the-mews/.forgejo/workflows/release.yml

name: Release APK

on:
  push:
    tags: ["v*"]

jobs:
  build:
    runs-on: android

    steps:
      - uses: actions/checkout@v4

      - name: Extract version
        run: |
          # Plain parameter expansion, not `grep -P` — the runner's grep
          # build has no PCRE support, so -P silently matches nothing.
          VERSION=$(grep '^version:' app/pubspec.yaml | sed 's/version: //')
          echo "VERSION_CODE=${VERSION##*+}" >> $GITHUB_ENV
          echo "VERSION_NAME=${VERSION%%+*}" >> $GITHUB_ENV

      - name: Decode keystore
        run: |
          echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > app/android/app/release.jks
          echo "KEYSTORE_PATH=$GITHUB_WORKSPACE/app/android/app/release.jks" >> $GITHUB_ENV

      - name: Build release APK
        env:
          STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
          KEY_ALIAS:      ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD:   ${{ secrets.KEY_PASSWORD }}
          # Host-mode runners share ~/.gradle (including the daemon) across
          # unrelated projects; a warm daemon from another build can poison
          # this one. Keep caches shared, just don't attach to a daemon.
          GRADLE_OPTS: -Dorg.gradle.daemon=false
        run: |
          # `devbox run` always executes relative to the devbox project root
          # (where devbox.json lives), ignoring the shell's cwd at
          # invocation — so the `cd app` has to happen inside the command
          # devbox runs, not before it.
          env -u GITHUB_TOKEN -u GH_TOKEN -u JAVA_HOME \
            devbox run -- bash -c 'cd app && flutter build apk --release'

      - name: Create release and upload APK
        env:
          FORGEJO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          APK="mews-${{ env.VERSION_NAME }}.apk"
          cp app/build/app/outputs/flutter-apk/app-release.apk "$APK"

          BODY=$(python3 -c "
          import json
          print(json.dumps(open('app/fastlane/metadata/android/en-US/changelogs/${{ env.VERSION_CODE }}.txt').read().strip()))
          ")

          RELEASE_ID=$(curl -sf -X POST \
            -H "Authorization: token $FORGEJO_TOKEN" \
            -H "Content-Type: application/json" \
            "$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY/releases" \
            -d "{\"tag_name\":\"$GITHUB_REF_NAME\",\"name\":\"$GITHUB_REF_NAME\",\"body\":$BODY}" \
            | python3 -c 'import sys,json; print(json.load(sys.stdin)["id"])')

          curl -sf -X POST \
            -H "Authorization: token $FORGEJO_TOKEN" \
            -H "Content-Type: application/vnd.android.package-archive" \
            "$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID/assets?name=$APK" \
            --data-binary @"$APK"