Obtainium/.github/workflows/release.yml

name: Build and Release

on:
  workflow_dispatch:
    inputs:
      beta:
        type: boolean
        description: Is beta?
    
jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      
      - uses: actions/checkout@v3
      - uses: subosito/flutter-action@v2
      - uses: actions/setup-java@v4
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '17'

      - name: Flutter Doctor
        id: flutter_doctor
        run: |
          flutter doctor -v
          
      - name: Import GPG key
        id: import_pgp_key
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.PGP_KEY_BASE64 }}
          passphrase: ${{ secrets.PGP_PASSPHRASE }}

      - name: Check submodule
        id: check_submodule
        run: |
          SUBMODULE_COMMIT_LONG="$(git submodule status | head -1 | tail -c +2 | awk '{print $1}')"
          FLUTTER_COMMIT_SHORT="$(flutter --version | head -2 | tail -1 | awk '{print $4}')"
          echo "SUBMODULE_COMMIT_LONG=$SUBMODULE_COMMIT_LONG, FLUTTER_COMMIT_SHORT=$FLUTTER_COMMIT_SHORT"
          if ! [[ "$SUBMODULE_COMMIT_LONG" =~ ^$FLUTTER_COMMIT_SHORT ]]; then
            echo "Your submodule has not been updated!"
            exit 1
          fi

      - name: Extract Version
        id: extract_version      
        run: |
          VERSION=$(grep -oP "^version: [^\+]+" pubspec.yaml | tail -c +10)
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          if [ ${{ inputs.beta }} == true ]; then BETA=true; else BETA=false; fi
          echo "beta=$BETA" >> $GITHUB_OUTPUT
          TAG="v$VERSION"
          echo "tag=$TAG" >> $GITHUB_OUTPUT

      - name: Build APKs
        run: |
          sed -i 's/signingConfig signingConfigs.release//g' android/app/build.gradle
          flutter build apk --flavor normal && flutter build apk --split-per-abi --flavor normal
          for file in build/app/outputs/flutter-apk/app-*normal*.apk*; do mv "$file" "${file//-normal/}"; done
          flutter build apk --flavor fdroid -t lib/main_fdroid.dart && flutter build apk --split-per-abi --flavor fdroid -t lib/main_fdroid.dart
          rm ./build/app/outputs/flutter-apk/*.sha1
          ls -l ./build/app/outputs/flutter-apk/
        
      - name: Sign APKs
        env:
          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
        run: |
          echo "${KEYSTORE_BASE64}" | base64 -d > apksign.keystore
          for apk in ./build/app/outputs/flutter-apk/*-release*.apk; do
            unsignedFn=${apk/-release/-unsigned}
            mv "$apk" "$unsignedFn"
            ${ANDROID_HOME}/build-tools/$(ls ${ANDROID_HOME}/build-tools/ | tail -1)/apksigner sign --ks apksign.keystore --ks-pass pass:"${KEYSTORE_PASSWORD}" --out "${apk}" "${unsignedFn}"
            sha256sum ${apk} | cut -d " " -f 1 > "$apk".sha256
            gpg --batch  --pinentry-mode loopback --passphrase "${PGP_PASSPHRASE}" --sign --detach-sig "$apk".sha256
          done
          rm apksign.keystore
          PGP_KEY_FINGERPRINT="${{ steps.import_pgp_key.outputs.fingerprint }}"

      - name: Create Tag
        uses: mathieudutour/github-tag-action@v6.1
        with:
          github_token: ${{ secrets.GH_ACCESS_TOKEN }}
          custom_tag: "${{ steps.extract_version.outputs.tag }}"
          tag_prefix: ""
      
      - name: Create Release And Upload APKs
        uses: ncipollo/release-action@v1
        with:
          token: ${{ secrets.GH_ACCESS_TOKEN }}
          tag: "${{ steps.extract_version.outputs.tag }}"
          prerelease: "${{ steps.extract_version.outputs.beta }}"
          artifacts: ./build/app/outputs/flutter-apk/*-release*.apk*
          generateReleaseNotes: true