android.yml

name: Android CI

on:
  push:
    branches:
      - development
      - master
      - internal-testing/**
  workflow_dispatch:

env:
  KEYSTORE_FILE: keystore-qrbarcode.jks
  GOOGLE_PLAY_JSON: qrbarcode-8b0b8-aaefa03b2374.json
  KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
  KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
  KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
  FIREBASE_APP_ID: ${{ secrets.FIREBASE_APP_ID }}
  FIREBASE_TOKEN: ${{ secrets.FIREBASE_TOKEN }}

jobs:
  setup:
    name: Setup Environment
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 1
          persist-credentials: false

      - name: Setup JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3

      - name: Setup Ruby & Dependencies
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.1'
          bundler-cache: true

      - name: Cache Ruby Gems
        uses: actions/cache@v4
        with:
          path: vendor/bundle
          key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}

      - name: Install Ruby Dependencies
        run: |
          bundle config set path 'vendor/bundle'
          bundle install

      - name: Decode Keystore File
        run: echo "${{ secrets.KEYSTORE_FILE }}" | base64 -d > ${{ env.KEYSTORE_FILE }}

      - name: Create Google Service Account JSON
        run: echo "${{ secrets.GOOGLE_PLAY_JSON }}" | base64 -d > app/${{ env.GOOGLE_PLAY_JSON }}

  build:
    name: Build AAB
    runs-on: ubuntu-latest
    needs: setup

    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 1

      - name: Setup JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Setup Ruby & Dependencies
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.1'
          bundler-cache: true

      - uses: actions/cache@v4
        with:
          path: vendor/bundle
          key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}

      - uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}

      - name: Install Ruby Dependencies
        run: |
          bundle config set path 'vendor/bundle'
          bundle install

      # 🔐 Decode secrets (runtime only)
      - name: Decode Keystore File
        run: echo "${{ secrets.KEYSTORE_FILE }}" | base64 -d > ${{ env.KEYSTORE_FILE }}

      - name: Create Google Service Account JSON
        run: echo "${{ secrets.GOOGLE_PLAY_JSON }}" | base64 -d > app/${{ env.GOOGLE_PLAY_JSON }}

      - name: Write local.properties
        run: |
          echo "sdk.dir=$ANDROID_HOME" > local.properties
          echo "KEYSTORE_FILE=${{ github.workspace }}/${{ env.KEYSTORE_FILE }}" >> local.properties
          echo "KEYSTORE_PASSWORD=${{ env.KEYSTORE_PASSWORD }}" >> local.properties
          echo "KEY_ALIAS=${{ env.KEY_ALIAS }}" >> local.properties
          echo "KEY_PASSWORD=${{ env.KEY_PASSWORD }}" >> local.properties

      - name: Grant gradlew permission
        run: chmod +x ./gradlew

      - name: Build AAB via Fastlane
        run: bundle exec fastlane buildBundle

      # 📦 ONLY BUILD OUTPUT
      - uses: actions/upload-artifact@v4
        with:
          name: release-aab
          path: app/build/outputs/bundle/release/*.aab

      # 🧹 Cleanup
      - name: Cleanup secrets
        if: always()
        run: |
          rm -f ${{ env.KEYSTORE_FILE }}
          rm -f app/${{ env.GOOGLE_PLAY_JSON }}
          rm -f local.properties

  unit-test:
    name: Unit Tests
    runs-on: ubuntu-latest
    needs: setup

    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 1

      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.1'
          bundler-cache: true

      - uses: actions/cache@v4
        with:
          path: vendor/bundle
          key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}

      - uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}

      - run: |
          bundle config set path 'vendor/bundle'
          bundle install
          bundle update fastlane

      - run: chmod +x ./gradlew

      - run: bundle exec fastlane test

  code-analysis:
    name: Lint & Check
    runs-on: ubuntu-latest
    needs: setup

    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 1

      - uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'

      - run: chmod +x ./gradlew
      - run: ./gradlew clean check

      - uses: actions/upload-artifact@v4
        with:
          name: lint-reports
          path: |
            app/build/reports/**/*.html
            app/build/intermediates/lint_intermediate_text_report/**/*.txt
            app/build/reports/lint-baseline.xml

  deploy-release:
    name: Deploy to Play Store (Production)
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/master'
    needs: build

    steps:
      - uses: actions/checkout@v3

      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.1'
          bundler-cache: true

      - uses: actions/cache@v4
        with:
          path: vendor/bundle
          key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}

      - uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}

      - run: |
          bundle config set path 'vendor/bundle'
          bundle install

      - name: Create Google Service Account JSON
        run: echo "${{ secrets.GOOGLE_PLAY_JSON }}" | base64 -d > app/${{ env.GOOGLE_PLAY_JSON }}

      - name: Download built AAB
        uses: actions/download-artifact@v4
        with:
          name: release-aab
          path: app/build/outputs/bundle/release

      - run: bundle exec fastlane deployRelease

  deploy-beta:
    name: Deploy to Play Store (Beta)
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/development'
    needs: build

    steps:
      - uses: actions/checkout@v3

      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.1'
          bundler-cache: true

      - uses: actions/cache@v4
        with:
          path: vendor/bundle
          key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}

      - uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}

      - run: |
          bundle config set path 'vendor/bundle'
          bundle install

      - name: Download built AAB
        uses: actions/download-artifact@v4
        with:
          name: release-aab
          path: app/build/outputs/bundle/release

      - run: bundle exec fastlane deployBeta

  deploy-firebase-internal:
    name: Distribute via Firebase (Internal)
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/heads/internal-testing/')
    needs: build

    steps:
      - uses: actions/checkout@v3

      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.1'
          bundler-cache: true

      - uses: actions/cache@v4
        with:
          path: vendor/bundle
          key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}

      - uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}

      - run: |
          bundle config set path 'vendor/bundle'
          bundle install

      - name: Download built AAB
        uses: actions/download-artifact@v4
        with:
          name: release-aab
          path: app/build/outputs/bundle/release

      - run: bundle exec fastlane deployFirebase --verbose