release.yml

# You'll need to setup the follwing environment variables:
#   secrets.REPO_TOKEN - A GitHub token with permissions to push and publish releases to the repo

name: Release builds (APK/EXE/DMG/DEB)

on:
  workflow_dispatch:
    inputs:
      title:
        description: 'Title to assign to the release'
        required: true
        type: string

      tag:
        description: 'Tag to assign to the release source code'
        required: true
        type: string

      generate_release_notes:
        description: 'Generate release notes?'
        required: true
        type: boolean


jobs:
  desktop:
    name: Tauri desktop build (${{ matrix.os }})
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node
        uses: actions/setup-node@v5
        with:
          node-version-file: '.nvmrc'
          cache: 'yarn'

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Build desktop bundles (Tauri)
        uses: tauri-apps/tauri-action@v0
        with:
          tauriScript: yarn tauri:build

      - name: Upload desktop artifacts
        uses: actions/upload-artifact@v4
        with:
          name: betaflight-desktop-${{ matrix.os }}
          path: |
            src-tauri/target/release/bundle/**/*.deb
            src-tauri/target/release/bundle/**/*.AppImage
            src-tauri/target/release/bundle/**/*.dmg
            src-tauri/target/release/bundle/**/*.msi
            src-tauri/target/release/bundle/**/*.exe
          if-no-files-found: warn
          retention-days: 30

  android:
    name: Android APK (Tauri)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node
        uses: actions/setup-node@v5
        with:
          node-version-file: '.nvmrc'
          cache: 'yarn'

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3

      - name: Setup Java 21
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '21'

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          workspaces: src-tauri

      - name: Cache Gradle
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Ensure JitPack repository (for usb-serial-for-android)
        shell: bash
        run: |
          set -euo pipefail
          FILE="src-tauri/gen/android/build.gradle.kts"
          if [ -f "$FILE" ]; then
            echo "Ensuring JitPack repository is present in $FILE"
            if ! grep -q 'jitpack.io' "$FILE"; then
              printf '\nallprojects {\n    repositories {\n        maven(url = "https://jitpack.io")\n    }\n}\n' >> "$FILE"
            fi
            grep -n "jitpack.io" "$FILE" || true
          else
            echo "Warning: $FILE not found (will be generated by Tauri on first build)."
          fi

      - name: Build Android release (unsigned)
        run: |
          yarn tauri:build:android

      - name: Setup release keystore (if available)
        if: ${{ secrets.ANDROID_KEYSTORE_BASE64 != '' }}
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        shell: bash
        run: |
          set -euo pipefail
          echo "Setting up release keystore from secrets"
          echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > release.keystore
          echo "KEYSTORE_PATH=$(pwd)/release.keystore" >> $GITHUB_ENV
          echo "KEYSTORE_PASSWORD=$ANDROID_KEYSTORE_PASSWORD" >> $GITHUB_ENV
          echo "KEY_ALIAS=$ANDROID_KEY_ALIAS" >> $GITHUB_ENV
          echo "KEY_PASSWORD=$ANDROID_KEY_PASSWORD" >> $GITHUB_ENV

      - name: Sign APK/AAB (release or debug)
        shell: bash
        run: |
          set -euo pipefail
          
          # Determine signing configuration
          if [ -f "release.keystore" ]; then
            echo "Using release keystore for signing"
            KEYSTORE="release.keystore"
            STORE_PASS="${KEYSTORE_PASSWORD}"
            KEY_ALIAS="${KEY_ALIAS}"
            KEY_PASS="${KEY_PASSWORD}"
            SUFFIX="release-signed"
          else
            echo "No release keystore found - using debug keystore"
            mkdir -p "${HOME}/.android"
            KEYSTORE="${HOME}/.android/debug.keystore"
            if [ ! -f "$KEYSTORE" ]; then
              echo "Generating debug keystore"
              keytool -genkeypair -v \
                -keystore "$KEYSTORE" \
                -storepass android \
                -alias androiddebugkey \
                -keypass android \
                -keyalg RSA \
                -keysize 2048 \
                -validity 10000 \
                -dname "CN=Android Debug,O=Android,C=US"
            fi
            STORE_PASS="android"
            KEY_ALIAS="androiddebugkey"
            KEY_PASS="android"
            SUFFIX="debug-signed"
          fi
          
