name: Android Build Final Fixed
on: [push]

jobs:
  build-android:
    runs-on: ubuntu-latest
    container:
      image: node:20-bookworm

    steps:
      - name: Checkout Main Project
        uses: actions/checkout@v4
        with:
          submodules: false
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Manual Clone easy-nostr
        run: |
          git clone https://${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}@gitea.malxte.de/Bytemalte/easy-nostr.git src-tauri/easy-nostr

      - name: Install System Dependencies
        run: |
          apt-get update
          apt-get install -y build-essential curl wget file libssl-dev pkg-config openjdk-17-jdk git unzip libgtk-3-dev webkit2gtk-4.1 libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev python3

      - name: Install Rust & Targets
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
          export PATH="$HOME/.cargo/bin:$PATH"
          rustup target add aarch64-linux-android wasm32-unknown-unknown

      - name: Install Trunk & Tauri-CLI
        run: |
          wget -qO- https://github.com/trunk-rs/trunk/releases/latest/download/trunk-x86_64-unknown-linux-gnu.tar.gz | tar -xzf- -C /usr/local/bin
          wget -qO- https://github.com/tauri-apps/tauri/releases/latest/download/cargo-tauri-x86_64-unknown-linux-gnu.tgz | tar -xzf- -C /usr/local/bin
          chmod +x /usr/local/bin/trunk /usr/local/bin/cargo-tauri

      - name: Setup Android SDK
        run: |
          export ANDROID_HOME=$HOME/android-sdk
          mkdir -p $ANDROID_HOME/cmdline-tools
          cd $ANDROID_HOME/cmdline-tools
          wget -q https://dl.google.com/android/repository/commandlinetools-linux-9477386_latest.zip
          unzip -q commandlinetools-linux-9477386_latest.zip
          mv cmdline-tools latest
          yes | $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager --sdk_root=$ANDROID_HOME "platform-tools" "platforms;android-33" "build-tools;33.0.1" "ndk;25.1.8937393"
          echo "ANDROID_HOME=$ANDROID_HOME" >> $GITHUB_ENV
          echo "NDK_HOME=$ANDROID_HOME/ndk/25.1.8937393" >> $GITHUB_ENV

      - name: Build and Compile
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          export ANDROID_HOME=$HOME/android-sdk
          export NDK_HOME=$ANDROID_HOME/ndk/25.1.8937393
          export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64

          # 1. Frontend bauen
          trunk build --release

          # 2. Android Build initialisieren & bauen
          if [ ! -d "src-tauri/gen/android" ]; then
            cargo-tauri android init
          fi
          cargo-tauri android build --target aarch64 --apk true

          # 3. APK manuell signieren
          echo "Verarbeite Keystore-Secret..."

          # Wir speichern das Secret in einer Datei, um Probleme mit Shell-Argument-Limits zu vermeiden
          cat <<EOF > keystore.base64
          ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          EOF

          # Wir löschen ALLES, was kein valides Base64-Zeichen ist (Space, Newlines, etc.)
          tr -dc 'a-zA-Z0-9+/=' < keystore.base64 | base64 -d > release.keystore

          # Validierung der Dateigröße
          FILE_SIZE=$(stat -c%s release.keystore)
          echo "Dekodierte Keystore-Größe: $FILE_SIZE Bytes"

          if [ "$FILE_SIZE" -lt 100 ]; then
            echo "FEHLER: Keystore ist korrupt oder zu klein!"
            exit 1
          fi

          echo "Suche unsignierte APK..."
          UNSIGNED_APK=$(find src-tauri/gen/android/app/build/outputs/apk/universal/release -name "*-unsigned.apk" | head -n 1)
          if [ -z "$UNSIGNED_APK" ]; then
            echo "FEHLER: Keine APK gefunden!"
            exit 1
          fi

          echo "Suche apksigner..."
          APKSIGNER=$(find $ANDROID_HOME/build-tools -name apksigner | sort -r | head -n 1)

          $APKSIGNER sign --ks release.keystore \
            --ks-key-alias "${{ secrets.ANDROID_KEY_ALIAS }}" \
            --ks-pass pass:"${{ secrets.ANDROID_KEYSTORE_PASSWORD }}" \
            --key-pass pass:"${{ secrets.ANDROID_KEY_PASSWORD }}" \
            --v4-signing-enabled true \
            --out Marstemedia-Signed.apk \
            "$UNSIGNED_APK"

          echo "Signierung erfolgreich!"
        env:
          JAVA_HOME: /usr/lib/jvm/java-17-openjdk-amd64

      - name: Upload Signed APK
        uses: actions/upload-artifact@v4
        with:
          name: Marstemedia-Signed
          path: Marstemedia-Signed.apk