release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      deploy_play_store:
        description: "Deploy AAB to Google Play internal track"
        type: boolean
        default: true
      deploy_web:
        description: "Deploy web build to Firebase Hosting"
        type: boolean
        default: true

# Cancel previous runs on the same ref so we don't waste minutes.
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

env:
  FLUTTER_VERSION: "3.38.2" # keep in sync with your local SDK
  JAVA_VERSION: "17"

jobs:
  # ──────────────────────────────────────────────
  # 0. Unit, widget, and integration tests (web Chrome)
  # ──────────────────────────────────────────────
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          channel: stable
          cache: true

      - name: Flutter pub get
        run: flutter pub get

      - name: Run unit and widget tests
        run: flutter test

      - name: Install Chrome
        uses: browser-actions/setup-chrome@v1

      - name: Install ChromeDriver
        uses: nanasess/setup-chromedriver@v2

      - name: Start ChromeDriver
        run: |
          chromedriver --port=4444 &
          sleep 3

      - name: Run integration tests (web)
        run: |
          flutter drive \
            --driver=test_driver/integration_test.dart \
            --target=integration_test/app_test.dart \
            -d web-server \
            --release \
            --web-browser-flag=--no-sandbox \
            --web-browser-flag=--disable-dev-shm-usage

  # ──────────────────────────────────────────────
  # 0b. Online integration tests (local Supabase + web Chrome)
  # ──────────────────────────────────────────────
  test-online:
    name: Online Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          channel: stable
          cache: true

      - name: Flutter pub get
        run: flutter pub get

      - name: Set up Supabase CLI
        uses: supabase/setup-cli@v1
        with:
          version: latest

      - name: Start local Supabase
        run: supabase start

      - name: Reset database (migrations + seed)
        run: supabase db reset

      - name: Wait for Supabase API
        run: |
          API_URL=$(supabase status --output json | jq -r '.API_URL')
          for i in $(seq 1 30); do
            code=$(curl -s -o /dev/null -w "%{http_code}" "$API_URL/rest/v1/" || true)
            if [ "$code" = "200" ] || [ "$code" = "401" ] || [ "$code" = "404" ]; then
              echo "Supabase API ready (HTTP $code)"
              break
            fi
            echo "Waiting for Supabase API... ($i/30)"
            sleep 2
          done

      - name: Extract Supabase credentials
        id: supabase
        run: |
          echo "url=$(supabase status --output json | jq -r '.API_URL')" >> "$GITHUB_OUTPUT"
          echo "anon_key=$(supabase status --output json | jq -r '.ANON_KEY')" >> "$GITHUB_OUTPUT"

      - name: Install Chrome
        uses: browser-actions/setup-chrome@v1

      - name: Install ChromeDriver
        uses: nanasess/setup-chromedriver@v2

      - name: Start ChromeDriver
        run: |
          chromedriver --port=4444 &
          sleep 3

      - name: Run online integration tests (web)
        run: |
          flutter drive \
            --driver=test_driver/integration_test.dart \
            --target=integration_test/online_app_test.dart \
            -d web-server \
            --release \
            --dart-define=SUPABASE_URL=${{ steps.supabase.outputs.url }} \
            --dart-define=SUPABASE_ANON_KEY=${{ steps.supabase.outputs.anon_key }} \
            --web-browser-flag=--no-sandbox \
            --web-browser-flag=--disable-dev-shm-usage

      - name: Stop local Supabase
        if: always()
        run: supabase stop

  # ──────────────────────────────────────────────
  # 1. Build Android APK + AAB
  # ──────────────────────────────────────────────
  build-android:
    name: Build Android
    needs: [test]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Java ${{ env.JAVA_VERSION }}
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: ${{ env.JAVA_VERSION }}

      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          channel: stable
          cache: true

      # Decode the release keystore from a base64 secret.
      - name: Decode keystore
        run: |
          echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 --decode > android/app/release-keystore.jks

      # Write key.properties so build.gradle.kts picks it up.
      - name: Create key.properties
        env:
          STORE_FILE: ${{ github.workspace }}/android/app/release-keystore.jks
          STORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS_VAL: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD_VAL: ${{ secrets.KEY_PASSWORD }}
        run: |
          printf 'storeFile=%s\nstorePassword=%s\nkeyAlias=%s\nkeyPassword=%s\n' \
            "$STORE_FILE" "$STORE_PASSWORD" "$KEY_ALIAS_VAL" "$KEY_PASSWORD_VAL" \
            > android/key.properties

      # Restore google-services.json from a base64 secret (gitignored for security).
      - name: Decode google-services.json
        run: echo "${{ secrets.GOOGLE_SERVICES_JSON }}" | base64 --decode > android/app/google-services.json

      - name: Flutter pub get
        run: flutter pub get

      - name: Build APK
        run: |
          flutter build apk --release \
            --dart-define=SUPABASE_URL=${{ secrets.SUPABASE_URL }} \
            --dart-define=SUPABASE_ANON_KEY=${{ secrets.SUPABASE_ANON_KEY }} \
            --dart-define=INVITE_BASE_URL=${{ secrets.INVITE_BASE_URL }} \
            --dart-define=FCM_VAPID_KEY=${{ secrets.FCM_VAPID_KEY }}

      - name: Build App Bundle
        run: |
          flutter build appbundle --release \
            --dart-define=SUPABASE_URL=${{ secrets.SUPABASE_URL }} \
            --dart-define=SUPABASE_ANON_KEY=${{ secrets.SUPABASE_ANON_KEY }} \
            --dart-define=INVITE_BASE_URL=${{ secrets.INVITE_BASE_URL }} \
            --dart-define=FCM_VAPID_KEY=${{ secrets.FCM_VAPID_KEY }}

