android-release.yml

name: treehouses remote release

on:
  push:
    branches:
      - 'master'
      - '1820-update-this-projects-agp'
    workflow_dispatch:

jobs:
  apk:
    name: Release APK
    runs-on: ubuntu-latest
    env:
      ANDROID_NDK_VERSION: "21.3.6528147"
      BUILD_TOOLS_VERSION: "34.0.0"
    steps:
      - name: run number with offset
        id: version
        env:
          NUM: ${{ github.run_number }}
        run: echo "::set-output name=id::$(($NUM+6050))"

      - name: checkout repository code
        uses: actions/checkout@v4

      - name: setup JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '17'
          cache: 'gradle'

      - name: install NDK
        run: |
          set -x
          echo "ANDROID_HOME is set to: ${ANDROID_HOME}"
          echo "ANDROID_SDK_ROOT is set to: ${ANDROID_SDK_ROOT}"
          echo "ANDROID_NDK_VERSION is set to: ${ANDROID_NDK_VERSION}"
          echo "y" | sudo ${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin/sdkmanager --install "ndk;${ANDROID_NDK_VERSION}" --sdk_root=${ANDROID_SDK_ROOT} 2>&1
          if [ $? -ne 0 ]; then
              echo "SDK Manager command failed"
              exit 1
          fi
          set +x
          chmod +x ./gradlew

      - name: build release APK and AAB
        run: |
          ./gradlew assembleRelease bundleRelease
          ls -alR app/build/outputs
          mkdir -p sign
          cp app/build/outputs/bundle/release/app-release.aab sign/.
          cp app/build/outputs/apk/release/remote-${{ steps.version.outputs.id }}.apk sign/app-release-unsigned.apk
          ls -al sign

      - name: sign release APK and AAB
        uses: dogi/sign-android-release@v4.0.1
        with:
          releaseDirectory: sign
          signingKeyBase64: ${{ secrets.SIGNING_KEY }}
          alias: ${{ secrets.ALIAS }}
          keyStorePassword: ${{ secrets.KEY_STORE_PASSWORD }}
          keyPassword: ${{ secrets.KEY_PASSWORD }}

      - name: copy builds to output and generate sha256
        run: |
          mkdir -p output
          cp sign/app-release-unsigned-signed.apk output/remote.apk
          cp sign/app-release.aab output/remote.aab
          sha256sum output/remote.apk > output/remote.apk.sha256
          sha256sum output/remote.aab > output/remote.aab.sha256
          ls -alR output

#      - name: publish AAB to playstore
#        if: github.ref == 'refs/heads/master'
#        uses: r0adkll/upload-google-play@v1.1.2
#        with:
#          serviceAccountJsonPlainText: ${{ secrets.SERVICE_ACCOUNT_JSON }}
#          packageName: io.treehouses.remote
#          releaseFiles: output/remote.aab
#          track: internal
#          releaseName: "${{ env.ANDROID_VERSION_CODE }} (${{ env.ANDROID_VERSION_NAME }})"
#          status: completed

      - name: mobile security framework
        run: |
          docker pull opensecurity/mobile-security-framework-mobsf
          docker run -itd -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest 
          cd output
          ls -al
          wget http://localhost:8000/api_docs
          MOBSF_API_KEY=$(grep 'REST API Key' api_docs)
          MOBSF_API_KEY=${MOBSF_API_KEY:42:64}
          rm api_docs
          HASH=$(md5sum remote.apk)
          HASH=${HASH:0:32}
          curl -F "file=@remote.apk" http://localhost:8000/api/v1/upload -H "Authorization:$MOBSF_API_KEY"
          curl -X POST --url http://localhost:8000/api/v1/scan --data "scan_type=apk&file_name=remote.apk&hash=$HASH" -H "Authorization:$MOBSF_API_KEY"
          curl -X POST --url http://localhost:8000/api/v1/download_pdf --data "hash=$HASH" -H "Authorization:$MOBSF_API_KEY" --output remote-${{ steps.version.outputs.id }}.pdf
          ls -al

      - name: rename APK and AAB with version and branch for artifact
        if: github.ref != 'refs/heads/master'
        run: |
          mv output/remote.apk output/remote-${{ steps.version.outputs.id }}-${{ env.BRANCHNAME }}.apk
          mv output/remote.apk.sha256 output/remote-${{ steps.version.outputs.id }}-${{ env.BRANCHNAME }}.apk.sha256
          mv output/remote.aab output/remote-${{ steps.version.outputs.id }}-${{ env.BRANCHNAME }}.aab
          mv output/remote.aab.sha256 output/remote-${{ steps.version.outputs.id }}-${{ env.BRANCHNAME }}.aab.sha256
          mv output/remote-${{ steps.version.outputs.id }}.pdf output/remote-${{ steps.version.outputs.id }}-${{ env.BRANCHNAME }}.pdf
          ls -alR output

      - name: upload APK and AAB as build artifact
        if: github.ref != 'refs/heads/master'
        uses: actions/upload-artifact@v3
        with:
          name: remote-${{ steps.version.outputs.id }}-${{ env.BRANCHNAME }}
          path: output/*
          retention-days: 9

      - name: release APK and AAB on GitHub
        if: github.ref == 'refs/heads/master'
        uses: svenstaro/upload-release-action@v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: output/*
          tag: v${{ steps.version.outputs.id }}
          overwrite: true
          file_glob: true

      - name: send success message to discord
        run: |
          sudo npm install -g @treehouses/cli
          export discord_channel="${{ secrets.CHANNEL }}"
          echo "https://github.com/treehouses/remote/releases/tag/v${{ steps.version.outputs.id }}"
          treehouses feedback "new remote app: https://github.com/treehouses/remote/releases/tag/v${{ steps.version.outputs.id }}"