action.yml

name: 'Rock Remote Build - Android'
description: 'Github implementation of the Rock Remote Build for Android'

branding:
  icon: 'box'
  color: 'green'

inputs:
  github-token:
    description: 'GitHub Token'
    required: true
  working-directory:
    description: 'Working directory for the build command'
    required: false
    default: '.'
  validate-gradle-wrapper:
    description: 'Whether to validate the Gradle wrapper'
    required: false
    default: true
  setup-java:
    description: 'Whether to run actions/setup-java action'
    required: false
    default: true
  variant:
    description: 'Build variant'
    required: false
    default: 'debug'
  aab:
    description: 'Build Android App Bundle instead of APK'
    required: false
    default: false
  rock-build-extra-params:
    description: 'Extra parameters to pass to "rock build:android"'
    required: false
  sign:
    description: 'Whether to sign the build with release keystore'
    required: false
  re-sign:
    description: Re-sign the app bundle with new JS bundle
    required: false
  ad-hoc:
    description: 'Upload the APK with index.html page'
    required: false
    default: false
  keystore-base64:
    description: 'Base64 version of the release keystore'
    required: false
  keystore-file:
    description: 'Path to the keystore file'
    required: false
  keystore-store-file:
    description: 'Keystore store file name'
    required: false
  keystore-store-password:
    description: 'Keystore store password'
    required: false
  keystore-key-alias:
    description: 'Keystore key alias'
    required: false
  keystore-key-password:
    description: 'Keystore key password'
    required: false
  keystore-path:
    description: 'Path within the Android source directory where the keystore should be placed'
    required: false
    default: 'release.keystore'
  comment-bot:
    description: 'Whether to send a comment under PR with the link to the generated build'
    required: false
    default: true
  custom-identifier:
    description: 'Custom identifier used in artifact naming for re-sign and ad-hoc flows to distinguish builds with the same native fingerprint'
    required: false
  validate-elf-alignment:
    description: 'Validate ELF alignment of native libraries (16KB page size compliance for Google Play)'
    required: false
    default: 'false'

outputs:
  artifact-url:
    description: 'URL of the relevant Android build artifact (could be cached)'
    value: ${{ steps.upload-artifact.outputs.artifact-url || env.ARTIFACT_URL }}
  artifact-id:
    description: 'ID of the relevant Android build artifact (could be cached)'
    value: ${{ steps.upload-artifact.outputs.artifact-id || env.ARTIFACT_ID }}

runs:
  using: 'composite'
  steps:
    - name: Validate Inputs
      run: |
        if [ "${{ inputs.sign }}" == "true" ]; then
          if [ -z "${{ inputs.keystore-file }}" ] && [ -z "${{ inputs.keystore-base64 }}" ]; then
            echo "Either 'keystore-file' or 'keystore-base64' is required for signed builds."
            exit 1
          fi

          # Validate keystore file actually exists if provided
          if [ -n "${{ inputs.keystore-file }}" ] && [ ! -f "${{ inputs.keystore-file }}" ]; then
            echo "Keystore file '${{ inputs.keystore-file }}' does not exist."
            exit 1
          fi

          if [ -z "${{ inputs.keystore-store-file }}" ]; then
            echo "  Input 'keystore-store-file' is required for signed builds."
            exit 1
          fi

          if [ -z "${{ inputs.keystore-store-password }}" ]; then
            echo "Input 'keystore-store-password' is required for signed builds."
            exit 1
          fi

          if [ -z "${{ inputs.keystore-key-alias }}" ]; then
            echo "Input 'keystore-key-alias' is required for signed builds."
            exit 1
          fi

          if [ -z "${{ inputs.keystore-key-password }}" ]; then
            echo "Input 'keystore-key-password' is required for signed builds."
            exit 1
          fi
        fi
      shell: bash

    - name: Native Fingerprint
      id: fingerprint
      run: |
        FINGERPRINT_OUTPUT=$(npx rock fingerprint -p android --raw) || (echo "$FINGERPRINT_OUTPUT" && exit 1)
        echo "FINGERPRINT=$FINGERPRINT_OUTPUT" >> $GITHUB_ENV
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: Set Binary Ext
      run: |
        echo "BINARY_EXT=${{ inputs.aab == 'true' && 'aab' || 'apk' }}" >> $GITHUB_ENV
      shell: bash

