key
        if: always()
        run: rm -f "$KEY_PATH"