name: Android Release (Signed)

on:
  push:
    tags:
      - 'v*'

jobs:
  release:
    runs-on: android
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Setup Java 17
      run: |
        export JAVA_HOME=/usr/lib/jvm/java-17-openjdk
        export PATH=$JAVA_HOME/bin:$PATH
        echo '=== Java 环境 ==='
        java -version

    - name: Setup Keystore
      run: |
        echo '=== 配置签名证书 ==='
        mkdir -p app
        echo '${{ secrets.KEYSTORE_BASE64 }}' | base64 -d > app/release.keystore
        echo '证书已解压'
        ls -lh app/release.keystore

    - name: Setup Gradle Properties
      run: |
        echo '=== 创建 gradle.properties ==='
        echo 'android.aapt2FromMavenOverride=/usr/bin/aapt2' > gradle.properties
        echo 'org.gradle.daemon=false' >> gradle.properties
        echo 'org.gradle.jvmargs=-Xmx2g' >> gradle.properties
        echo 'org.gradle.java.home=/usr/lib/jvm/java-17-openjdk' >> gradle.properties
        echo 'android.useAndroidX=true' >> gradle.properties
        cat gradle.properties

    - name: Copy Signed build.gradle
      run: |
        echo '=== 复制签名版 build.gradle ==='
        cp .gitea/workflows/build.gradle.signed app/build.gradle
        echo '已复制'

    - name: Build Signed Release APK
      env:
        KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
        KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
      run: |
        echo '=== 编译签名 Release APK ==='
        export ANDROID_HOME=/opt/android-sdk
        export ANDROID_SDK_ROOT=$ANDROID_HOME
        export PATH=$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/platform-tools:$PATH
        
        gradle assembleRelease --no-daemon --stacktrace
        
        VERSION=${GITHUB_REF#refs/tags/}
        cp app/build/outputs/apk/release/app-release.apk app/build/outputs/apk/release/app-${VERSION}-signed.apk
        echo "APK_NAME=app-${VERSION}-signed.apk" >> $GITHUB_ENV
        
        echo ''
        echo '编译完成！'
        ls -lh app/build/outputs/apk/release/

    - name: Create Gitea Release
      run: |
        echo '=== 创建 Gitea Release ==='
        VERSION=${GITHUB_REF#refs/tags/}
        
        # 先检查 Release 是否已存在
        EXISTING=$(curl -s "https://gitea.kg8.net/api/v1/repos/${{ github.repository }}/releases/tags/$VERSION" \
          -H "Authorization: token ${{ secrets.ACTIONS_TOKEN }}")
        
        RELEASE_ID=$(echo "$EXISTING" | grep -o '"id":[0-9]*' | head -1 | cut -d':' -f2)
        
        if [ -n "$RELEASE_ID" ] && [ "$RELEASE_ID" != "null" ]; then
            echo "Release 已存在，ID: $RELEASE_ID"
        else
            echo '创建新 Release...'
            RESPONSE=$(curl -s -X POST \
              "https://gitea.kg8.net/api/v1/repos/${{ github.repository }}/releases" \
              -H "Authorization: token ${{ secrets.ACTIONS_TOKEN }}" \
              -H "Content-Type: application/json" \
              -d "{\"tag_name\":\"$VERSION\",\"name\":\"Release $VERSION\",\"body\":\"## 自动发布的签名版本\\n\\n- ✅ 已签名\\n- 🔐 开发者证书签名\",\"draft\":false,\"prerelease\":false}")
            
            RELEASE_ID=$(echo "$RESPONSE" | grep -o '"id":[0-9]*' | head -1 | cut -d':' -f2)
            echo "新 Release 创建成功，ID: $RELEASE_ID"
        fi
        
        echo "RELEASE_ID=$RELEASE_ID" >> $GITHUB_ENV
        echo "RELEASE_ID: $RELEASE_ID"

    - name: Upload Signed APK
      run: |
        echo '=== 上传签名 APK ==='
        echo "APK: ${{ env.APK_NAME }}"
        echo "Release ID: ${{ env.RELEASE_ID }}"
        
        # Gitea 上传 API: POST /repos/{owner}/{repo}/releases/{id}/assets
        # 注意：Gitea 只需要 attachment 参数，文件名从文件自动获取
        UPLOAD_RESPONSE=$(curl -s -X POST \
          "https://gitea.kg8.net/api/v1/repos/${{ github.repository }}/releases/${{ env.RELEASE_ID }}/assets" \
          -H "Authorization: token ${{ secrets.ACTIONS_TOKEN }}" \
          -F "attachment=@app/build/outputs/apk/release/${{ env.APK_NAME }}")
        
        echo "上传响应: $UPLOAD_RESPONSE"
        
        if echo "$UPLOAD_RESPONSE" | grep -q '"browser_download_url"'; then
            echo ''
            echo '✅ APK 上传成功！'
            echo "$UPLOAD_RESPONSE" | grep -o '"browser_download_url":"[^"]*"'
        else
            echo '❌ 上传失败'
            echo "$UPLOAD_RESPONSE"
            exit 1
        fi

    - name: Verify Signature
      run: |
        echo '=== 验证 APK 签名 ==='
        $ANDROID_HOME/build-tools/34.0.0/apksigner verify --print-certs \
          app/build/outputs/apk/release/${{ env.APK_NAME }} || true
        echo '验证完成'