    - name: Get Provider Name
      run: |
        PROVIDER_NAME=$(npx rock remote-cache get-provider-name) || (echo "$PROVIDER_NAME" && exit 1)
        echo "PROVIDER_NAME=$PROVIDER_NAME" >> $GITHUB_ENV
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: Populate GitHub Token in Cache
      if: ${{ env.PROVIDER_NAME == 'GitHub' }}
      run: |
        mkdir -p .rock/cache
        echo "{\"githubToken\": \"${{ inputs.github-token }}\"}" > .rock/cache/project.json
      shell: bash
      working-directory: ${{ inputs.working-directory }}
    # We create PR-related artifacts to avoid overwriting the main artifact with new JS bundle
    - name: Check if PR-related artifact exists
      if: ${{ github.event_name == 'pull_request' && inputs.re-sign == 'true' }}
      run: |
        ARTIFACT_TRAITS="${{ inputs.variant }},${{ github.event.pull_request.number}}"
        echo "ARTIFACT_TRAITS=$ARTIFACT_TRAITS" >> $GITHUB_ENV

        OUTPUT=$(npx rock remote-cache list -p android --traits "${ARTIFACT_TRAITS}" --json) || (echo "$OUTPUT" && exit 1)
        if [ "$OUTPUT" ]; then
          echo "ARTIFACT_URL=$(echo "$OUTPUT" | jq -r '.url')" >> $GITHUB_ENV
          echo "ARTIFACT_ID=$(echo "$OUTPUT" | jq -r '.id')" >> $GITHUB_ENV
          echo "ARTIFACT_NAME=$(echo "$OUTPUT" | jq -r '.name')" >> $GITHUB_ENV
        fi
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: Check if regular artifact exists
      if: ${{ !env.ARTIFACT_NAME }}
      run: |
        ARTIFACT_TRAITS="${{ inputs.variant }}"
        echo "ARTIFACT_TRAITS=$ARTIFACT_TRAITS" >> $GITHUB_ENV

        OUTPUT=$(npx rock remote-cache list -p android --traits "${ARTIFACT_TRAITS}" --json) || (echo "$OUTPUT" && exit 1)
        if [ "$OUTPUT" ]; then
          echo "ARTIFACT_URL=$(echo "$OUTPUT" | jq -r '.url')" >> $GITHUB_ENV
          echo "ARTIFACT_ID=$(echo "$OUTPUT" | jq -r '.id')" >> $GITHUB_ENV
          echo "ARTIFACT_NAME=$(echo "$OUTPUT" | jq -r '.name')" >> $GITHUB_ENV
        fi
      shell: bash
      working-directory: ${{ inputs.working-directory }}
    - name: Set Artifact Name (if not set)
      if: ${{ !env.ARTIFACT_NAME }}
      run: |
        # Transform commas to hyphens
        ARTIFACT_TRAITS_HYPHENATED=$(echo "$ARTIFACT_TRAITS" | tr ',' '-')
        ARTIFACT_TRAITS_HYPHENATED_FINGERPRINT="${ARTIFACT_TRAITS_HYPHENATED}-${FINGERPRINT}"
        echo "ARTIFACT_NAME=rock-android-${ARTIFACT_TRAITS_HYPHENATED_FINGERPRINT}" >> $GITHUB_ENV
      shell: bash

    - name: Install Java
      if: ${{ inputs.setup-java == 'true' && !env.ARTIFACT_URL }}
      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
      with:
        java-version: 17
        distribution: adopt
        cache: gradle

    - name: Validate Gradle wrapper
      if: ${{ inputs.validate-gradle-wrapper == 'true' && !env.ARTIFACT_URL }}
      uses: gradle/actions/wrapper-validation@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1

    - name: Determine Android sourceDir and appName
      if: ${{ !env.ARTIFACT_URL || (env.ARTIFACT_URL && inputs.re-sign) }}
      run: |
        JSON_OUTPUT=$(npx rock config -p android) || (echo "$JSON_OUTPUT" && exit 1)
        echo "$JSON_OUTPUT" | jq -r '.project'
        ANDROID_SOURCE_DIR=$(echo "$JSON_OUTPUT" | jq -r '.project.android.sourceDir')
        APP_NAME=$(echo "$JSON_OUTPUT" | jq -r '.project.android.appName')
        echo "ANDROID_SOURCE_DIR=$ANDROID_SOURCE_DIR" >> $GITHUB_ENV
        echo "APP_NAME=$APP_NAME" >> $GITHUB_ENV
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: Decode and store keystore file
      if: ${{ (!env.ARTIFACT_URL && inputs.sign) || (env.ARTIFACT_URL && inputs.re-sign) }}
      run: |
        if [ -n "$APP_NAME" ]; then
          KEYSTORE_TARGET_PATH="$ANDROID_SOURCE_DIR/$APP_NAME/${{ inputs.keystore-path }}"
        else
          KEYSTORE_TARGET_PATH="$ANDROID_SOURCE_DIR/${{ inputs.keystore-path }}"
        fi

