android.yml

name: "Reusable android workflow"

on:
  workflow_call:
    inputs:
      publish:
        required: false
        type: boolean
    secrets:
      ANDROID_RELEASE_KEYSTORE:
        required: false
      ANDROID_RELEASE_KEYSTORE_PASSWORD:
        required: false
      ANDROID_RELEASE_KEY:
        required: false
      ANDROID_RELEASE_KEY_PASSWORD:
        required: false

jobs:
  build:
    runs-on: ubuntu-latest
    name: "📦"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        name: 🔄 Checkout

      - name: ☕ Setup Java
        uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4
        with:
          distribution: "zulu"
          java-version: "17"

      - name: 🤖 Setup Android SDK
        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3

      - name: 🛠️ Install NDK
        run: sdkmanager "ndk;27.0.11902837"

      - name: 🦀 Install rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android,wasm32-unknown-unknown

      - name: 📝 Check spelling using typos-action
        uses: crate-ci/typos@2872c382bb9668d4baa5eade234dcbc0048ca2cf # v1.28.2

      - name: 📥 Cached install trunk
        uses: taiki-e/cache-cargo-install-action@caa6f48d18d42462f9c30df89e2b4f71a42b7c2c # v2.0.1
        with:
          tool: trunk@0.21.4
          locked: true

      - name: 📥 Cached install cargo-auditable
        uses: taiki-e/cache-cargo-install-action@caa6f48d18d42462f9c30df89e2b4f71a42b7c2c # v2.0.1
        with:
          tool: cargo-auditable@0.6.6
          locked: true

      - name: 📥 Cached install tauri-cli
        uses: taiki-e/cache-cargo-install-action@caa6f48d18d42462f9c30df89e2b4f71a42b7c2c # v2.0.1
        with:
          tool: tauri-cli@2.1.0
          locked: true

      - name: 🔨 Build app bundle
        run: |
          cargo --locked auditable tauri android init
          cp -a src-tauri/icons/android/mipmap-* src-tauri/gen/android/app/src/main/res/
          cargo --locked auditable tauri android build
        env:
          NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/27.0.11902837
          RUSTFLAGS: "-D warnings"

      - name: 🔑 Extract android signing key from env (publish only)
        run: |
          echo "${{ secrets.ANDROID_RELEASE_KEYSTORE }}" > src-tauri/gen/android/release.jks.base64
          base64 -d src-tauri/gen/android/release.jks.base64 > src-tauri/gen/android/release.decrypted.jks

      - name: 🔏 Sign APK
        run: |
          ${{ env.ANDROID_HOME }}/build-tools/34.0.0/apksigner sign --ks src-tauri/gen/android/release.decrypted.jks \
            --ks-key-alias ${{ secrets.ANDROID_RELEASE_KEY }} \
            --ks-pass pass:${{ secrets.ANDROID_RELEASE_KEYSTORE_PASSWORD }} \
            --key-pass pass:${{ secrets.ANDROID_RELEASE_KEY_PASSWORD }} \
            --out src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release-signed.apk \
            src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release-unsigned.apk

      - name: 📤 Upload build artifacts (push or pr builds only)
        if: (!inputs.publish)
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: "signed-apk"
          path: |
            src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release-signed.apk

      - name: 📝 Extract version from tauri.android.conf.json (publish only)
        if: inputs.publish
        id: get-version
        run: |
          CURRENT_VERSION=$(jq -r '.version' src-tauri/tauri.android.conf.json)
          echo "current-version=$CURRENT_VERSION" >> "$GITHUB_OUTPUT"

      - name: ✏️  Rename APK file (publish only)
        if: inputs.publish
        run: |
          mv ./src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release-signed.apk ./src-tauri/gen/android/app/build/outputs/apk/universal/release/mdns-browser_${{ steps.get-version.outputs.current-version }}.apk

      - name: 🚀 Publish (publish only)
        if: inputs.publish
        uses: softprops/action-gh-release@e7a8f85e1c67a31e6ed99a94b41bd0b71bbee6b8 # v2
        with:
          name: mDNS-Browser Release v${{ steps.get-version.outputs.current-version }}
          append_body: true
          make_latest: false
          generate_release_notes: false
          files: |
            src-tauri/gen/android/app/build/outputs/apk/universal/release/mdns-browser_${{ steps.get-version.outputs.current-version }}.apk

      - name: 🛡️ Attest build provenance (publish only)
        if: inputs.publish
        uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0.0
        with:
          subject-path: |
            src-tauri/gen/android/app/build/outputs/apk/universal/release/mdns-browser_${{ steps.get-version.outputs.current-version }}.apk

  retry-on-failure:
    if: failure() && fromJSON(github.run_attempt) < 3
    needs: [build]
    runs-on: ubuntu-latest
    steps:
      - env:
          GH_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ github.token }}
        run: gh workflow run retry-workflow.yml -F run_id=${{ github.run_id }}