nightly-build.yml

# Implement to use environment secrets someday, At the moment GH Actions doesn't support those in reusable workflows (ref: https://github.com/actions/runner/issues/1490)
# at least that's what I found.
# This workflow executes PR Code when triggered from PR via workflow_call,
# MUST approve the PR code BEFORE triggering this workflow.

name: Nightly Build

on:
  workflow_call:
    inputs:
      is_PR:
        default: false
        type: boolean
        description: If a Pull Request has triggered it.
      is_trusted_pr:
        default: false
        type: boolean
        description: If a Pull Request is from the same repository (not a fork).
      PR_NUMBER:
        required: false
        type: number
        description: Pull Request number (for PR builds)
    secrets:
      KEYSTORE_CONTENT:
        required: true
      BUILD_JSON_CONTENT:
        required: true
    outputs:
      job_result:
        description: Build job result
        value: ${{ jobs.build.result }}
      updated_version:
        description: Computed build version
        value: ${{ jobs.build.outputs.updated_version }}
      git_commit:
        description: Commit SHA used for artifact naming
        value: ${{ jobs.build.outputs.git_commit }}
      normal_artifact_name:
        description: Artifact name for normal APK
        value: ${{ jobs.build.outputs.normal_artifact_name }}
      fdroid_artifact_name:
        description: Artifact name for fdroid APK
        value: ${{ jobs.build.outputs.fdroid_artifact_name }}

  workflow_dispatch:

permissions:
  contents: read

concurrency:
   # Allow only one workflow per branch.
  group: ${{ github.workflow }}-${{ github.ref_name }}-${{ inputs.is_PR && 'is_PR' || 'not_PR' }}
  cancel-in-progress: true

env:
  STORE_FILE_PATH: /tmp/app-debug.keystore
  BUILD_JSON_PATH: build.json
  VERSION_LABEL: ${{ inputs.is_PR && 'pr' || 'nightly' }}

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    if: github.repository_owner == 'Acode-Foundation'
    permissions:
      contents: read
      pull-requests: read

    outputs:
      updated_version: ${{ steps.version.outputs.updated_version }}
      git_commit: ${{ steps.meta.outputs.git_commit }}
      normal_artifact_name: ${{ steps.meta.outputs.normal_artifact_name }}
      fdroid_artifact_name: ${{ steps.meta.outputs.fdroid_artifact_name }}

    steps:
      - name: Validate required secrets (Fast Fail If missing on nightly builds)
        if: ${{ !inputs.is_PR || inputs.is_trusted_pr }}
        env:
          KEYSTORE_CONTENT: ${{ secrets.KEYSTORE_CONTENT }}
          BUILD_JSON_CONTENT: ${{ secrets.BUILD_JSON_CONTENT }}
        run: |
          [ -n "$KEYSTORE_CONTENT" ] && [ -n "$BUILD_JSON_CONTENT" ] || { echo "::error title=Missing secrets::KEYSTORE_CONTENT or BUILD_JSON_CONTENT is missing"; exit 1; }
      
      - name: Logging & summaries
        run: |
          echo "::group::Logging" 
          echo "🎯 github trigger event name: ${{ github.event_name }}"
          echo "is_PR: ${{ inputs.is_PR }} "
          echo "PR_NUMBER: ${{ inputs.PR_NUMBER }}" 
          echo "env: STORE_FILE_PATH: ${{ env.STORE_FILE_PATH }}" 
          echo "env: BUILD_JSON_PATH: ${{ env.BUILD_JSON_PATH }}" 
          echo "env: VERSION_LABEL: ${{ env.VERSION_LABEL }}"
          echo "github sha: ${{ github.sha }}" 
          echo "should skip signing with our keys: ${{ inputs.is_PR && !inputs.is_trusted_pr && 'true' || 'false' }}"             
          echo "::endgroup::" 
          echo "## 🚀 Build Type: ${{ env.VERSION_LABEL }}" >> $GITHUB_STEP_SUMMARY
          echo "is_PR: ${{ inputs.is_PR || 'NOT a PR' }}" >> $GITHUB_STEP_SUMMARY
          echo "PR_NUMBER: ${{ inputs.PR_NUMBER || 'not a PR' }}" >> $GITHUB_STEP_SUMMARY  
      
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0 # Required for tags
          persist-credentials: false
          submodules: recursive
          ref: ${{ (inputs.is_PR && inputs.PR_NUMBER) && github.event.pull_request.head.sha || '' }}
          allow-unsafe-pr-checkout: ${{ !!(inputs.is_PR && inputs.PR_NUMBER && github.event.pull_request.head.sha) }}

      - name: Setup Java
        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: "21"
          cache: ${{ (!(inputs.is_PR && inputs.PR_NUMBER) && github.ref == 'refs/heads/main' && 'gradle') || '' }}

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: "lts/*" # or '18.x' for latest stable
          cache: ${{ (!(inputs.is_PR && inputs.PR_NUMBER) && github.ref == 'refs/heads/main' && 'npm') || '' }}