        echo "Keystore target path before normalizing: $KEYSTORE_TARGET_PATH"
        KEYSTORE_TARGET_PATH=$(realpath -m "$KEYSTORE_TARGET_PATH")
        echo "Keystore target path after normalizing: $KEYSTORE_TARGET_PATH"
        mkdir -p "$(dirname "$KEYSTORE_TARGET_PATH")" || {
          echo "Failed to create keystore directory: $(dirname "$KEYSTORE_TARGET_PATH")"
          exit 1
        }
        if [ -n "${{ inputs.keystore-file }}" ]; then
          cp "${{ inputs.keystore-file }}" "$KEYSTORE_TARGET_PATH"
          echo "Successfully copied keystore file to target path: $KEYSTORE_TARGET_PATH"
        else
          echo "${{ inputs.keystore-base64 }}" | base64 --decode > "$KEYSTORE_TARGET_PATH"
          echo "Successfully copied keystore base64 to target path: $KEYSTORE_TARGET_PATH"
        fi
        echo "KEYSTORE_TARGET_PATH=$KEYSTORE_TARGET_PATH" >> $GITHUB_ENV
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: Create local gradle.properties
      if: ${{ !env.ARTIFACT_URL && inputs.sign }}
      run: |
        mkdir -p $HOME/.gradle
        touch $HOME/.gradle/gradle.properties

        # Android standard properties (auto-recognized by AGP).
        echo "android.injected.signing.store.file=$KEYSTORE_TARGET_PATH" >> $HOME/.gradle/gradle.properties
        echo "android.injected.signing.store.password=${{ inputs.keystore-store-password }}" >> $HOME/.gradle/gradle.properties
        echo "android.injected.signing.key.alias=${{ inputs.keystore-key-alias }}" >> $HOME/.gradle/gradle.properties
        echo "android.injected.signing.key.password=${{ inputs.keystore-key-password }}" >> $HOME/.gradle/gradle.properties

        # Rock custom properties (for apps that explicitly read them in signingConfigs)
        echo "ROCK_UPLOAD_STORE_FILE=${{ inputs.keystore-store-file }}" >> $HOME/.gradle/gradle.properties
        echo "ROCK_UPLOAD_STORE_PASSWORD=${{ inputs.keystore-store-password }}" >> $HOME/.gradle/gradle.properties
        echo "ROCK_UPLOAD_KEY_ALIAS=${{ inputs.keystore-key-alias }}" >> $HOME/.gradle/gradle.properties
        echo "ROCK_UPLOAD_KEY_PASSWORD=${{ inputs.keystore-key-password }}" >> $HOME/.gradle/gradle.properties
      shell: bash

