name: Android Release (Signed)

on:
  push:
    tags:
      - 'v*'

jobs:
  release:
    runs-on: android
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Setup Java 17
      run: |
        export JAVA_HOME=/usr/lib/jvm/java-21-openjdk
        export PATH=$JAVA_HOME/bin:$PATH
        echo '=== Java 环境 ==='
        java -version

    - name: Setup Keystore
      run: |
        echo '=== 配置签名证书 ==='
        mkdir -p app
        echo '${{ secrets.KEYSTORE_BASE64 }}' | base64 -d > app/release.keystore
        echo '✅ 证书已解压'
        ls -lh app/release.keystore

    - name: Build Signed Release APK
      env:
        KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
        KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
      run: |
        echo '=== 编译签名 Release APK ==='
        export ANDROID_HOME=/opt/android-sdk
        export ANDROID_SDK_ROOT=$ANDROID_HOME
        export PATH=$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/platform-tools:$PATH
        export CUSTOM_AAPT2_PATH=/usr/bin/aapt2
        
        # 创建 gradle.properties
        cat >> gradle.properties << EOF
android.aapt2FromMavenOverride=$CUSTOM_AAPT2_PATH
org.gradle.daemon=false
org.gradle.jvmargs=-Xmx2g
EOF
        
        # 创建签名配置
        cat > app/signing-config.gradle << 'EOF'
android {
    signingConfigs {
        release {
            storeFile file('release.keystore')
            storePassword System.getenv('KEYSTORE_PASSWORD')
            keyAlias System.getenv('KEY_ALIAS')
            keyPassword System.getenv('KEY_PASSWORD')
            v1SigningEnabled true
            v2SigningEnabled true
        }
    }
    buildTypes {
        release {
            signingConfig signingConfigs.release
            minifyEnabled false
            shrinkResources false
        }
    }
}
EOF
        
        # 在 app/build.gradle 中应用签名配置（如果还没有）
        if ! grep -q 'signing-config.gradle' app/build.gradle; then
            sed -i '1i apply from: '"'"'signing-config.gradle'"'"'' app/build.gradle
        fi
        
        echo '开始编译...'
        gradle assembleRelease --no-daemon --stacktrace
        
        # 重命名 APK
        VERSION=${GITHUB_REF#refs/tags/}
        cp app/build/outputs/apk/release/app-release.apk app/build/outputs/apk/release/app-${VERSION}-signed.apk
        echo 'APK_NAME=app-'"${VERSION}"'-signed.apk' >> $GITHUB_ENV
        
        echo ''
        echo '✅ 编译完成！'
        ls -lh app/build/outputs/apk/release/

    - name: Create Gitea Release
      id: create_release
      run: |
        echo '=== 创建 Gitea Release ==='
        VERSION=${GITHUB_REF#refs/tags/}
        
        RESPONSE=$(curl -s -X POST \
          'https://gitea.kg8.net/api/v1/repos/${{ github.repository }}/releases' \
          -H 'Authorization: token ${{ secrets.ACTIONS_TOKEN }}' \
          -H 'Content-Type: application/json' \
          -d "{
            \\\"tag_name\\\": \\\"$VERSION\\\",
            \\\"name\\\": \\\"Release $VERSION\\\",
            \\\"body\\\": \\\"## 自动发布的签名版本\\n\\n- ✅ 已签名，可安装到真机\\n- 🔐 使用开发者证书签名\\n- 🚀 自动编译\\\",
            \\\"draft\\\": false,
            \\\"prerelease\\\": false
          }")
        
        UPLOAD_URL=$(echo "$RESPONSE" | grep -o '"upload_url":"[^"]*' | cut -d'"' -f4)
        
        if [ -n "$UPLOAD_URL" ]; then
            echo "UPLOAD_URL=$UPLOAD_URL" >> $GITHUB_ENV
            echo '✅ Release 创建成功'
        else
            echo '❌ 创建 Release 失败'
            echo "响应：$RESPONSE"
            exit 1
        fi

    - name: Upload Signed APK
      run: |
        echo '=== 上传签名 APK ==='
        echo 'APK: ${{ env.APK_NAME }}'
        echo 'Upload URL: ${{ env.UPLOAD_URL }}'
        
        curl -s -X POST '${{ env.UPLOAD_URL }}?name=${{ env.APK_NAME }}' \
          -H 'Authorization: token ${{ secrets.ACTIONS_TOKEN }}' \
          -H 'Content-Type: application/vnd.android.package-archive' \
          --data-binary '@app/build/outputs/apk/release/${{ env.APK_NAME }}'
        
        echo ''
        echo '✅ APK 上传成功！'

    - name: Verify Signature
      run: |
        echo '=== 验证 APK 签名 ==='
        $ANDROID_HOME/build-tools/34.0.0/apksigner verify --print-certs \
          app/build/outputs/apk/release/${{ env.APK_NAME }}
        
        echo ''
        echo '✅ 签名验证通过！此 APK 可以安装到真机。'