name: Build & Publish Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

jobs:
  release:
    name: Build Packages & Publish to Gitea
    # Hinweis zum Gitea act_runner:
    # Standardmäßig 'ubuntu-latest'. Falls Ihr Runner unter einem anderen Label registriert ist
    # (z. B. 'linux', 'ubuntu-24.04' oder 'host'), passen Sie dieses Label an.
    runs-on: ubuntu-latest
    # The APK from the android job goes into the release and its SHA256SUMS.txt
    needs: android
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4.2.2

      - name: Fetch Android APK
        uses: actions/download-artifact@v4.3.0
        with:
          name: ink-notes-android-apk
          path: target

      - name: Install System Packaging Tools
        run: |
          export DEBIAN_FRONTEND=noninteractive
          SUDO=""
          if [ "$(id -u)" -ne 0 ]; then
            if command -v sudo >/dev/null 2>&1; then
              SUDO="sudo"
            fi
          fi
          $SUDO apt-get update -y
          $SUDO apt-get install -y --no-install-recommends \
            build-essential \
            pkg-config \
            libx11-dev \
            libxcursor-dev \
            libxrandr-dev \
            libxi-dev \
            libxkbcommon-dev \
            gcc-mingw-w64-x86-64 \
            squashfs-tools \
            dpkg-dev \
            curl \
            python3

      - name: Setup Rust Toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1.11.0
        with:
          toolchain: stable
          # Die Action installiert mit --profile minimal; ohne diese Komponenten
          # schlagen cargo fmt und cargo clippy in den Quality Gates sofort fehl
          components: rustfmt, clippy
          cache: true
          # No global -D warnings: it would also apply to the vendored winit (vendor/winit),
          # which is built as a path dependency. The quality gates run clippy with -D warnings.
          rustflags: ""

      - name: Install rsign2 (Release-Signatur)
        # RUSTFLAGS leeren: die Toolchain-Action setzt -D warnings, das soll nicht für rsign2 gelten
        run: RUSTFLAGS="" cargo install rsign2 --locked --version 0.6.7

      - name: Code Quality & Testing (Quality Gates)
        run: |
          cargo fmt --check
          cargo clippy --all-targets -- -D warnings
          cargo test

      - name: Build Release Artifacts (.deb, .AppImage, .exe, .apk, SHA256SUMS.txt + .minisig)
        run: |
          chmod +x scripts/*.sh
          ./scripts/build-release.sh
        env:
          MINISIGN_SECRET_KEY: ${{ secrets.MINISIGN_SECRET_KEY }}
          INK_NOTES_REQUIRE_SIGNATURE: "1"
          INK_NOTES_REQUIRE_APK: "1"

      - name: Publish Release to Gitea
        run: |
          ./scripts/publish-gitea-release.sh
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN || secrets.GITHUB_TOKEN }}
          GITEA_SERVER: ${{ github.server_url }}
          REPO_OWNER: ${{ github.repository_owner }}
          REPO_NAME: ${{ github.event.repository.name }}

  android:
    # Builds the signed APK (Issue #45) and hands it to the release job as a workflow artifact
    name: Android APK
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4.2.2

      - name: Install JDK and Tools
        run: |
          export DEBIAN_FRONTEND=noninteractive
          SUDO=""
          if [ "$(id -u)" -ne 0 ] && command -v sudo >/dev/null 2>&1; then
            SUDO="sudo"
          fi
          $SUDO apt-get update -y
          $SUDO apt-get install -y --no-install-recommends \
            openjdk-17-jdk-headless build-essential pkg-config curl unzip zip

      - name: Setup Rust Toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1.11.0
        with:
          toolchain: stable
          target: aarch64-linux-android
          cache: true
          rustflags: ""

      - name: Cache Android SDK
        uses: actions/cache@v4.2.3
        with:
          path: ~/android-sdk
          key: android-sdk-${{ hashFiles('scripts/setup-android-sdk.sh') }}

      - name: Install Android SDK and NDK
        run: ./scripts/setup-android-sdk.sh

      - name: Build APK
        run: |
          if [ -n "${ANDROID_KEYSTORE_B64}" ]; then
            KEYSTORE="${RUNNER_TEMP:-/tmp}/release.keystore"
            printf '%s' "${ANDROID_KEYSTORE_B64}" | base64 -d > "${KEYSTORE}"
            export ANDROID_KEYSTORE="${KEYSTORE}"
          fi
          ./scripts/package-android.sh
        env:
          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
          ANDROID_KEYSTORE_PASS: ${{ secrets.ANDROID_KEYSTORE_PASS }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}

      - name: Hand APK to the Release Job
        uses: actions/upload-artifact@v4.6.2
        with:
          name: ink-notes-android-apk
          path: target/ink-notes_*_arm64.apk