      - name: Upload APK artifact
        uses: actions/upload-artifact@v4
        with:
          name: release-apk
          path: build/app/outputs/flutter-apk/app-release.apk

      - name: Upload AAB artifact
        uses: actions/upload-artifact@v4
        with:
          name: release-aab
          path: build/app/outputs/bundle/release/app-release.aab

  # ──────────────────────────────────────────────
  # 2. Create GitHub Release (tag pushes only)
  # ──────────────────────────────────────────────
  github-release:
    name: GitHub Release
    needs: build-android
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download APK
        uses: actions/download-artifact@v4
        with:
          name: release-apk

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: app-release.apk

  # ──────────────────────────────────────────────
  # 3. Deploy AAB to Google Play (internal track)
  # ──────────────────────────────────────────────
  deploy-play-store:
    name: Deploy to Google Play
    needs: build-android
    if: >-
      (startsWith(github.ref, 'refs/tags/v')) ||
      (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_play_store == 'true')
    runs-on: ubuntu-latest
    steps:
      - name: Download AAB
        uses: actions/download-artifact@v4
        with:
          name: release-aab

      - name: Upload to Play Store (internal)
        uses: r0adkll/upload-google-play@v1
        with:
          serviceAccountJsonPlainText: ${{ secrets.PLAY_STORE_SERVICE_ACCOUNT_JSON }}
          packageName: com.shenepoy.hisab
          releaseFiles: app-release.aab
          track: internal
          status: completed

  # ──────────────────────────────────────────────
  # 4. Build & deploy web to Firebase Hosting
  # ──────────────────────────────────────────────
  deploy-web:
    name: Deploy Web
    if: >-
      (startsWith(github.ref, 'refs/tags/v')) ||
      (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_web == 'true')
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          channel: stable
          cache: true

      - name: Flutter pub get
        run: flutter pub get

      # PowerSync web needs sqlite3.wasm and worker JS (required for live site; missing = "Unexpected token '<'" / wrong WASM MIME).
      - name: Set up PowerSync web (sqlite3.wasm + workers)
        run: dart run powersync:setup_web

      - name: Ensure PowerSync web assets exist
        run: |
          test -f web/sqlite3.wasm || (echo "Missing web/sqlite3.wasm after setup_web" && exit 1)
          test -f web/powersync_db.worker.js || (echo "Missing web/powersync_db.worker.js after setup_web" && exit 1)

      - name: Build web
        run: |
          flutter build web \
            --dart-define=SUPABASE_URL=${{ secrets.SUPABASE_URL }} \
            --dart-define=SUPABASE_ANON_KEY=${{ secrets.SUPABASE_ANON_KEY }} \
            --dart-define=INVITE_BASE_URL=${{ secrets.INVITE_BASE_URL }} \
            --dart-define=SITE_URL=${{ secrets.SITE_URL }} \
            --dart-define=FCM_VAPID_KEY=${{ secrets.FCM_VAPID_KEY }} \
            --dart-define=FIREBASE_API_KEY=${{ secrets.FIREBASE_API_KEY }} \
            --dart-define=FIREBASE_AUTH_DOMAIN=${{ secrets.FIREBASE_AUTH_DOMAIN }} \
            --dart-define=FIREBASE_PROJECT_ID=${{ secrets.FIREBASE_PROJECT_ID }} \
            --dart-define=FIREBASE_STORAGE_BUCKET=${{ secrets.FIREBASE_STORAGE_BUCKET }} \
            --dart-define=FIREBASE_MESSAGING_SENDER_ID=${{ secrets.FIREBASE_MESSAGING_SENDER_ID }} \
            --dart-define=FIREBASE_APP_ID=${{ secrets.FIREBASE_APP_ID }}

      - name: Inject Firebase config into web assets
        run: |
          for f in build/web/index.html build/web/firebase-messaging-sw.js; do
            sed -i "s|__FIREBASE_API_KEY__|${{ secrets.FIREBASE_API_KEY }}|g" "$f"
            sed -i "s|__FIREBASE_AUTH_DOMAIN__|${{ secrets.FIREBASE_AUTH_DOMAIN }}|g" "$f"
            sed -i "s|__FIREBASE_PROJECT_ID__|${{ secrets.FIREBASE_PROJECT_ID }}|g" "$f"
            sed -i "s|__FIREBASE_STORAGE_BUCKET__|${{ secrets.FIREBASE_STORAGE_BUCKET }}|g" "$f"
            sed -i "s|__FIREBASE_MESSAGING_SENDER_ID__|${{ secrets.FIREBASE_MESSAGING_SENDER_ID }}|g" "$f"
            sed -i "s|__FIREBASE_APP_ID__|${{ secrets.FIREBASE_APP_ID }}|g" "$f"
          done

      - name: Copy static pages and PowerSync web assets for Firebase Hosting
        run: |
          cp -r web/privacy build/web/
          cp -r web/delete-account build/web/
          cp web/redirect.html build/web/
          cp web/og-invite.png build/web/
          sed "s|__SUPABASE_URL__|${{ secrets.SUPABASE_URL }}|g" web/invite-redirect-template.html > build/web/invite-redirect.html
          cp web/sqlite3.wasm build/web/ 2>/dev/null || true
          for f in web/*.worker.js; do [ -f "$f" ] && cp "$f" build/web/; done

      - name: Deploy to Firebase Hosting
        uses: FirebaseExtended/action-hosting-deploy@v0
        with:
          repoToken: ${{ secrets.GITHUB_TOKEN }}
          firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT }}
          channelId: live
          projectId: ${{ secrets.FIREBASE_PROJECT_ID }}