publish-github-release.yml

name: Publish GitHub Release

on:
  push:
    branches:
      - main
    tags:
      - 'v*'
    paths:
      - 'lsposed-helper/**'
      - 'scripts/**'
      - 'themes/**'
      - 'theme-packs/**'
      - 'system_ext/**'
      - 'customer-options/**'
      - 'docs/**'
      - 'module.prop'
      - 'latestStable.json'
      - 'latestBeta.json'
      - 'latestNightly.json'
      - '.github/workflows/publish-github-release.yml'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version tag, example: v0.6.0'
        required: false
        default: ''
      publish:
        description: 'Publish GitHub Release'
        required: true
        type: boolean
        default: true

concurrency:
  group: publish-github-release-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: write
  id-token: write
  attestations: write

env:
  APK_NAME: ColorOS-Customizer
  MODULE_ID: ColorOS-Themes-Rock

jobs:
  build-and-publish:
    name: Build and Publish Release
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Android SDK
        uses: android-actions/setup-android@v3

      - name: Install Android SDK packages
        run: sdkmanager "platforms;android-35" "build-tools;35.0.0" "platform-tools"

      - name: Set up Gradle 8.10.2
        uses: gradle/actions/setup-gradle@v4
        with:
          gradle-version: 8.10.2

      - name: Resolve version
        id: meta
        shell: bash
        run: |
          VERSION="${{ inputs.version }}"
          if [[ -z "$VERSION" && "$GITHUB_REF" == refs/tags/* ]]; then
            VERSION="$GITHUB_REF_NAME"
          fi
          if [[ -z "$VERSION" ]]; then
            VERSION="v$(grep -E "versionName '" lsposed-helper/app/build.gradle | head -n 1 | sed -E "s/.*versionName '([^']+)'.*/\1/")"
          fi
          if [[ ! "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-beta)?$ ]]; then
            echo "Invalid version: $VERSION"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "MODULE_VERSION=$VERSION" >> "$GITHUB_ENV"

      - name: Validate theme module
        run: bash scripts/validate-module.sh

      - name: Check theme asset sizes
        run: bash scripts/check-theme-size.sh

      - name: Build Android APK files
        working-directory: lsposed-helper
        run: gradle :app:assembleDebug :app:assembleRelease --no-daemon --stacktrace

      - name: Build theme module ZIP
        run: bash scripts/package.sh

      - name: Collect release files
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p release/files
          VERSION="${{ steps.meta.outputs.version }}"

          cp lsposed-helper/app/build/outputs/apk/debug/app-debug.apk "release/files/${APK_NAME}-${VERSION}-debug.apk"

          if [[ -f lsposed-helper/app/build/outputs/apk/release/app-release-unsigned.apk ]]; then
            cp lsposed-helper/app/build/outputs/apk/release/app-release-unsigned.apk "release/files/${APK_NAME}-${VERSION}-release-unsigned.apk"
          elif [[ -f lsposed-helper/app/build/outputs/apk/release/app-release.apk ]]; then
            cp lsposed-helper/app/build/outputs/apk/release/app-release.apk "release/files/${APK_NAME}-${VERSION}-release.apk"
          fi

          for file in dist/*.zip; do
            cp "$file" release/files/
          done

          cat > release/files/BUILD_INFO.txt <<INFO
          Project: Sayanth Rock ColorOS Release
          Version: ${VERSION}
          Commit: ${GITHUB_SHA}
          Workflow: ${GITHUB_WORKFLOW}
          Run ID: ${GITHUB_RUN_ID}
          Android target policy: Android 15 supported, Android 16/17 device testing required
          INFO

          (cd release/files && sha256sum * > SHA256SUMS.txt)

      - name: Upload workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: Sayanth-Rock-ColorOS-${{ steps.meta.outputs.version }}
          path: release/files/*
          if-no-files-found: error
          retention-days: 30

      - name: Generate build provenance attestation
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: 'release/files/*'

      - name: Create release notes
        run: |
          VERSION="${{ steps.meta.outputs.version }}"
          cat > RELEASE_NOTES.md <<INFO
          # Sayanth Rock ColorOS Release ${VERSION}

          ## Included files
          - Debug APK for direct testing
          - Release APK output when produced by Gradle
          - ColorOS Themes Rock module ZIP
          - BUILD_INFO.txt
          - SHA256SUMS.txt

          ## Added in this line
          - Android 15 support label
          - Android 16 forward-compatible label
          - Android 17 preview-safe label
          - Rootd Health page in the helper APK
          - Systemless-only module policy
          - Improved support report and rollback metadata

          ## Free customer tools
          - Wallpaper tools
          - Feedback and support pages
          - Safe mode guidance
          - Diagnostics status page
          - Feature labels: Working, Limited, Needs testing, Not available

          ## Release rule
          - Free customer tools stay available.
          - Advanced or untested items must show clear status labels.
          - Test on an OPPO, OnePlus, or realme phone before public sharing.
          INFO

      - name: Publish GitHub Release with clobber upload
        if: github.event_name != 'workflow_dispatch' || inputs.publish
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.meta.outputs.version }}
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          files=(release/files/*)
          if [[ ${#files[@]} -eq 0 ]]; then
            echo "No files to upload"
            exit 1
          fi
          if gh release view "$VERSION" >/dev/null 2>&1; then
            gh release edit "$VERSION" --title "Sayanth Rock ColorOS Release ${VERSION}" --notes-file RELEASE_NOTES.md
          else
            gh release create "$VERSION" --target "$GITHUB_SHA" --title "Sayanth Rock ColorOS Release ${VERSION}" --notes-file RELEASE_NOTES.md
          fi
          gh release upload "$VERSION" "${files[@]}" --clobber