name: Build Android Agent

on:
  workflow_call:
    inputs:
      build_type:
        description: 'Build type (debug or release)'
        required: false
        type: string
        default: 'release'

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      RUNNER_TOOL_CACHE: /toolcache
    steps:
      - name: Configure git auth for submodules
        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"

      - uses: actions/checkout@v4
        with:
          submodules: true
          fetch-depth: 0
          token: ${{ secrets.BUILD_TOKEN }}
          persist-credentials: true

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: gradle

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3

      - name: Check for signing key
        id: check-signing
        run: |
          if [ -n "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" ]; then
            echo "has_key=true" >> "$GITHUB_OUTPUT"
            echo "Signing: Using production keystore from secrets"
          else
            echo "has_key=false" >> "$GITHUB_OUTPUT"
            echo "Signing: No keystore found, using debug/self-signed"
          fi

      - name: Decode keystore
        if: steps.check-signing.outputs.has_key == 'true'
        run: |
          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > /tmp/release.keystore

      - name: Create keystore properties
        if: steps.check-signing.outputs.has_key == 'true'
        run: |
          cat > /tmp/keystore.properties << EOF
          storePassword=${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          keyPassword=${{ secrets.ANDROID_KEY_PASSWORD }}
          keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}
          storeFile=/tmp/release.keystore
          EOF

      - name: Configure signing (production)
        if: steps.check-signing.outputs.has_key == 'true'
        working-directory: apps/android-agent
        run: |
          # Inject signing config into build.gradle.kts
          cat >> app/build.gradle.kts << 'GRADLE_EOF'

          android {
              signingConfigs {
                  create("release") {
                      storeFile = file("/tmp/release.keystore")
                      storePassword = System.getenv("KEYSTORE_PASSWORD") ?: ""
                      keyAlias = System.getenv("KEY_ALIAS") ?: ""
                      keyPassword = System.getenv("KEY_PASSWORD") ?: ""
                  }
              }
              buildTypes {
                  release {
                      signingConfig = signingConfigs.getByName("release")
                  }
              }
          }
          GRADLE_EOF
        env:
          KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}

      - name: Grant execute permission for gradlew
        working-directory: apps/android-agent
        run: chmod +x gradlew

      - name: Build debug APK (no signing key)
        if: steps.check-signing.outputs.has_key == 'false'
        working-directory: apps/android-agent
        run: ./gradlew assembleDebug

      - name: Build release APK (with signing key)
        if: steps.check-signing.outputs.has_key == 'true'
        working-directory: apps/android-agent
        run: ./gradlew assembleRelease

      - name: Upload debug APK
        if: steps.check-signing.outputs.has_key == 'false'
        uses: actions/upload-artifact@v3
        with:
          name: nexusguard-android-debug
          path: apps/android-agent/app/build/outputs/apk/debug/app-debug.apk

      - name: Upload release APK
        if: steps.check-signing.outputs.has_key == 'true'
        uses: actions/upload-artifact@v3
        with:
          name: nexusguard-android-release
          path: apps/android-agent/app/build/outputs/apk/release/app-release.apk

      - name: Upload mapping file (release only)
        if: steps.check-signing.outputs.has_key == 'true'
        uses: actions/upload-artifact@v3
        with:
          name: nexusguard-android-mapping
          path: apps/android-agent/app/build/outputs/mapping/release/mapping.txt
          if-no-files-found: warn

      - name: Cleanup keystore
        if: always()
        run: rm -f /tmp/release.keystore /tmp/keystore.properties