name: Release

on:
  push:
    tags: ['v*']

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3  # v4
        with:
          java-version: '17'
          distribution: 'temurin'
      - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407  # v3
        with:
          packages: 'platforms;android-35 build-tools;35.0.0'
      - name: Decode Keystore
        run: echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > release.jks
      - name: Build Release APK
        env:
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEYSTORE_ALIAS: ${{ secrets.KEYSTORE_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: |
          chmod +x gradlew
          ./gradlew assembleRelease
      - name: Cleanup keystore (always run for security)
        run: rm -f release.jks
        if: always()
      - name: Rename & Release
        run: |
          cp app/build/outputs/apk/release/app-release.apk "RainyToken-${GITHUB_REF#refs/tags/}.apk"
      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2
        with:
          name: "🎉 RainyToken ${{ github.ref_name }}"
          files: RainyToken-${{ github.ref_name }}.apk
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}