name: Publish HardenedPass to GitHub Releases
on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'

jobs:
  release:
    name: Build and publish signed release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - name: Setup build environment
      uses: danixland/HardenedPass/.github/reusable-workflows/setup-gradle@master

    - name: Decrypt signing secrets
      shell: bash
      run: scripts/signing-setup.sh "$ENCRYPT_KEY"
      env:
        ENCRYPT_KEY: ${{ secrets.ENCRYPT_KEY }}

    - name: Build signed release APK
      shell: bash
      run: ./gradlew :app:assembleRelease

    - name: Clean signing secrets
      if: "${{ always() }}"
      run: scripts/signing-cleanup.sh

    - name: Create draft release
      shell: bash
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        TAG: ${{ github.ref_name }}
      run: |
        apk="HardenedPass_${TAG}.apk"
        cp app/build/outputs/apk/release/app-release.apk "$apk"
        sha256sum "$apk" > "$apk.sha256"
        gh release create "$TAG" "$apk" "$apk.sha256" --draft --title "$TAG" \
          --notes "See [CHANGELOG.md](https://github.com/${GITHUB_REPOSITORY}/blob/${TAG}/CHANGELOG.md)."