# Pipeline Gitea Actions pour Kazier — Release (tags vX.Y.Z uniquement).
#
# Construit l'APK signé (assembleRelease), crée la Release Gitea avec l'APK en
# asset (API, équivalent de `glab release create`), puis pousse l'image
# kazier-server sur le registre conteneur Gitea + Docker Hub (tag + latest).
#
# Secrets (Settings > Actions) :
#   - RELEASE_KEYSTORE_B64  base64 du keystore release Android (jamais en clair)
#   - SIGNING_STORE_PASSWORD SIGNING_KEY_ALIAS SIGNING_KEY_PASSWORD
#   - RELEASE_API_TOKEN            PAT scope write:repository (API : création Release)
#   - CONTAINER_REGISTRY_TOKEN   PAT scope write:packages (registre conteneur Gitea)
#   - CONTAINER_REGISTRY_USER    utilisateur propriétaire du PAT ci-dessus
#   - DOCKERHUB_USER         DOCKERHUB_TOKEN  PAT Docker Hub (push public)

name: Release

on:
  push:
    tags: ["v*"]

env:
  ANDROID_IMAGE: cimg/android:2024.01
  DOCKERHUB_IMAGE: docker.io/thirdshop/kasier
  # API Gitea (host de l'instance)
  API_HOST: gitea.thirdshop.fr

jobs:
  release-apk:
    runs-on: ubuntu-24.04
    container: ${{ env.ANDROID_IMAGE }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: gradle-${{ runner.os }}-${{ hashFiles('mobile-kotlin/gradle/libs.versions.toml') }}
          restore-keys: |
            gradle-${{ runner.os }}-

      - name: Signer + assembler l'APK release
        working-directory: mobile-kotlin
        env:
          RELEASE_KEYSTORE_B64: ${{ secrets.RELEASE_KEYSTORE_B64 }}
          SIGNING_STORE_PASSWORD: ${{ secrets.SIGNING_STORE_PASSWORD }}
          SIGNING_KEY_ALIAS: ${{ secrets.SIGNING_KEY_ALIAS }}
          SIGNING_KEY_PASSWORD: ${{ secrets.SIGNING_KEY_PASSWORD }}
        run: |
          if [ -z "${RELEASE_KEYSTORE_B64:-}" ]; then
            echo "RELEASE_KEYSTORE_B64 manquant — release non signée." >&2
            exit 1
          fi
          echo "$RELEASE_KEYSTORE_B64" | base64 -d > app/release.keystore
          cat > app/signing.properties <<EOF
          storeFile=release.keystore
          storePassword=${SIGNING_STORE_PASSWORD:?}
          keyAlias=${SIGNING_KEY_ALIAS:?}
          keyPassword=${SIGNING_KEY_PASSWORD:?}
          EOF
          ./gradlew :app:assembleRelease -q

      - name: Créer la Release Gitea + upload APK
        env:
          RELEASE_API_TOKEN: ${{ secrets.RELEASE_API_TOKEN }}
        run: |
          set -euo pipefail
          VERSION="$(cat VERSION)"
          API="https://${API_HOST}/api/v1"
          AUTH="Authorization: token ${RELEASE_API_TOKEN:?RELEASE_API_TOKEN manquant (PAT scope write:repository)}"
          NOTES="$(python3 -c 'import json,sys;print(json.dumps(open("CHANGELOG.md", encoding="utf-8").read()))' 2>/dev/null)" || NOTES=""
          RELEASE_JSON="$(curl -sSf -X POST "${API}/repos/${GITHUB_REPOSITORY}/releases" \
            -H "${AUTH}" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"v${VERSION}\",\"name\":\"Kazier v${VERSION}\",\"body\":${NOTES}}")"
          RELEASE_ID="$(printf '%s' "${RELEASE_JSON}" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)"
          curl -sSf -X POST \
            "${API}/repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}/assets?name=app-release.apk" \
            -H "${AUTH}" \
            -F "attachment=@mobile-kotlin/app/build/outputs/apk/release/app-release.apk"

  release-docker:
    runs-on: ubuntu-24.04
    container:
      image: docker:27
      env:
        DOCKER_HOST: tcp://docker:2375
        DOCKER_TLS_CERTDIR: ""
    services:
      docker:
        image: docker:27-dind
    steps:
      - uses: actions/checkout@v4

      - name: Login registre Gitea
        env:
          CONTAINER_REGISTRY_TOKEN: ${{ secrets.CONTAINER_REGISTRY_TOKEN }}
          CONTAINER_REGISTRY_USER: ${{ secrets.CONTAINER_REGISTRY_USER }}
        run: |
          : "${CONTAINER_REGISTRY_TOKEN:?CONTAINER_REGISTRY_TOKEN manquant (PAT scope write:packages)}"
          : "${CONTAINER_REGISTRY_USER:?CONTAINER_REGISTRY_USER manquant (propriétaire du PAT)}"
          echo "$CONTAINER_REGISTRY_TOKEN" | docker login "$API_HOST" -u "$CONTAINER_REGISTRY_USER" --password-stdin
          echo "REGISTRY_IMAGE=${API_HOST}/${{ github.repository_owner }}/kasier" >> "$GITHUB_ENV"

      - name: "Build + push (registre Gitea : vX.Y.Z)"
        run: |
          VERSION="$(cat VERSION)"
          docker build \
            --build-arg VERSION="${VERSION}" \
            --build-arg BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
            -t "$REGISTRY_IMAGE:v${VERSION}" \
            ./backend
          docker push "$REGISTRY_IMAGE:v${VERSION}"
          docker run --rm "$REGISTRY_IMAGE:v${VERSION}" --version
          echo "TAG=v${VERSION}" >> "$GITHUB_ENV"

      - name: Push Docker Hub (tag + latest)
        env:
          DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: |
          : "${DOCKERHUB_USER:?DOCKERHUB_USER manquant}"
          : "${DOCKERHUB_TOKEN:?DOCKERHUB_TOKEN manquant}"
          IMAGE="$DOCKERHUB_IMAGE"
          echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USER" --password-stdin docker.io
          docker tag "$REGISTRY_IMAGE:$TAG" "$IMAGE:$TAG"
          docker tag "$REGISTRY_IMAGE:$TAG" "$IMAGE:latest"
          docker push "$IMAGE:$TAG"
          docker push "$IMAGE:latest"