unstable.yml

name: Unstable

# Unstable / pre-release channel. These builds DO self-update: the app checks GitHub
# pre-releases and downloads a newer unstable APK (origin allowlist + signature check).
on:
  push:
    branches: [master]
  workflow_dispatch:

permissions:
  contents: write

jobs:
  build:
    name: Build and publish unstable APK
    runs-on: ubuntu-latest
    env:
      SIGNING_KEYSTORE_BASE64: ${{ secrets.SIGNING_KEYSTORE_BASE64 }}
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 1, submodules: recursive }

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Decode signing keystore
        if: ${{ env.SIGNING_KEYSTORE_BASE64 != '' }}
        run: |
          printf '%s' "$SIGNING_KEYSTORE_BASE64" | tr -d '[:space:]' | base64 -d > "$RUNNER_TEMP/signing.keystore"
          if [ "$(head -c1 "$RUNNER_TEMP/signing.keystore" | od -An -tx1 | tr -d ' ')" != "30" ]; then
            echo "::error::SIGNING_KEYSTORE_BASE64 is invalid. Recreate it with: base64 -w0 signing.keystore"
            exit 1
          fi
          echo "SIGNING_KEYSTORE=$RUNNER_TEMP/signing.keystore" >> "$GITHUB_ENV"

      - name: Run checks
        run: |
          chmod +x gradlew
          bash .github/security/check-permissions.sh
          ./gradlew testUnstableDebugUnitTest lintUnstableDebug --no-daemon

      - name: Resolve unstable version
        id: version
        run: |
          chmod +x gradlew
          v=$(./gradlew -q printUnstableVersion -PunstableBuild=${{ github.run_number }} --no-daemon | tail -1)
          echo "value=$v" >> "$GITHUB_OUTPUT"

      - name: Build unstable release APK
        env:
          SIGNING_STORE_PASSWORD: ${{ secrets.SIGNING_STORE_PASSWORD }}
          SIGNING_KEY_ALIAS: ${{ secrets.SIGNING_KEY_ALIAS }}
          SIGNING_KEY_PASSWORD: ${{ secrets.SIGNING_KEY_PASSWORD }}
        run: ./gradlew assembleUnstableRelease -PunstableBuild=${{ github.run_number }} --no-daemon

      - name: Collect APK
        run: |
          mkdir -p dist
          # The release tag is the fixed string "unstable", so the version lives in the asset
          # name: the updater matches ".apk" + "unstable" and reads the version from it.
          find app/build/outputs/apk -name "EVABRPUploader-unstable.apk" \
            -exec cp {} "dist/EVABRPUploader-unstable-${{ steps.version.outputs.value }}.apk" \;
          ls -la dist/

      - name: Build timestamp
        id: date
        run: echo "value=$(date -u +'%Y-%m-%d %H:%M UTC')" >> "$GITHUB_OUTPUT"

      - name: Extract changelog
        id: changelog
        run: |
          {
            echo 'notes<<CHANGELOG_EOF'
            ./release-notes.sh --latest
            echo 'CHANGELOG_EOF'
          } >> "$GITHUB_OUTPUT"

      # One rolling pre-release: drop the previous release and its tag so the new one is
      # published at this commit instead of leaving the tag behind on the old sha.
      - name: Reset rolling unstable release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release delete unstable --cleanup-tag --yes || true

      - name: Publish pre-release
        uses: softprops/action-gh-release@v2
        with:
          # Fixed tag, overwritten on every build. The in-app updater no longer reads a
          # version from here — it reads it from the APK asset name.
          tag_name: unstable
          name: Unstable
          prerelease: true
          files: dist/*.apk
          body: |
            ## Unstable build ${{ steps.date.outputs.value }}

            Version `${{ steps.version.outputs.value }}` (run ${{ github.run_number }}).

            Automated build from `master`. **Not tested on a vehicle.**

            Installed unstable builds update themselves from this channel. The updater accepts
            an APK only over https from a GitHub host, and only if it is signed with the
            same certificate as the running app — otherwise it deletes the file.

            ### Changelog
            ${{ steps.changelog.outputs.notes }}

            Commit: ${{ github.sha }}