straw/.forgejo/workflows/build.yml

# Straw APK — build on Forgejo Actions, and (gated on a green build) publish to
# fdroid.sulkta.com so the in-app updater picks it up.
#
# Runs in the dedicated git.sulkta.com/sulkta-infra/straw-build image (Android
# SDK/NDK + Rust + cargo-ndk, see ci/Dockerfile). The signing key comes from
# the STRAW_SIGNING_KEYSTORE_B64 secret (the same androiddebugkey the whole
# series is signed with — vaulted as "Sulkta — Straw fdroid signing keystore").
#
# Publish path mirrors scripts/publish-fdroid.sh: drop the APK into the Lucy
# fdroid repo + re-sign the index (both via the host docker socket, keystore
# never leaves Lucy), then stream the signed repo to Rackham web168 over a
# scoped, forced-command deploy key (STRAW_FDROID_RACKHAM_KEY).
name: build-apk

on:
  push:
    branches: [main]
    paths:
      - 'strawApp/**'
      - 'rust/**'
      - 'buildSrc/**'
      - 'gradle/**'
      - 'gradlew'
      - '*.gradle.kts'
      - 'gradle.properties'
      - 'ci/Dockerfile'
      - '.forgejo/workflows/build.yml'
  workflow_dispatch:

jobs:
  build-and-publish:
    runs-on: lucy-rust
    container:
      image: git.sulkta.com/sulkta-infra/straw-build:latest
    steps:
      - name: Checkout straw
        uses: actions/checkout@v4
        with:
          path: straw

      # strawcore is consumed by rust/strawcore via `path = "../../../strawcore"`,
      # i.e. a sibling of the straw checkout — so it MUST live next to it.
      - name: Checkout strawcore (sibling)
        uses: actions/checkout@v4
        with:
          repository: Sulkta-OSS/strawcore
          ref: main
          path: strawcore

      - name: Decode signing keystore
        env:
          KS_B64: ${{ secrets.STRAW_SIGNING_KEYSTORE_B64 }}
        run: echo "$KS_B64" | base64 -d > "$GITHUB_WORKSPACE/straw.keystore"

      - name: Assemble debug APK
        working-directory: straw
        env:
          STRAW_KEYSTORE_FILE: ${{ github.workspace }}/straw.keystore
          STRAW_KEYSTORE_PASS: android
          STRAW_KEY_ALIAS: androiddebugkey
          STRAW_KEY_PASS: android
          # Keep the 4-ABI cross-compile off the container rootfs.
          CARGO_TARGET_DIR: ${{ github.workspace }}/cargo-target
        # ionice idle class + low nice so the build yields disk/CPU to the
        # live DBs on Lucy — a 5GB build I/O-starved the MAS Postgres
        # checkpoint and dropped Matrix for ~2min on 2026-06-19.
        run: ionice -c3 nice -n 19 ./gradlew :strawApp:assembleDebug --no-daemon --stacktrace

      - name: Verify signer + stage APK
        working-directory: straw
        run: |
          set -euo pipefail
          VC=$(grep STRAW_VERSION_CODE buildSrc/src/main/kotlin/ProjectConfig.kt | grep -o '[0-9]\+')
          APK=$(ls strawApp/build/outputs/apk/debug/*.apk | head -1)
          NAME="com.sulkta.straw.debug_${VC}.apk"
          cp "$APK" "$GITHUB_WORKSPACE/$NAME"
          echo "Built vc=$VC -> $NAME"
          # The whole series is signed with SHA-1 bb9ca96b...; fail loudly if a
          # build ever produces a different signer (would break in-place updates).
          FP=$("$ANDROID_HOME/build-tools/34.0.0/apksigner" verify --print-certs "$APK" | grep -i 'SHA-1' | grep -o '[0-9a-f]\{40\}')
          echo "signer SHA-1: $FP"
          if [ "$FP" != "bb9ca96b10ebbc1ac48e037a21f350415d18915f" ]; then
            echo "::error::APK signer $FP != canonical key — refusing to publish"; exit 1
          fi
          echo "STRAW_VC=$VC" >> "$GITHUB_ENV"
          echo "STRAW_APK=$NAME" >> "$GITHUB_ENV"

      # ---- Publish: only on a real push to main, AFTER the build above passed ----
      - name: Publish to fdroid (Lucy repo + index re-sign, via host docker socket)
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          set -euo pipefail
          FDROID=git.sulkta.com/sulkta-infra/fdroid-sulkta:latest
          # Stream the APK into the host-mounted fdroid repo (helper runs as the
          # fdroid uid so ownership matches).
          docker run --rm -i -u 1000:1000 -v /mnt/cache/appdata/fdroid-sulkta/repo:/repo \
            --entrypoint sh "$FDROID" -c "cat > /repo/${STRAW_APK}" < "$GITHUB_WORKSPACE/${STRAW_APK}"
          # Re-sign the index (the index keystore lives only on Lucy).
          docker run --rm -u 1000:1000 -v /mnt/cache/appdata/fdroid-sulkta:/repo "$FDROID" update

      - name: Publish to Rackham (rsync signed repo to web168)
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          RACKHAM_KEY: ${{ secrets.STRAW_FDROID_RACKHAM_KEY }}
        run: |
          set -euo pipefail
          mkdir -p ~/.ssh && echo "$RACKHAM_KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
          ssh-keyscan -H 142.44.213.229 >> ~/.ssh/known_hosts 2>/dev/null
          FDROID=git.sulkta.com/sulkta-infra/fdroid-sulkta:latest
          # tar the signed repo out of the host-mounted volume and stream it to
          # the forced-command deploy key on Rackham (which untars + sudo-rsyncs).
          docker run --rm -u 1000:1000 -v /mnt/cache/appdata/fdroid-sulkta:/src \
            --entrypoint sh "$FDROID" -c 'tar c -C /src repo' \
            | ssh -i ~/.ssh/id_deploy kayos@142.44.213.229
          echo "Published vc=${STRAW_VC} to fdroid.sulkta.com"