build-android.yaml

name: Build Android

on:
  push:
    tags:
      - 'android-v*'
  workflow_dispatch:
    inputs:
      track:
        description: 'Initial Play Store track to upload to (default: beta = Open testing)'
        required: true
        default: 'beta'
        type: choice
        options:
          - internal
          - alpha
          - beta
          - production
      promote_to_production:
        description: 'Auto-promote the same versionCode to Production after the initial upload succeeds.'
        required: false
        default: true
        type: boolean
      rollout_percent:
        description: 'Production staged rollout fraction (0.0–1.0). 1.0 = full release.'
        required: false
        default: '1.0'
        type: string
      force:
        description: 'Build even if this versionCode is already uploaded to Play (default: skip duplicates).'
        required: false
        default: false
        type: boolean

permissions:
  contents: read

env:
  NODE_VERSION: '22'
  JAVA_VERSION: '21'

jobs:
  preflight:
    name: Preflight (skip if Play already has this versionCode)
    runs-on: ubuntu-latest
    outputs:
      should-build: ${{ steps.check.outputs.should-build }}
      version-name: ${{ steps.version.outputs.name }}
      version-code: ${{ steps.version.outputs.code }}
      track: ${{ steps.track.outputs.track }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Determine version from package.json
        id: version
        run: |
          VERSION=$(node -p "require('./package.json').version")
          IFS='.' read -r major minor patch <<< "$VERSION"
          CODE=$((major * 10000 + minor * 100 + patch))
          echo "name=$VERSION" >> "$GITHUB_OUTPUT"
          echo "code=$CODE"   >> "$GITHUB_OUTPUT"
          echo "Version: $VERSION  Code: $CODE"

      - name: Determine Play Store track
        id: track
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "track=${{ inputs.track }}" >> "$GITHUB_OUTPUT"
          else
            # Tag push (android-v*) defaults to Open testing (beta) and then promotes to production.
            echo "track=beta" >> "$GITHUB_OUTPUT"
          fi

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.12'

      - name: Check Play Console for existing AAB/APK
        id: check
        env:
          FORCE: ${{ inputs.force }}
          SA_JSON: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
          PACKAGE_NAME: com.acedatacloud.nexior
          VERSION_CODE: ${{ steps.version.outputs.code }}
        # Opens a Play Console edit, lists all previously uploaded bundles/apks,
        # and aborts the edit. If the target versionCode already appears, we set
        # should-build=false so the heavy build job is skipped. Fail-open on any
        # API failure so a flaky preflight never blocks a release.
        run: |
          if [ "$FORCE" = "true" ]; then
            echo "::notice::force=true → skipping Play duplicate check."
            echo "should-build=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          python3 -m pip install --quiet 'pyjwt[crypto]==2.10.1' requests
          python3 <<'PY'
          import json, os, time, requests, jwt
          try:
              sa = json.loads(os.environ['SA_JSON'])
              package = os.environ['PACKAGE_NAME']
              wanted = int(os.environ['VERSION_CODE'])

              # Exchange the service-account JWT for an access token.
              now = int(time.time())
              assertion = jwt.encode(
                  {
                      'iss': sa['client_email'],
                      'scope': 'https://www.googleapis.com/auth/androidpublisher',
                      'aud': 'https://oauth2.googleapis.com/token',
                      'iat': now, 'exp': now + 3600,
                  },
                  sa['private_key'], algorithm='RS256',
              )
              tok = requests.post(
                  'https://oauth2.googleapis.com/token',
                  data={
                      'grant_type': 'urn:ietf:params:oauth:grant-type:jwt-bearer',
                      'assertion': assertion,
                  }, timeout=30,
              )
              tok.raise_for_status()
              access = tok.json()['access_token']
              h = {'Authorization': f'Bearer {access}'}
              base = f'https://androidpublisher.googleapis.com/androidpublisher/v3/applications/{package}'