          # Sign APK
          UNSIGNED_APK=$(find src-tauri/gen/android/app/build/outputs/apk -name "*-unsigned.apk" | head -1)
          if [ -n "$UNSIGNED_APK" ]; then
            echo "Signing APK: $UNSIGNED_APK"
            SIGNED_APK="${UNSIGNED_APK%-unsigned.apk}-${SUFFIX}.apk"
            ALIGNED_APK="${UNSIGNED_APK%-unsigned.apk}-aligned.apk"
            
            # First zipalign the unsigned APK
            echo "Zipaligning APK..."
            BUILD_TOOLS_VERSION=$(ls ${ANDROID_HOME}/build-tools | tail -1)
            ${ANDROID_HOME}/build-tools/${BUILD_TOOLS_VERSION}/zipalign -v -p 4 "$UNSIGNED_APK" "$ALIGNED_APK"

            # Then sign the aligned APK with v2/v3 signatures using apksigner
            echo "Signing aligned APK..."
            ${ANDROID_HOME}/build-tools/${BUILD_TOOLS_VERSION}/apksigner sign \
              --ks "$KEYSTORE" \
              --ks-key-alias "$KEY_ALIAS" \
              --ks-pass pass:"$STORE_PASS" \
              --key-pass pass:"$KEY_PASS" \
              --v1-signing-enabled true \
              --out "$SIGNED_APK" \
              "$ALIGNED_APK"
            echo "Signed APK created: $SIGNED_APK"
            ls -lh "$SIGNED_APK"
            
            # Verify the signature
            ${ANDROID_HOME}/build-tools/${BUILD_TOOLS_VERSION}/apksigner verify --verbose --print-certs "$SIGNED_APK"
          else
            echo "Warning: No unsigned APK found"
          fi
          
          # Sign AAB (if release keystore available)
          if [ -f "release.keystore" ]; then
            UNSIGNED_AAB=$(find src-tauri/gen/android/app/build/outputs/bundle -name "*.aab" | head -1)
            if [ -n "$UNSIGNED_AAB" ]; then
              echo "Signing AAB: $UNSIGNED_AAB"
              SIGNED_AAB="${UNSIGNED_AAB%.aab}-signed.aab"
              jarsigner -verbose -sigalg SHA256withRSA -digestalg SHA-256 \
                -keystore "$KEYSTORE" \
                -storepass "$STORE_PASS" \
                -keypass "$KEY_PASS" \
                "$UNSIGNED_AAB" \
                "$KEY_ALIAS"
              mv "$UNSIGNED_AAB" "$SIGNED_AAB"
              echo "Signed AAB created: $SIGNED_AAB"
              ls -lh "$SIGNED_AAB"
            fi
          fi

      - name: Upload APK/AAB artifacts
        uses: actions/upload-artifact@v4
        with:
          name: betaflight-android
          path: |
            src-tauri/gen/android/app/build/outputs/apk/universal/release/*-signed.apk
            src-tauri/gen/android/app/build/outputs/bundle/universalRelease/*-signed.aab
          if-no-files-found: warn
          retention-days: 30

  publish:
    name: Create GitHub Release
    needs: [desktop, android]
    runs-on: ubuntu-latest
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v5
        with:
          path: release-assets/

      - name: Release
        uses: softprops/action-gh-release@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          name: ${{ github.event.inputs.title }}
          tag_name: ${{ github.event.inputs.tag }}
          generate_release_notes: ${{ github.event.inputs.generate_release_notes }}
          files: release-assets/**
          draft: true
          prerelease: false
          fail_on_unmatched_files: false