kryz-go-flutter/.gitea/workflows/release.yml

# kryz-go-flutter Release Pipeline
# Triggers on version tags (v1.0.0, v1.0.1, etc.)
# Produces signed artifacts and attaches them to a Gitea Release

name: Release

on:
  push:
    tags:
      - "v*"

env:
  FLUTTER_VERSION: "3.41.x"

jobs:
  # ── Lint (gate) ─────────────────────────────────────────────
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          cache: true

      - name: Install dependencies
        run: flutter pub get

      - name: Generate stubs (lint gate support)
        if: hashFiles('theme.json') == ''
        run: python3 ci_stub_gen.py

      - name: Analyze Dart code
        run: flutter analyze --fatal-warnings

      - name: Check formatting
        run: dart format --set-exit-if-changed lib/ test/


  # ── Test (gate) ──────────────────────────────────────────────────
  test:
    name: Test
    runs-on: ubuntu-latest
    needs: [lint]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          cache: true

      - name: Install dependencies
        run: flutter pub get

      - name: Generate stubs (lint gate support)
        run: python3 ci_stub_gen.py

      - name: Run tests
        run: flutter test --reporter=expanded


  # ── Android release build ───────────────────────────────────
  build-android:
    name: Build Android Release
    runs-on: ubuntu-latest
    needs: [test]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Java 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"
          cache: gradle

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          cache: true

      - name: Pre-cache Android platform artifacts
        run: flutter precache --android

      - name: Accept Android SDK licenses
        run: |
          yes | sdkmanager --licenses || true

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install Python dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt

      - name: Install Flutter dependencies
        run: flutter pub get

      - name: Generate stubs (lint gate support)
        run: python3 ci_stub_gen.py

      # If release signing secrets are available, write keystore
      # and update build.gradle.kts to use a release signing config.
      # Otherwise fall back to debug keys (current state of the repo).
      - name: Configure release signing
        if: env.ANDROID_KEYSTORE_BASE64 != ''
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEYSTORE_PASS: ${{ secrets.ANDROID_KEYSTORE_PASS }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASS: ${{ secrets.ANDROID_KEY_PASS }}
        run: |
          echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > android/app/release.keystore
          cat > android/key.properties <<EOF
          storePassword=$ANDROID_KEYSTORE_PASS
          keyPassword=$ANDROID_KEY_PASS
          keyAlias=$ANDROID_KEY_ALIAS
          storeFile=../release.keystore
          EOF

      - name: Build APK (release)
        run: flutter build apk --release

      - name: Build App Bundle (release)
        run: flutter build appbundle --release

      - name: List build outputs
        run: |
          echo "=== APK output ==="
          ls -lh build/app/outputs/flutter-apk/ || true
          echo "=== AAB output ==="
          ls -lh build/app/outputs/bundle/release/ || true

      - name: Upload APK artifact
        uses: actions/upload-artifact@v4
        with:
          name: release-android-apk
          path: build/app/outputs/flutter-apk/app-release.apk
          retention-days: 90

      - name: Upload AAB artifact
        uses: actions/upload-artifact@v4
        with:
          name: release-android-aab
          path: build/app/outputs/bundle/release/app-release.aab
          retention-days: 90


  # ── iOS release build ───────────────────────────────────────
  # Note: requires a macOS runner. Uses 'self-hosted' label which
  # matches our Gitea Actions runner. Falls back to --no-codesign
  # if Apple signing secrets are not configured.
  build-ios:
    name: Build iOS Release
    runs-on: self-hosted
    needs: [test]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ env.FLUTTER_VERSION }}
          cache: true

      - name: Install dependencies
        run: flutter pub get

      - name: Install CocoaPods dependencies
        run: cd ios && pod install --repo-update

      # Configure Apple signing if secrets are available
      - name: Install Apple certificate
        if: env.APPLE_CERTIFICATE_P12 != ''
        env:
          APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
          APPLE_CERTIFICATE_PASS: ${{ secrets.APPLE_CERTIFICATE_PASS }}
          APPLE_PROVISION_PROFILE: ${{ secrets.APPLE_PROVISION_PROFILE }}
        run: |
          KEYCHAIN_PATH=$RUNNER_TEMP/build.keychain
          CERTIFICATE_PATH=$RUNNER_TEMP/certificate.p12
          PROVISION_PATH=$RUNNER_TEMP/profile.mobileprovision

          echo "$APPLE_CERTIFICATE_P12" | base64 -d > "$CERTIFICATE_PATH"
          echo "$APPLE_PROVISION_PROFILE" | base64 -d > "$PROVISION_PATH"

          security create-keychain -p "" "$KEYCHAIN_PATH"
          security default-keychain -s "$KEYCHAIN_PATH"
          security unlock-keychain -p "" "$KEYCHAIN_PATH"
          security set-keychain-settings -t 3600 -l "$KEYCHAIN_PATH"
          security import "$CERTIFICATE_PATH" -P "$APPLE_CERTIFICATE_PASS" \
            -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
          security set-key-partition-list -S apple-tool:,apple: -k "" "$KEYCHAIN_PATH"

          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
          cp "$PROVISION_PATH" ~/Library/MobileDevice/Provisioning\ Profiles/

      - name: Build iOS (release)
        if: env.APPLE_CERTIFICATE_P12 != ''
        run: flutter build ios --release

      - name: Build iOS (release, no-codesign)
        if: env.APPLE_CERTIFICATE_P12 == ''
        run: flutter build ios --release --no-codesign

      - name: Upload iOS artifact
        uses: actions/upload-artifact@v4
        with:
          name: release-ios-app
          path: build/ios/iphoneos/
          retention-days: 90


  # ── Publish Gitea Release ────────────────────────────────────
  publish-release:
    name: Publish Release
    runs-on: ubuntu-latest
    needs: [build-android, build-ios]
    steps:
      - name: Download Android APK
        uses: actions/download-artifact@v4
        with:
          name: release-android-apk

      - name: Download Android AAB
        uses: actions/download-artifact@v4
        with:
          name: release-android-aab

      - name: Create Gitea Release
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          TAG: ${{ gitea.ref_name }}
          GITEA_BASE: https://git.westerntechnologies.duckdns.org
        run: |
          curl -s -X POST \
            -H "Authorization: token $GITEA_TOKEN" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\": \"$TAG\", \"name\": \"$TAG\", \"body\": \"Automated release build for $TAG\"}" \
            "$GITEA_BASE/api/v1/repos/kfj001/kryz-go-flutter/releases"

      - name: Upload APK to Release
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          TAG: ${{ gitea.ref_name }}
          GITEA_BASE: https://git.westerntechnologies.duckdns.org
        run: |
          curl -s -X POST \
            -H "Authorization: token $GITEA_TOKEN" \
            -H "Content-Type: application/vnd.android.package-archive" \
            --data-binary @app-release.apk \
            "$GITEA_BASE/api/v1/repos/kfj001/kryz-go-flutter/releases/assets?name=app-release.apk&tag_name=$TAG"

      - name: Upload AAB to Release
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          TAG: ${{ gitea.ref_name }}
          GITEA_BASE: https://git.westerntechnologies.duckdns.org
        run: |
          curl -s -X POST \
            -H "Authorization: token $GITEA_TOKEN" \
            -H "Content-Type: application/octet-stream" \
            --data-binary @app-release.aab \
            "$GITEA_BASE/api/v1/repos/kfj001/kryz-go-flutter/releases/assets?name=app-release.aab&tag_name=$TAG"