              edit = requests.post(f'{base}/edits', headers=h, json={}, timeout=30)
              edit.raise_for_status()
              edit_id = edit.json()['id']
              try:
                  codes = set()
                  for kind in ('bundles', 'apks'):
                      r = requests.get(f'{base}/edits/{edit_id}/{kind}', headers=h, timeout=30)
                      if r.status_code == 200:
                          for item in r.json().get(kind, []):
                              codes.add(int(item['versionCode']))
              finally:
                  requests.delete(f'{base}/edits/{edit_id}', headers=h, timeout=30)

              if wanted in codes:
                  print(f"::notice::Play already has versionCode {wanted} for {package} (uploaded: {sorted(codes)[-10:]}) — skipping.")
                  should = 'false'
              else:
                  print(f"versionCode {wanted} not yet uploaded (last 10 uploaded: {sorted(codes)[-10:]}) — proceeding.")
                  should = 'true'
          except Exception as e:
              print(f"::warning::Play preflight check failed ({e!r}) — letting build proceed.")
              should = 'true'
          with open(os.environ['GITHUB_OUTPUT'], 'a') as f:
              f.write(f'should-build={should}\n')
          print(f'should-build={should}')
          PY

  build:
    name: Build & Upload to Play Store
    needs: preflight
    if: needs.preflight.outputs.should-build == 'true'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Set up JDK
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: ${{ env.JAVA_VERSION }}
          cache: gradle

      - name: Install Node dependencies
        run: npm ci

      - name: Build web assets (Android surface)
        env:
          VITE_STRIPE_PUBLISHABLE_KEY: ${{ secrets.VITE_STRIPE_PUBLISHABLE_KEY }}
        run: npm run build:android

      - name: Sync Android project
        run: npx cap sync android

      - name: Decode keystore
        run: |
          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > android/app/release.keystore
        shell: bash

      - name: Set version in build.gradle
        env:
          VERSION_NAME: ${{ needs.preflight.outputs.version-name }}
          VERSION_CODE: ${{ needs.preflight.outputs.version-code }}
        run: |
          sed -i "s/versionCode [0-9]*/versionCode $VERSION_CODE/" android/app/build.gradle
          sed -i "s/versionName \"[^\"]*\"/versionName \"$VERSION_NAME\"/" android/app/build.gradle
        shell: bash

      - name: Build release AAB
        working-directory: android
        run: |
          chmod +x gradlew
          ./gradlew bundleRelease \
            -PRELEASE_STORE_FILE=release.keystore \
            -PRELEASE_STORE_PASSWORD='${{ secrets.ANDROID_KEYSTORE_PASSWORD }}' \
            -PRELEASE_KEY_ALIAS='${{ secrets.ANDROID_KEY_ALIAS }}' \
            -PRELEASE_KEY_PASSWORD='${{ secrets.ANDROID_KEY_PASSWORD }}'

      - name: Build release APK (for GitHub artifacts)
        working-directory: android
        run: |
          ./gradlew assembleRelease \
            -PRELEASE_STORE_FILE=release.keystore \
            -PRELEASE_STORE_PASSWORD='${{ secrets.ANDROID_KEYSTORE_PASSWORD }}' \
            -PRELEASE_KEY_ALIAS='${{ secrets.ANDROID_KEY_ALIAS }}' \
            -PRELEASE_KEY_PASSWORD='${{ secrets.ANDROID_KEY_PASSWORD }}'

      - name: Upload APK artifact
        uses: actions/upload-artifact@v7
        with:
          name: nexior-${{ needs.preflight.outputs.version-name }}.apk
          path: android/app/build/outputs/apk/release/app-release.apk

      - name: Upload AAB artifact
        uses: actions/upload-artifact@v7
        with:
          name: nexior-${{ needs.preflight.outputs.version-name }}.aab
          path: android/app/build/outputs/bundle/release/app-release.aab

      - name: Upload to Play Store
        uses: r0adkll/upload-google-play@v1
        with:
          serviceAccountJsonPlainText: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
          packageName: com.acedatacloud.nexior
          releaseFiles: android/app/build/outputs/bundle/release/app-release.aab
          tracks: ${{ needs.preflight.outputs.track }}
          status: completed

  promote:
    name: Promote to Production
    needs: [preflight, build]
    # Run when preflight finished AND either the build job uploaded a fresh AAB
    # or it was skipped because Play already had this versionCode (so the
    # promote step can still push it from beta → production).
    if: |
      always()
      && needs.preflight.result == 'success'
      && (needs.build.result == 'success' || needs.build.result == 'skipped')
      && needs.preflight.outputs.track != 'production'
      && (github.event_name != 'workflow_dispatch' || inputs.promote_to_production)
    runs-on: ubuntu-latest
    steps:
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.12'

