deploy-android.yml

name: Deploy Android

# ========================================================================
# PRODUCTION ACTIVATION CHECKLIST
# ========================================================================
# Required GitHub Secrets (Settings > Secrets and variables > Actions):
#   - ANDROID_KEYSTORE_BASE64           upload-keystore.jks, base64-encoded
#                                       (`base64 -i upload-keystore.jks`)
#   - ANDROID_KEYSTORE_PASSWORD
#   - ANDROID_KEY_ALIAS
#   - ANDROID_KEY_PASSWORD
#   - BASE_URL_STAGING                  API base URL for staging
#   - BASE_URL_PRODUCTION               API base URL for production
#   - SUPABASE_URL_PROD                 Supabase project URL
#   - SUPABASE_ANON_KEY_PROD            Supabase anon/public key
#   - GOOGLE_PLAY_SERVICE_ACCOUNT_JSON  Play Console service account JSON
#
# External setup before first run:
#   1. Generate upload keystore: keytool -genkey -v -keystore
#      upload-keystore.jks -keyalg RSA -keysize 2048 -validity 10000.
#   2. Create app in Google Play Console; enable API access; create a
#      service account with "Release manager" role.
#   3. Verify the `packageName` in the "Setup Google Play" step matches
#      what's in Play Console (currently `com.example.grex`).
#
# Activation order (do these in sequence as each piece becomes ready):
#   1. Populate SUPABASE_URL_PROD / SUPABASE_ANON_KEY_PROD secrets so the
#      "Write .env from secrets" step has real values to interpolate.
#   2. Uncomment "Setup Android keystore".
#   3. Uncomment "Build App Bundle".
#   4. Uncomment "Setup Google Play" — OR leave commented and rely on
#      "Upload artifacts" + manual upload to Play Console.
#   5. Switch the trigger below from `workflow_dispatch` only to
#      `push: tags: [ 'v*.*.*' ]` for tag-based releases.
# ========================================================================
#
# ------------------------------------------------------------------------
# Workflow Triggers Configuration
# ------------------------------------------------------------------------
# This is a starter template, so triggers are commented out by default.
# Uncomment and configure according to your deployment strategy:
#
# Option 1: Deploy on version tags
#   push:
#     tags:
#       - 'v*.*.*'  # Deploy when version tag is pushed (e.g., v1.0.0)
#
# Option 2: Deploy on branch push
#   push:
#     branches: [ main ]  # Deploy when pushing to main branch
#
# Option 3: Manual trigger only (workflow_dispatch)
#   - Keep push triggers commented
#   - Use GitHub Actions UI to trigger manually
# ------------------------------------------------------------------------
on:
  # push:
  #   tags:
  #     - 'v*.*.*'  # Uncomment to deploy on version tags
  #   branches: [ main ]  # Uncomment to deploy on branch push
  workflow_dispatch:  # Allows manual trigger from GitHub Actions UI
    inputs:
      environment:
        description: 'Environment to deploy'
        required: true
        default: 'production'
        type: choice
        options:
          - staging
          - production

jobs:
  deploy:
    name: Deploy to Play Store
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: 'stable'
          channel: 'stable'

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '17'

      # Writes `.env` from GitHub Secrets at runtime. Required secrets:
      # SUPABASE_URL_PROD, SUPABASE_ANON_KEY_PROD. Until those are set in
      # the repo, the interpolated values resolve to empty strings — still
      # safer than shipping the placeholder values from `.env.example`.
      - name: Write .env from secrets
        env:
          ENV_INPUT: ${{ github.event.inputs.environment }}
        run: |
          ENV="${ENV_INPUT:-production}"
          cat > .env <<EOF
          ENVIRONMENT=$ENV
          SUPABASE_URL=${{ secrets.SUPABASE_URL_PROD }}
          SUPABASE_ANON_KEY=${{ secrets.SUPABASE_ANON_KEY_PROD }}
          EOF

      - name: Get dependencies
        run: flutter pub get

      # Decodes the upload keystore and writes android/key.properties so the
      # release build can sign the bundle. Required secrets: ANDROID_KEYSTORE_*
      # (see checklist at top of file).
      # - name: Setup Android keystore
      #   env:
      #     KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
      #     KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
      #     KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
      #     KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
      #   run: |
      #     echo "$KEYSTORE_BASE64" | base64 -d > android/upload-keystore.jks
      #     echo "storePassword=$KEYSTORE_PASSWORD" > android/key.properties
      #     echo "keyPassword=$KEY_PASSWORD" >> android/key.properties
      #     echo "keyAlias=$KEY_ALIAS" >> android/key.properties
      #     echo "storeFile=upload-keystore.jks" >> android/key.properties

      - name: Determine environment
        id: env
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
            echo "environment=${{ github.event.inputs.environment }}" >> $GITHUB_OUTPUT
          else
            echo "environment=production" >> $GITHUB_OUTPUT
          fi

      # Builds the .aab artifact. Depends on "Setup Android keystore" above.
      # Required secrets: BASE_URL_STAGING, BASE_URL_PRODUCTION.
      # - name: Build App Bundle
      #   env:
      #     BASE_URL: ${{ secrets.BASE_URL_PRODUCTION }}
      #   run: |
      #     ENV="${{ steps.env.outputs.environment }}"
      #     if [ "$ENV" == "staging" ]; then
      #       BASE_URL="${{ secrets.BASE_URL_STAGING }}"
      #     else
      #       BASE_URL="${{ secrets.BASE_URL_PRODUCTION }}"
      #     fi
          
      #     flutter build appbundle \
      #       --flavor "$ENV" \
      #       --release \
      #       --dart-define=ENVIRONMENT="$ENV" \
      #       --dart-define=BASE_URL="$BASE_URL"

      # Uploads the .aab to Play Console (internal/production track by env).
      # Required secret: GOOGLE_PLAY_SERVICE_ACCOUNT_JSON. Confirm packageName
      # matches Play Console before activating.
      # - name: Setup Google Play
      #   uses: r0adkll/upload-google-play@v1
      #   with:
      #     serviceAccountJsonPlainText: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
      #     packageName: com.example.grex
      #     releaseFiles: build/app/outputs/bundle/${ENV}Release/app-${ENV}-release.aab
      #     track: ${{ steps.env.outputs.environment == 'production' && 'production' || 'internal' }}
      #     status: completed
      #     inAppUpdatePriority: 2
      #     whatsNewDirectory: fastlane/metadata/android/en-US/changelogs

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: android-bundle
          path: build/app/outputs/bundle/**/*.aab