android-release.yml

name: treehouses remote release

on:
  workflow_dispatch:
  push:
    branches:
      - 'master'

jobs:
  apk:
    name: Release APK
    runs-on: ubuntu-latest
    env:
      ANDROID_NDK_VERSION: "21.3.6528147"
      BUILD_TOOLS_VERSION: "34.0.0"
    steps:
      - name: set more env
        env:
          NUM: ${{ github.run_number }}
        run: |
          echo "VERSION="$(($NUM+6047)) >> $GITHUB_ENV
          echo "BRANCH="${GITHUB_REF##*/} >> $GITHUB_ENV

      - name: checkout repository code
        uses: actions/checkout@v4

      - name: setup JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '17'
          cache: 'gradle'

      - name: install NDK
        run: |
          set -x
          echo "ANDROID_HOME is set to: ${ANDROID_HOME}"
          echo "ANDROID_SDK_ROOT is set to: ${ANDROID_SDK_ROOT}"
          echo "ANDROID_NDK_VERSION is set to: ${ANDROID_NDK_VERSION}"
          echo "y" | sudo ${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin/sdkmanager --install "ndk;${ANDROID_NDK_VERSION}" --sdk_root=${ANDROID_SDK_ROOT} 2>&1
          if [ $? -ne 0 ]; then
              echo "SDK Manager command failed"
              exit 1
          fi
          set +x
          chmod +x ./gradlew

      - name: build release APK and AAB
        run: |
          ./gradlew assembleRelease bundleRelease
          ls -alR app/build/outputs
          mkdir -p sign
          cp app/build/outputs/bundle/release/app-release.aab sign/.
          cp app/build/outputs/apk/release/remote-${{ env.VERSION }}.apk sign/app-release-unsigned.apk
          ls -al sign

      - name: sign release APK and AAB
        uses: dogi/sign-android-release@v5
        with:
          releaseDirectory: sign
          signingKeyBase64: ${{ secrets.SIGNING_KEY }}
          alias: ${{ secrets.ALIAS }}
          keyStorePassword: ${{ secrets.KEY_STORE_PASSWORD }}
          keyPassword: ${{ secrets.KEY_PASSWORD }}

      - name: copy builds to output and generate sha256
        run: |
          mkdir -p output
          cp sign/app-release-unsigned-signed.apk output/remote.apk
          cp sign/app-release.aab output/remote.aab
          sha256sum output/remote.apk > output/remote.apk.sha256
          sha256sum output/remote.aab > output/remote.aab.sha256
          ls -alR output

      - name: publish AAB to happy playstore
        if: github.ref == 'refs/heads/master'
        continue-on-error: true
        uses: dogi/upload-google-play@v1.1.3
        with:
          serviceAccountJsonPlainText: ${{ secrets.SERVICE_ACCOUNT_JSON }}
          packageName: io.treehouses.remote
          releaseFiles: output/remote.aab
          track: internal
          releaseName: "${{ env.VERSION }}"
          status: completed

      - name: publish AAB to unhappy playstore
        if: github.ref == 'refs/heads/master'
        continue-on-error: true
        uses: dogi/upload-google-play@v1.1.3
        with:
          serviceAccountJsonPlainText: ${{ secrets.SERVICE_ACCOUNT_JSON }}
          packageName: io.treehouses.remote
          releaseFiles: output/remote.aab
          track: internal
          releaseName: "${{ env.VERSION }}"
          status: completed
          changesNotSentForReview: true

#      - name: mobile security framework
#        run: |
#          docker pull opensecurity/mobile-security-framework-mobsf
#          docker run -itd -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest 
#          cd output
#          ls -al
#          wget http://localhost:8000/api_docs
#          MOBSF_API_KEY=$(grep 'Api Key' api_docs)
#          echo MOBSF_API_KEY
#          MOBSF_API_KEY=${MOBSF_API_KEY:42:64}
#          echo MOBSF_API_KEY
#          rm api_docs
#          HASH=$(md5sum remote.apk)
#          HASH=${HASH:0:32}
#          curl -F "file=@remote.apk" http://localhost:8000/api/v1/upload -H "Authorization:$MOBSF_API_KEY"
#          curl -X POST --url http://localhost:8000/api/v1/scan --data "scan_type=apk&file_name=remote.apk&hash=$HASH" -H "Authorization:$MOBSF_API_KEY"
#          curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=$HASH" -H "Authorization:$MOBSF_API_KEY" --output remote-${{ steps.version.outputs.id }}.pdf
#          ls -al

      - name: rename APK and AAB with version and branch for artifact
        if: github.ref != 'refs/heads/master'
        run: |
          mv output/remote.apk output/remote-${{ env.VERSION }}-${{ env.BRANCH }}.apk
          mv output/remote.apk.sha256 output/remote-${{ env.VERSION }}-${{ env.BRANCH }}.apk.sha256
          mv output/remote.aab output/remote-${{ env.VERSION }}-${{ env.BRANCH }}.aab
          mv output/remote.aab.sha256 output/remote-${{ env.VERSION }}-${{ env.BRANCH }}.aab.sha256
          #mv output/remote-${{ env.VERSION }}.pdf output/remote-${{ env.VERSION }}-${{ env.BRANCH }}.pdf
          #cp app/build/outputs/mapping/release/mapping.txt output/mapping.txt
          ls -alR output

      - name: upload APK and AAB as build artifact
        if: github.ref != 'refs/heads/master'
        uses: actions/upload-artifact@v4
        with:
          name: remote-${{ env.VERSION }}-${{ env.BRANCH }}
          path: output/*
          retention-days: 9

      - name: release APK and AAB on GitHub
        if: github.ref == 'refs/heads/master'
        uses: dogi/upload-release-action@v2.7.1
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: output/*
          tag: v${{ env.VERSION }}
          overwrite: true
          file_glob: true

      - name: send success message to discord
        if: github.ref == 'refs/heads/master'
        run: |
          sudo npm install -g @treehouses/cli
          export discord_channel="${{ secrets.CHANNEL }}" #remote
          echo "https://github.com/treehouses/remote/releases/tag/v${{ env.VERSION }}"
          treehouses feedback "new remote app: https://github.com/treehouses/remote/releases/tag/v${{ env.VERSION }}"