      - name: Promote release to Production track
        env:
          SA_JSON: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
          PACKAGE_NAME: com.acedatacloud.nexior
          VERSION_CODE: ${{ needs.preflight.outputs.version-code }}
          VERSION_NAME: ${{ needs.preflight.outputs.version-name }}
          ROLLOUT: ${{ github.event_name == 'workflow_dispatch' && inputs.rollout_percent || '1.0' }}
        # Creates a Play Console edit, points the production track at the same versionCode
        # uploaded in the previous job, and commits. Uses staged rollout when ROLLOUT < 1.
        run: |
          python3 -m pip install --quiet 'pyjwt[crypto]==2.10.1' requests
          python3 <<'PY'
          import json, os, time, requests, jwt

          sa = json.loads(os.environ['SA_JSON'])
          package = os.environ['PACKAGE_NAME']
          wanted = int(os.environ['VERSION_CODE'])
          version_name = os.environ.get('VERSION_NAME') or str(wanted)
          try:
              rollout = float(os.environ.get('ROLLOUT', '1.0'))
          except ValueError:
              rollout = 1.0
          rollout = max(0.0, min(1.0, rollout))

          now = int(time.time())
          assertion = jwt.encode(
              {
                  'iss': sa['client_email'],
                  'scope': 'https://www.googleapis.com/auth/androidpublisher',
                  'aud': 'https://oauth2.googleapis.com/token',
                  'iat': now, 'exp': now + 3600,
              },
              sa['private_key'], algorithm='RS256',
          )
          tok = requests.post(
              'https://oauth2.googleapis.com/token',
              data={
                  'grant_type': 'urn:ietf:params:oauth:grant-type:jwt-bearer',
                  'assertion': assertion,
              }, timeout=30,
          )
          tok.raise_for_status()
          access = tok.json()['access_token']
          h = {'Authorization': f'Bearer {access}', 'Content-Type': 'application/json'}
          base = f'https://androidpublisher.googleapis.com/androidpublisher/v3/applications/{package}'

          edit = requests.post(f'{base}/edits', headers=h, json={}, timeout=30)
          edit.raise_for_status()
          edit_id = edit.json()['id']
          try:
              bundles = requests.get(f'{base}/edits/{edit_id}/bundles', headers=h, timeout=30)
              bundles.raise_for_status()
              codes = {int(b['versionCode']) for b in bundles.json().get('bundles', [])}
              if wanted not in codes:
                  raise SystemExit(
                      f'::error::versionCode {wanted} not found in uploaded bundles '
                      f'(last 10: {sorted(codes)[-10:]})'
                  )

              release = {
                  'name': version_name,
                  'versionCodes': [str(wanted)],
              }
              if rollout >= 1.0:
                  release['status'] = 'completed'
              elif rollout > 0:
                  release['status'] = 'inProgress'
                  release['userFraction'] = rollout
              else:
                  release['status'] = 'draft'

              r = requests.put(
                  f'{base}/edits/{edit_id}/tracks/production',
                  headers=h,
                  json={'track': 'production', 'releases': [release]},
                  timeout=30,
              )
              if r.status_code >= 400:
                  print(f'::error::production track update failed: {r.status_code} {r.text}')
                  r.raise_for_status()

              c = requests.post(f'{base}/edits/{edit_id}:commit', headers=h, timeout=60)
              if c.status_code >= 400:
                  print(f'::error::commit failed: {c.status_code} {c.text}')
                  c.raise_for_status()

              print(f'::notice::Promoted versionCode {wanted} ({version_name}) to '
                    f'production (rollout={rollout}).')
          except Exception:
              try:
                  requests.delete(f'{base}/edits/{edit_id}', headers=h, timeout=30)
              except Exception:
                  pass
              raise
          PY