      - name: Compute metadata
        id: meta
        run: |
          GIT_COMMIT="$(git rev-parse HEAD)"
          echo "git_commit=$GIT_COMMIT" >> "$GITHUB_OUTPUT"
          echo "normal_artifact_name=app-debug-$GIT_COMMIT" >> "$GITHUB_OUTPUT"
          echo "fdroid_artifact_name=app-debug-fdroid-$GIT_COMMIT" >> "$GITHUB_OUTPUT"

      - name: Inject signing files
        if: ${{ !inputs.is_PR || inputs.is_trusted_pr }}
        run: |
          echo "${{ secrets.KEYSTORE_CONTENT }}" | base64 -d > "${{ env.STORE_FILE_PATH }}"
          echo "${{ secrets.BUILD_JSON_CONTENT }}" | base64 -d > "${{ env.BUILD_JSON_PATH }}"

      - name: Extract base version
        id: base
        run: |
          VERSION=$(grep -oP 'version="\K[0-9.]+' config.xml)
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Compose and set build version in config.xml
        id: version
        run: |
          SHORT="$(echo "${{ steps.meta.outputs.git_commit }}" | cut -c1-7)"
          if ${{ inputs.is_PR || false }}; then
            SUFFIX="${{ inputs.PR_NUMBER }}"
          else
            SUFFIX="$SHORT"
          fi
          UPDATED="${{ steps.base.outputs.version }}-${{ env.VERSION_LABEL }}.$SUFFIX"
          sed -i "s/version=\"${{ steps.base.outputs.version }}\"/version=\"$UPDATED\"/g" config.xml
          echo "updated_version=$UPDATED" >> "$GITHUB_OUTPUT"
          echo "NORMAL_APK_PATH=/tmp/acode-debug-normal-$UPDATED.apk" >> "$GITHUB_ENV"
          echo "FDROID_APK_PATH=/tmp/acode-debug-fdroid-$UPDATED.apk" >> "$GITHUB_ENV"

      - name: Install deps
        run: |
          npm install
          npm install -g cordova
          npm run setup

      - name: Build normal APK
        run: |
          node utils/storage_manager.mjs y
          npm run build paid dev apk
          mv platforms/android/app/build/outputs/apk/debug/app-debug.apk ${{ env.NORMAL_APK_PATH }}

      - name: Upload normal artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ steps.meta.outputs.normal_artifact_name }}
          path: ${{ env.NORMAL_APK_PATH }}

      - name: Build fdroid APK
        if: ${{ !inputs.is_PR }}
        run: |
          node utils/storage_manager.mjs y
          npm run build paid dev apk fdroid
          mv platforms/android/app/build/outputs/apk/debug/app-debug.apk ${{ env.FDROID_APK_PATH }}

      - name: Upload fdroid artifact
        if: ${{ !inputs.is_PR }}
        uses: actions/upload-artifact@v7
        with:
          name: ${{ steps.meta.outputs.fdroid_artifact_name }}
          path: ${{ env.FDROID_APK_PATH }}

      - name: Cleanup signing files
        if: ${{ !inputs.is_PR || inputs.is_trusted_pr }}
        run: rm -f ${{ env.STORE_FILE_PATH }} ${{ env.BUILD_JSON_PATH }}
      
      - name: Post Build - SHA256 signature computation (output)
        id: sha256
        run: |
          echo "normal_apk_sha256=$(sha256sum ${{ env.NORMAL_APK_PATH }} | awk '{print $1}')" >> "$GITHUB_OUTPUT"
          if [ -f "${{ env.FDROID_APK_PATH }}" ]; then
            echo "fdroid_apk_sha256=$(sha256sum ${{ env.FDROID_APK_PATH }} | awk '{print $1}')" >> "$GITHUB_OUTPUT"
          fi

      - name: Post build summary (Table)
        run: |
          echo "## 🏗️ Build Summary" >> $GITHUB_STEP_SUMMARY
          echo "| Key | Value |" >> $GITHUB_STEP_SUMMARY
          echo "| --- | ----- |" >> $GITHUB_STEP_SUMMARY
          echo "| Build Version | ${{ steps.version.outputs.updated_version }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Git Commit | ${{ steps.meta.outputs.git_commit }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Normal APK Artifact Name | ${{ steps.meta.outputs.normal_artifact_name }} |" >> $GITHUB_STEP_SUMMARY
          echo "| F-Droid APK Artifact Name | ${{ steps.meta.outputs.fdroid_artifact_name || 'N/A' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Normal APK Artifact SHA256 | ${{ steps.sha256.outputs.normal_apk_sha256 }} |" >> $GITHUB_STEP_SUMMARY
          echo "| F-Droid APK Artifact SHA256 | ${{ steps.sha256.outputs.fdroid_apk_sha256 || 'N/A' }} |" >> $GITHUB_STEP_SUMMARY