name: Build & Publish to Zapstore

on:
  push:
    tags:
      - 'v*.*.*'   # e.g. v1.2.3

  # Allow manual trigger from Actions tab
  workflow_dispatch:

permissions:
  contents: write   # needed to create GitHub releases

jobs:
  build-and-publish:
    runs-on: ubuntu-latest

    steps:
      # ── 1. Checkout ────────────────────────────────────────────
      - name: Checkout repository
        uses: actions/checkout@v4

      # ── 2. Node / web build ────────────────────────────────────
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm

      - name: Install dependencies and build web app
        run: |
          npm install
          npm run build

      # ── 3. Java / Android toolchain ───────────────────────────
      - name: Setup Java 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3

      # ── 4. Capacitor sync ─────────────────────────────────────
      - name: Install Capacitor CLI and sync Android
        run: |
          npx cap sync android

      # ── 5. Sign the APK ───────────────────────────────────────
      # Secrets required in GitHub repo settings:
      #   KEYSTORE_BASE64   – base64-encoded .jks keystore file
      #   KEYSTORE_PASSWORD – keystore password
      #   KEY_ALIAS         – key alias inside the keystore
      #   KEY_PASSWORD      – key password
      - name: Decode keystore
        run: |
          echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 --decode > android/app/release.jks

      - name: Build signed release APK
        working-directory: android
        env:
          KEYSTORE_PATH: app/release.jks
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: |
          ./gradlew assembleRelease \
            -Pandroid.injected.signing.store.file=$KEYSTORE_PATH \
            -Pandroid.injected.signing.store.password=$KEYSTORE_PASSWORD \
            -Pandroid.injected.signing.key.alias=$KEY_ALIAS \
            -Pandroid.injected.signing.key.password=$KEY_PASSWORD

      # ── 6. Locate APK ─────────────────────────────────────────
      - name: Locate APK
        id: apk
        run: |
          APK=$(find android/app/build/outputs/apk/release -name "*.apk" | head -1)
          echo "path=$APK" >> $GITHUB_OUTPUT
          echo "Found APK: $APK"

      # ── 7. Create GitHub Release with APK ─────────────────────
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: ${{ steps.apk.outputs.path }}
          generate_release_notes: true

      # ── 8. Install zsp ────────────────────────────────────────
      - name: Install zsp
        run: |
          curl -sSL https://github.com/zapstore/zsp/releases/latest/download/zsp_linux_amd64 \
            -o /usr/local/bin/zsp
          chmod +x /usr/local/bin/zsp
          zsp --version

      # ── 9. Publish to Zapstore ────────────────────────────────
      # Secrets required:
      #   SIGN_WITH   – nsec or bunker:// URL for Nostr signing
      - name: Publish to Zapstore
        env:
          SIGN_WITH: ${{ secrets.SIGN_WITH }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELAY_URLS: wss://relay.zapstore.dev
        run: |
          zsp publish -y zapstore.yaml