name: Notesnook Android Preview Build

# UNTRUSTED stage. Runs on `pull_request`, so fork code is checked out and
# compiled with a read-only GITHUB_TOKEN and NO repository secrets. The release
# APK is built without any signing secret (the same as before). Firebase
# distribution and the PR comment happen in android.preview.publish.yml, which
# runs in the trusted `workflow_run` context and never executes fork code.
# Because no secrets are exposed here, the build runs automatically for every
# PR (including forks) with no authorization gate.

on:
  pull_request:
    types: [opened, reopened, synchronize]
    branches: [master, beta]
    paths:
      - "apps/mobile/**"
      - "packages/**"
      - ".github/workflows/android.preview.build.yml"
      - ".github/workflows/android.preview.publish.yml"

concurrency:
  group: android-preview-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-22.04
    env:
      STAGING_BUILD: true

    steps:
      - name: Checkout PR code
        uses: actions/checkout@v5
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Setup Node
        uses: ./.github/actions/setup-node-with-cache

      - name: Use specific Java version for the builds
        uses: joschi/setup-jdk@v2
        with:
          java-version: "17"
          architecture: "x64"

      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@main
        with:
          tool-cache: false
          android: false
          dotnet: true
          haskell: true
          large-packages: true
          docker-images: true
          swap-storage: true

      - name: Install node modules
        run: |
          npm ci --ignore-scripts --prefer-offline --no-audit
          npm run bootstrap -- --scope=mobile

      - name: Make Gradlew Executable
        run: cd apps/mobile/android && chmod +x ./gradlew

      - name: Get build number
        id: build-number
        run: echo "timestamp=$(($(date +%s) - 1774851180 ))" >> $GITHUB_OUTPUT

      - name: Check for typescript errors
        run: |
          npm run tx mobile:build
          cd apps/mobile
          npx tsc --noEmit

      - name: Build arm64-v8a apk
        run: |
          cd apps/mobile/android
          ./gradlew assembleRelease -PreactNativeArchitectures=arm64-v8a -PstagingReleaseBuild=true -PprBuildNumber=${{ steps.build-number.outputs.timestamp }}

      - name: Stage build artifact
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/artifact"
          cp apps/mobile/android/app/build/outputs/apk/release/app-arm64-v8a-release.apk \
            "$RUNNER_TEMP/artifact/app-preview.apk"
          {
            echo "PR_NUMBER=${{ github.event.pull_request.number }}"
            echo "HEAD_SHA=${{ github.event.pull_request.head.sha }}"
          } > "$RUNNER_TEMP/artifact/pr-meta.env"

      - name: Upload build artifact
        uses: actions/upload-artifact@v4
        with:
          name: android-preview-build
          path: ${{ runner.temp }}/artifact
          if-no-files-found: error
          retention-days: 1

      - name: Upload sourcemaps
        uses: actions/upload-artifact@v4
        with:
          name: sourcemaps
          path: |
            apps/mobile/android/app/build/generated/sourcemaps/**/*.map