name: Publish HardenedPass to GitHub Releases
on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'

jobs:
  release:
    name: Build and publish signed release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - name: Setup build environment
      uses: danixland/HardenedPass/.github/reusable-workflows/setup-gradle@master

    - name: Decrypt signing secrets
      shell: bash
      run: scripts/signing-setup.sh "$ENCRYPT_KEY"
      env:
        ENCRYPT_KEY: ${{ secrets.ENCRYPT_KEY }}

    - name: Build signed release APK
      shell: bash
      run: ./gradlew :app:assembleRelease

    - name: Clean signing secrets
      if: "${{ always() }}"
      run: scripts/signing-cleanup.sh

    - name: Create draft release
      shell: bash
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        TAG: ${{ github.ref_name }}
      run: |
        apk="HardenedPass_${TAG}.apk"
        cp app/build/outputs/apk/release/app-release.apk "$apk"
        sha256sum "$apk" > "$apk.sha256"
        # The release notes are this version's section of the changelog.
        awk -v head="## [${TAG#v}]" 'index($0, head) == 1 { found = 1; next } /^## \[/ { found = 0 } found' \
          CHANGELOG.md > notes.md
        grep -q '[^[:space:]]' notes.md || { echo "No CHANGELOG.md section for $TAG"; exit 1; }
        gh release create "$TAG" "$apk" "$apk.sha256" --draft --title "$TAG" --notes-file notes.md