android.yml

name: "Reusable android workflow"

on:
  workflow_call:
    inputs:
      publish:
        required: false
        type: boolean
    secrets:
      ANDROID_RELEASE_KEYSTORE:
        required: false
      ANDROID_RELEASE_KEYSTORE_PASSWORD:
        required: false
      ANDROID_RELEASE_KEY:
        required: false
      ANDROID_RELEASE_KEY_PASSWORD:
        required: false

jobs:
  build:
    runs-on: ubuntu-latest
    name: "📦"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        name: 🔄 Checkout

      - name: ☕ Setup Java
        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4
        with:
          distribution: "zulu"
          java-version: "17"

      - name: 🤖 Setup Android SDK
        uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3

      - name: 🛠️ Install NDK
        run: sdkmanager "ndk;27.0.11902837"

      - name: 🦀 Install rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android,wasm32-unknown-unknown

      - name: 📝 Check spelling using typos-action
        uses: crate-ci/typos@11ca4583f2f3f74c7e7785c0ecb20fe2c99a4308 # v1.29.5

      - name: 📥 Cached Install trunk
        uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3 # v3
        with:
          crate: trunk
          version: 0.21.7
          locked: true
          args: --no-default-features
          features: rustls

      - name: 📥 Cached install cargo-auditable
        uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3 # v3
        with:
          crate: cargo-auditable
          version: 0.6.6
          locked: true

      - name: 📥 Cached install tauri-cli
        uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3 # v3
        with:
          crate: tauri-cli
          version: 2.2.7
          locked: true

      - name: 🔨 Build app bundle
        run: |
          cargo --locked auditable tauri android init
          cp -a src-tauri/icons/android/mipmap-* src-tauri/gen/android/app/src/main/res/
          cargo --locked auditable tauri android build
        env:
          NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/27.0.11902837
          RUSTFLAGS: "-D warnings"

      - name: 🔑 Extract android signing key from env (publish only)
        run: |
          echo "${{ secrets.ANDROID_RELEASE_KEYSTORE }}" > src-tauri/gen/android/release.jks.base64
          base64 -d src-tauri/gen/android/release.jks.base64 > src-tauri/gen/android/release.decrypted.jks

      - name: 🔏 Sign APK
        run: |
          ${{ env.ANDROID_HOME }}/build-tools/34.0.0/apksigner sign --ks src-tauri/gen/android/release.decrypted.jks \
            --ks-key-alias ${{ secrets.ANDROID_RELEASE_KEY }} \
            --ks-pass pass:${{ secrets.ANDROID_RELEASE_KEYSTORE_PASSWORD }} \
            --key-pass pass:${{ secrets.ANDROID_RELEASE_KEY_PASSWORD }} \
            --out src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release-signed.apk \
            src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release-unsigned.apk

      - name: 📤 Upload build artifacts (push or pr builds only)
        if: (!inputs.publish)
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: "signed-apk"
          path: |
            src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release-signed.apk

      - name: 📝 Extract version from tauri.android.conf.json (publish only)
        if: inputs.publish
        id: get-version
        run: |
          CURRENT_VERSION=$(jq -r '.version' src-tauri/tauri.android.conf.json)
          echo "current-version=$CURRENT_VERSION" >> "$GITHUB_OUTPUT"

      - name: ✏️  Rename APK file (publish only)
        if: inputs.publish
        run: |
          mv ./src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release-signed.apk ./src-tauri/gen/android/app/build/outputs/apk/universal/release/mdns-browser_${{ steps.get-version.outputs.current-version }}.apk

      - name: 🚀 Publish (publish only)
        if: inputs.publish
        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2
        with:
          name: mDNS-Browser Release v${{ steps.get-version.outputs.current-version }}
          append_body: true
          make_latest: false
          generate_release_notes: false
          files: |
            src-tauri/gen/android/app/build/outputs/apk/universal/release/mdns-browser_${{ steps.get-version.outputs.current-version }}.apk

      - name: 🛡️ Attest build provenance (publish only)
        if: inputs.publish
        uses: actions/attest-build-provenance@520d128f165991a6c774bcb264f323e3d70747f4 # v2.2.0
        with:
          subject-path: |
            src-tauri/gen/android/app/build/outputs/apk/universal/release/mdns-browser_${{ steps.get-version.outputs.current-version }}.apk