release.yml

# Builds a release on a tag and attaches everything someone needs to trust it:
# the signed APK, both bills of materials, and the mapping file that turns a
# stack trace back into line numbers.
#
# Signing happens only when the repository holds the credentials. A fork without
# them still gets a working run and an unsigned APK, clearly labelled, rather
# than a red cross and a secrets error.
name: Release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          # The CycloneDX plugin reads the git remote for the BOM's VCS
          # reference, and a shallow clone leaves it without one.
          fetch-depth: 0

      - uses: gradle/actions/wrapper-validation@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - uses: android-actions/setup-android@v3

      - name: Install the Rust Android target
        run: rustup target add aarch64-linux-android

      - uses: gradle/actions/setup-gradle@v4

      - name: Restore the signing key
        id: signing
        if: env.KEYSTORE_BASE64 != ''
        env:
          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: |
          mkdir -p "$RUNNER_TEMP/keys"
          echo "$KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/keys/release.jks"
          cat > "$RUNNER_TEMP/keys/keystore.properties" <<EOF
          storeFile=$RUNNER_TEMP/keys/release.jks
          storePassword=$KEYSTORE_PASSWORD
          keyAlias=$KEY_ALIAS
          keyPassword=$KEY_PASSWORD
          EOF
          echo "UXSPACE_KEYSTORE_PROPERTIES=$RUNNER_TEMP/keys/keystore.properties" >> "$GITHUB_ENV"
          echo "signed=true" >> "$GITHUB_OUTPUT"

      - name: Assemble
        working-directory: Android
        run: ./gradlew assembleRelease

      - name: Test
        working-directory: Android
        run: ./gradlew test

      - name: Bill of materials
        working-directory: Android
        run: |
          ./gradlew :app:cyclonedxBom
          curl -fsSL -o /tmp/cyclonedx \
            https://github.com/CycloneDX/cyclonedx-cli/releases/latest/download/cyclonedx-linux-x64
          chmod +x /tmp/cyclonedx
          sudo mv /tmp/cyclonedx /usr/local/bin/cyclonedx
          python3 tools/make_sbom.py
          cyclonedx validate \
            --input-file build/sbom/uxspace-bom.json \
            --input-format json --input-version v1_6 --fail-on-errors

      - name: Verify the APK carries the open driver
        working-directory: Android
        run: |
          unzip -l app/build/outputs/apk/release/*.apk | grep -q libviture_v2.so
          ! unzip -l app/build/outputs/apk/release/*.apk | grep -qi 'vituresdk\|libviture\.so'

      - name: Publish
        uses: softprops/action-gh-release@v2
        with:
          draft: true
          generate_release_notes: true
          files: |
            Android/app/build/outputs/apk/release/*.apk
            Android/build/sbom/uxspace-bom.json
            Android/build/sbom/uxspace-bom.spdx.json
            Android/app/build/outputs/mapping/release/mapping.txt
            THIRD-PARTY-NOTICES.md
          body: |
            ${{ steps.signing.outputs.signed == 'true'
                && 'Signed release APK.'
                || '**Unsigned** — built without signing credentials.' }}

            Attached: the APK, a CycloneDX 1.6 and an SPDX-2.3 bill of materials
            covering both the Gradle graph and the Rust driver, the R8 mapping
            file, and the third-party notices.

            Verify:

            ```sh
            apksigner verify --print-certs app-release.apk
            cyclonedx validate --input-file uxspace-bom.json \
                               --input-format json --input-version v1_6 --fail-on-errors
            ```