android-client/.github/workflows/build-snapshot.yml

name: build snapshot

on:
  workflow_dispatch:

permissions:
  contents: read
  actions: read

concurrency:
  group: android-version-code-lock
  cancel-in-progress: false

jobs:
  build-snapshot:
    runs-on: ubuntu-latest
    environment: android-release
    env:
      NETBIRD_UPLOAD_KEY_ALIAS: ${{ secrets.NETBIRD_UPLOAD_KEY_ALIAS }}
      NETBIRD_UPLOAD_KEY_PASSWORD: ${{ secrets.NETBIRD_UPLOAD_KEY_PASSWORD }}
      NETBIRD_UPLOAD_STORE_PASSWORD: ${{ secrets.NETBIRD_UPLOAD_STORE_PASSWORD }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          # git describe below needs the tags and the history down to the
          # nearest release tag; the default shallow clone carries neither.
          fetch-depth: 0
          submodules: recursive

      # Reaches the management server as the peer's ui_version and is shown on
      # the app's about screen, so it has to say at a glance that this build was
      # signed and handed out rather than released. build-debug.yml already
      # claims the ci- prefix, and sharing it would make an unsigned PR build
      # and a signed hand-out indistinguishable in the peer list.
      # The tag is the nearest release tag in the commit's ancestry, so once a
      # new release is tagged, later snapshots pick it up on their own. If
      # describe finds no tag the step fails instead of minting a bare name.
      - name: Get version name
        id: version
        run: |
          BASE_TAG=$(git describe --tags --abbrev=0)
          SHORT_GIT_SHA=$(git rev-parse --short HEAD)
          VERSION_NAME="${BASE_TAG}-snapshot-${SHORT_GIT_SHA}"
          echo "Version name: $VERSION_NAME"
          echo "version_name=$VERSION_NAME" >> "$GITHUB_OUTPUT"

      # Must stay identical to the Compute version code step in the sibling
      # workflow. build-release.yml and build-snapshot.yml feed the same Play
      # Store listing, so they have to draw from one shared counter; a
      # github.run_number sees only its own workflow's runs and would hand out a
      # code the other already used. The concurrency group above keeps the two
      # from computing at once. Renaming either workflow file resets the count
      # GitHub keeps for it, which would send version codes backwards.
      #
      # A 404 means the workflow has never run and is not on the default branch
      # yet, which is a true zero. Any other failure aborts the build: falling
      # back to zero would mint a version code below already-published ones.
      - name: Compute version code
        id: version_code
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          count_runs() {
            local runs
            if runs=$(gh api "repos/${{ github.repository }}/actions/workflows/$1/runs?per_page=1" --jq '.total_count' 2>gh_err.txt); then
              if ! [[ "$runs" =~ ^[0-9]+$ ]]; then
                echo "::error::unexpected run count for $1: '$runs'" >&2
                return 1
              fi
              echo "$runs"
            elif grep -q 'HTTP 404' gh_err.txt; then
              echo 0
            else
              echo "::error::failed to fetch run count for $1: $(cat gh_err.txt)" >&2
              return 1
            fi
          }
          release_runs=$(count_runs build-release.yml)
          snapshot_runs=$(count_runs build-snapshot.yml)
          version_code=$((release_runs + snapshot_runs + 40))
          echo "Release runs: $release_runs, snapshot runs: $snapshot_runs -> version_code=$version_code"
          echo "version_code=$version_code" >> "$GITHUB_OUTPUT"

      - name: Write google-services.json
        run: |
          echo "${{ secrets.GOOGLE_JSON }}" | base64 -d > app/google-services.json

      - name: Write keystore file
        run: |
          echo "${{ secrets.GPLAY_KEYSTORE }}" | base64 -d > gplay.keystore
          echo "NETBIRD_UPLOAD_STORE_FILE=$GITHUB_WORKSPACE/gplay.keystore" >> "$GITHUB_ENV"

      - name: Build Android
        id: build
        uses: ./.github/actions/build-android
        with:
          version_name: ${{ steps.version.outputs.version_name }}
          version_code: ${{ steps.version_code.outputs.version_code }}
          build_type: release

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.version.outputs.version_name }}
          path: |
            ${{ steps.build.outputs.apk_path }}
            ${{ steps.build.outputs.bundle_path }}
          retention-days: 14