    - name: Build Android
      if: ${{ !env.ARTIFACT_URL }}
      run: |
        npx rock build:android \
          --variant "${{ inputs.variant }}" \
          ${{ env.BINARY_EXT == 'aab' && '--aab' || '' }} \
          ${{ inputs.rock-build-extra-params }}
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: Find Build Artifact
      if: ${{ !env.ARTIFACT_URL }}
      run: |
        BINARY_PATH=$(find $ANDROID_SOURCE_DIR/$APP_NAME/build/outputs -name '*.${{ env.BINARY_EXT }}' | head -1 )
        echo BINARY_PATH $BINARY_PATH
        echo "ARTIFACT_PATH=$BINARY_PATH" >> $GITHUB_ENV
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: Validate ELF Alignment
      if: ${{ inputs.validate-elf-alignment == 'true' && !env.ARTIFACT_URL && env.ARTIFACT_PATH }}
      run: |
        npx rock validate-elf-alignment "${{ env.ARTIFACT_PATH }}"
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: Download and Unpack Binary
      if: ${{ env.ARTIFACT_URL && inputs.re-sign == 'true' }}
      run: |
        DOWNLOAD_OUTPUT=$(npx rock remote-cache download --name ${{ env.ARTIFACT_NAME }} --json) || (echo "$DOWNLOAD_OUTPUT" && exit 1)
        BINARY_PATH=$(echo "$DOWNLOAD_OUTPUT" | jq -r '.path')
        echo "ARTIFACT_PATH=$BINARY_PATH" >> $GITHUB_ENV
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: Re-sign Binary
      if: ${{ env.ARTIFACT_URL && inputs.re-sign == 'true' }}
      run: |
        npx rock sign:android "${{ env.ARTIFACT_PATH }}" \
          --build-jsbundle \
          --keystore "$KEYSTORE_TARGET_PATH" \
          --keystore-password "${{ inputs.keystore-store-password }}" \
          --key-alias "${{ inputs.keystore-key-alias }}" \
          --key-password "${{ inputs.keystore-key-password }}"
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: Set Identifier
      if: ${{ inputs.re-sign == 'true' || inputs.ad-hoc == 'true' }}
      run: |
        if [ -n "${{ inputs.custom-identifier }}" ]; then
          IDENTIFIER="${{ inputs.custom-identifier }}"
          if ! echo "$IDENTIFIER" | grep -qE '^[a-zA-Z0-9._-]+$'; then
            echo "Invalid 'custom-identifier': '$IDENTIFIER'. Use only alphanumeric characters, hyphens, dots, and underscores."
            exit 1
          fi
        elif [ "${{ github.event_name }}" = "pull_request" ]; then
          IDENTIFIER="${{ github.event.pull_request.number }}"
        else
          IDENTIFIER=$(echo "$GITHUB_SHA" | cut -c1-7)
        fi
        echo "IDENTIFIER=$IDENTIFIER" >> $GITHUB_ENV
      shell: bash

    # Non-ad-hoc re-sign flow: add identifier to ARTIFACT_NAME so the re-signed ZIP Artifact doesn't overwrite the base ZIP.
    # Skipped for ad-hoc — ARTIFACT_NAME stays fingerprint-only (one ZIP Artifact per fingerprint).
    - name: Update Artifact Name for re-signed builds
      if: ${{ env.ARTIFACT_URL && inputs.re-sign == 'true' && inputs.ad-hoc != 'true' }}
      run: |
        ARTIFACT_TRAITS="${{ inputs.variant }},${IDENTIFIER}"
        ARTIFACT_TRAITS_HYPHENATED=$(echo "$ARTIFACT_TRAITS" | tr ',' '-')
        ARTIFACT_TRAITS_HYPHENATED_FINGERPRINT="${ARTIFACT_TRAITS_HYPHENATED}-${FINGERPRINT}"
        echo "ARTIFACT_NAME=rock-android-${ARTIFACT_TRAITS_HYPHENATED_FINGERPRINT}" >> $GITHUB_ENV
        echo "ARTIFACT_TRAITS=$ARTIFACT_TRAITS" >> $GITHUB_ENV
      shell: bash

    # Find artifact URL again before uploading, as other concurrent workflows could upload the same artifact
    - name: Find artifact URL again before uploading
      run: |
        OUTPUT=$(npx rock remote-cache list --name ${{ env.ARTIFACT_NAME }} --json) || (echo "$OUTPUT" && exit 1)
        if [ -z "$OUTPUT" ]; then
          echo "No artifact found"
        else
          echo "ARTIFACT_URL=$(echo "$OUTPUT" | jq -r '.url')" >> $GITHUB_ENV
          echo "ARTIFACT_ID=$(echo "$OUTPUT" | jq -r '.id')" >> $GITHUB_ENV
        fi
      shell: bash
      working-directory: ${{ inputs.working-directory }}
    # Special case for GitHub, as it doesn't support uploading through the API
    - name: Upload Artifact to GitHub
      id: upload-artifact
      if: ${{ env.PROVIDER_NAME == 'GitHub' && (!env.ARTIFACT_URL || inputs.re-sign == 'true') }}
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
      with:
        name: ${{ env.ARTIFACT_NAME }}
        path: ${{ env.ARTIFACT_PATH }}
        if-no-files-found: error

