android.yml

name: Build Android

permissions:
  contents: read
  pull-requests: write
  
on: 
  workflow_dispatch:
  workflow_call:

  push:
    branches:
      - master
      - main

  pull_request:
    branches:
      - master
      - main

env:
  # NOTE: secrets are only provided in original repo, ideal for conditional logic in forks
  ANDROID_CERTIFICATE_BASE64: ${{ secrets.ANDROID_CERTIFICATE_BASE64 }}
  ANDROID_PRIVATE_KEY_BASE64: ${{ secrets.ANDROID_PRIVATE_KEY_BASE64 }}


jobs:
  build-apk:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: 'recursive'

      - name: Install Qt
        uses: jurplel/install-qt-action@v4
        with:
          aqtversion: '==3.3.*'
          version: '5.14.2'
          host: 'linux'
          target: 'android'
          arch: 'android'

      - name: Install SDK
        run: ${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin/sdkmanager --install 'platforms;android-31' 'build-tools;31.0.0' 'ndk;21.3.6528147'

      # Secrets should be the base64 portion of the PEM format
      # (i.e. the stuff between the BEGIN/END lines):
      #
      # -----BEGIN CERTIFICATE-----
      # ... base64-encoded X.509 certificate ...
      # -----END CERTIFICATE-----
      #
      # -----BEGIN PRIVATE KEY-----
      # ... base64-encoded PKCS#8 private key ...
      # -----END PRIVATE KEY-----
      #
      # These can be extracted from a PKCS#12 .keystore file using:
      # openssl pkcs12 -in path/to/.keystore -info -noenc

      - name: Install certificate and private key
        if: env.ANDROID_PRIVATE_KEY_BASE64 != '' && env.ANDROID_CERTIFICATE_BASE64 != ''
        working-directory: Desktop_Interface
        run: |
          echo "$ANDROID_CERTIFICATE_BASE64" | base64 --decode > cert.cer
          echo "$ANDROID_PRIVATE_KEY_BASE64" | base64 --decode > cert.p8

      # The .apk must be signed to be useful.  If the previous step
      # was unsuccessful or skipped, build a debug package which will
      # be signed with debug keys.

      - name: Build Android package
        working-directory: Desktop_Interface
        run: |
          export ANDROID_NDK_ROOT="${ANDROID_SDK_ROOT}/ndk/21.3.6528147"
          APK_BASENAME="Labrador-$(git rev-parse --short HEAD)"
          if [ -e cert.cer ] && [ -e cert.p8 ]; then
            qmake -config release
            make -j$(nproc)
            make INSTALL_ROOT=android-build install
            JAVA_HOME=${JAVA_HOME_8_X64} androiddeployqt --input android-Labrador-deployment-settings.json --output android-build --aab --android-platform android-31 --verbose --gradle --release
            ${ANDROID_SDK_ROOT}/build-tools/31.0.0/apksigner sign --in android-build/build/outputs/apk/release/android-build-release-unsigned.apk --out ${APK_BASENAME}-release-signed.apk --key cert.p8 --cert cert.cer --verbose
          else
            qmake -config debug
            make -j$(nproc)
            make INSTALL_ROOT=android-build install
            JAVA_HOME=${JAVA_HOME_8_X64} androiddeployqt --input android-Labrador-deployment-settings.json --output android-build --aab --android-platform android-31 --verbose --gradle
            cp android-build/build/outputs/apk/debug/android-build-debug.apk ${APK_BASENAME}-debug.apk
          fi
          cp android-build/build/outputs/bundle/release/android-build-release.aab ${APK_BASENAME}-release-unsigned.aab

      - name: Upload apk artifacts
        uses: actions/upload-artifact@v4
        with:
          name: asset-apk
          path: Desktop_Interface/Labrador*.apk
          compression-level: 0
          if-no-files-found: error
      - name: Upload aab artifacts
        uses: actions/upload-artifact@v4
        with:
          name: asset-aab
          path: Desktop_Interface/Labrador*.aab
          compression-level: 0
          if-no-files-found: error