    # Non-ad-hoc re-sign flow: upload ZIP Artifact with {identifier}-{fingerprint} name
    # For re-signed builds, the ARTIFACT_NAME may contain PR-number, while Rock will save the artifact without PR trait in its cache.
    # We need to upload the artifact with the PR-number in the name, that's why we use --binary-path with appropriate ARTIFACT_PATH that accounts for it.
    - name: Upload re-signed ZIP Artifact for non-ad-hoc flow
      if: ${{ env.PROVIDER_NAME != 'GitHub' && inputs.re-sign == 'true' && inputs.ad-hoc != 'true' }}
      run: |
        OUTPUT=$(npx rock remote-cache upload --name ${{ env.ARTIFACT_NAME }} --binary-path "${{ env.ARTIFACT_PATH }}" --json --verbose) || (echo "$OUTPUT" && exit 1)
        echo "ARTIFACT_URL=$(echo "$OUTPUT" | jq -r '.url')" >> $GITHUB_ENV
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    # Upload ZIP Artifact with {fingerprint}-only name as base ZIP Artifact for caching only (first build only).
    # Runs only when no cached artifact exists (!ARTIFACT_URL), meaning native build was done from scratch.
    # Excludes non-ad-hoc re-sign, which uploads with identifier in the name.
    # Applies to:
    # - regular builds (no ad-hoc, no re-sign)
    # - re-sign with ad-hoc
    - name: Upload ZIP Artifact for caching
      if: ${{ env.PROVIDER_NAME != 'GitHub' && !env.ARTIFACT_URL && (inputs.re-sign != 'true' || inputs.ad-hoc == 'true') }}
      run: |
        OUTPUT=$(npx rock remote-cache upload --name ${{ env.ARTIFACT_NAME }} --json --verbose) || (echo "$OUTPUT" && exit 1)
        echo "ARTIFACT_URL=$(echo "$OUTPUT" | jq -r '.url')" >> $GITHUB_ENV
      shell: bash
      working-directory: ${{ inputs.working-directory }}


    # Ad-hoc uploads always include an identifier in the name {identifier}-{fingerprint}
    - name: Set Ad-Hoc Artifact Name
      if: ${{ inputs.ad-hoc == 'true' }}
      run: |
        ADHOC_TRAITS="${{ inputs.variant }},${IDENTIFIER}"
        ADHOC_TRAITS_HYPHENATED=$(echo "$ADHOC_TRAITS" | tr ',' '-')
        echo "ADHOC_ARTIFACT_NAME=rock-android-${ADHOC_TRAITS_HYPHENATED}-${FINGERPRINT}" >> $GITHUB_ENV
      shell: bash

    # Uploads APK/AAB + index.html under ad-hoc/{ADHOC_ARTIFACT_NAME}/.
    # The ARTIFACT_URL output points to index.html
    - name: Upload for Ad-hoc distribution
      if: ${{ env.PROVIDER_NAME != 'GitHub' && inputs.ad-hoc == 'true' }}
      run: |
        OUTPUT=$(npx rock remote-cache upload --name ${{ env.ADHOC_ARTIFACT_NAME }} --binary-path "${{ env.ARTIFACT_PATH }}" --json --ad-hoc) || (echo "$OUTPUT" && exit 1)
        echo "ARTIFACT_URL=$(echo "$OUTPUT" | jq -r '.url')" >> $GITHUB_ENV
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: Delete Old Re-Signed Artifacts
      if: ${{ env.ARTIFACT_URL && inputs.re-sign == 'true' && github.event_name == 'pull_request' }}
      run: |
        npx rock remote-cache delete --name ${{ env.ARTIFACT_NAME }} --all-but-latest --json
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: Clean Up Keystore
      if: ${{ (!env.ARTIFACT_URL && inputs.sign) || (env.ARTIFACT_URL && inputs.re-sign) }}
      run: |
        if [ -n "$APP_NAME" ]; then
          rm "$ANDROID_SOURCE_DIR/$APP_NAME/${{ inputs.keystore-path }}"
        else
          rm "$ANDROID_SOURCE_DIR/${{ inputs.keystore-path }}"
        fi
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: Clean Up gradle properties (signed builds only)
      if: ${{ !env.ARTIFACT_URL && inputs.sign }}
      run: |
        rm $HOME/.gradle/gradle.properties
      shell: bash
      working-directory: ${{ inputs.working-directory }}

    - name: Post Build
      if: ${{ github.event_name == 'pull_request' && inputs.comment-bot == 'true' }}
      uses: callstackincubator/android/.github/actions/rock-post-build@v3
      with:
        title: Android ${{ inputs.variant }} Binary for all devices
        artifact-url: ${{ steps.upload-artifact.outputs.artifact-url || env.ARTIFACT_URL }}
        github-token: ${{ inputs.github-token }}