android.yml

name: Android Build & Release

on:
  workflow_call:
  push:
    tags:
      - "release/android-*"
  schedule:
    - cron: "30 0 * 4-9 *"
    - cron: "0 6 * 4-9 *"
    - cron: "30 23 * 1,2,3,10,11,12 *"
    - cron: "0 5 * 1,2,3,10,11,12 *"
  workflow_dispatch:
    inputs:
      buildType:
        description: "Build type (debug|dev|release)"
        default: "release"
        required: true
        type: choice
        options:
          - debug
          - dev
          - release
jobs:
  determine-env:
    runs-on: ubuntu-latest
    outputs:
      env_name: ${{ steps.set_env.outputs.env_name }}
    steps:
      - id: set_env
        run: |
          # Map buildType to environment name
          TYPE="${{ inputs.buildType || '' }}"
          EVENT="${{ github.event_name }}"
          if [ -z "$TYPE" ]; then TYPE="release"; fi
          # Default scheduled runs to release
          if [ "$EVENT" = "schedule" ]; then TYPE="release"; fi
          ENV_NAME="development"
          if [ "$TYPE" = "release" ]; then ENV_NAME="production"; fi
          if [ "$TYPE" = "dev" ]; then ENV_NAME="development"; fi
          echo "env_name=$ENV_NAME" >> $GITHUB_OUTPUT
          echo "Environment name: $ENV_NAME"
  android:
    runs-on: ubuntu-latest
    needs: determine-env
    environment: ${{ needs.determine-env.outputs.env_name }}
    env:
      # GitHub Packages (Flow Wallet Kit + wallet-core)
      GITHUB_USERNAME: ${{ secrets.GPR_USER }}
      GITHUB_TOKEN: ${{ secrets.GPR_KEY }}
      # Also expose as Gradle properties preferred by our build
      GPR_USER: ${{ secrets.GPR_USER }}
      GPR_KEY: ${{ secrets.GPR_KEY }}

      # Firebase App Distribution (optional; used on release paths/tags)
      FIREBASE_TESTERS: ${{ vars.FIREBASE_TESTERS }}
      # Backward-compat names from previous repo
      LOCAL_PROPERTIES: ${{ secrets.LOCAL_PROPERTIES }}
      KEY_PROPERTIES: ${{ secrets.KEY_PROPERTIES }}
      KEY_PROPERTIES_B64: ${{ secrets.KEY_PROPERTIES_B64 }}
      GOOGLE_SERVICES: ${{ secrets.GOOGLE_SERVICES }}
      GOOGLE_SERVICES_B64: ${{ secrets.GOOGLE_SERVICES_B64 }}
      SERVICE_ACCOUNT_JSON: ${{ secrets.SERVICE_ACCOUNT_JSON }}
      FASTLANE_SA: ${{ secrets.FASTLANE_SA }}
      KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
      # Debug keystore location set in step using RUNNER_TEMP

      # Monorepo paths
      RN_APP_DIR: apps/react-native
      ANDROID_DIR: apps/react-native/android

    steps:
      - name: Checkout (with submodules)
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref != '' && github.ref || github.event.ref }}
          fetch-depth: 0
          submodules: recursive

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build monorepo packages
        run: pnpm -r --filter='./packages/*' build

      - name: Regenerate RN bridge models
        run: pnpm -F "frw-rn" codegen:bridge

      - name: Setup Java 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Install Android SDK components
        shell: bash
        run: |
          yes | sudo ${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin/sdkmanager \
            "platform-tools" \
            "platforms;android-35" \
            "build-tools;35.0.0" \
            "platforms;android-36" || true

      - name: Prepare Android config files
        shell: bash
        run: |
          set -euo pipefail
          cd "$ANDROID_DIR"

          # Configure Gradle properties for GitHub Packages auth
          mkdir -p "$HOME/.gradle"
          {
            echo "gpr.user=${GPR_USER:-}"
            echo "gpr.key=${GPR_KEY:-}"
          } >> "$HOME/.gradle/gradle.properties"

          # Always ensure local.properties exists
          if [ -n "${LOCAL_PROPERTIES:-}" ]; then
            echo "[Android CI] Writing local.properties from LOCAL_PROPERTIES secret (raw)"
            printf '%s' "$LOCAL_PROPERTIES" > local.properties
          else
            echo "[Android CI] Creating minimal local.properties"
            {
              echo "sdk.dir=${ANDROID_SDK_ROOT}"
              echo "testers=${FIREBASE_TESTERS:-}"
            } > local.properties
          fi

          # Ensure local.properties ends with a newline to avoid concatenated appends
          if [ -f local.properties ]; then
            END_CHAR=$(tail -c1 local.properties || true)
            if [ -n "${END_CHAR}" ] && [ "${END_CHAR}" != $'\n' ]; then
              printf '\n' >> local.properties
            fi
          fi

          # Optional: Google Services JSONs (multiple supported secret names)
          if [ -n "${GOOGLE_SERVICES:-}" ]; then
            echo "[Android CI] Writing GOOGLE_SERVICES (raw) to app/src/dev/google-services.json"
            mkdir -p app/src/dev
            printf '%s' "$GOOGLE_SERVICES" > app/src/dev/google-services.json || true
            # Also place a default copy for plugins that expect default location
            printf '%s' "$GOOGLE_SERVICES" > app/google-services.json || true
          fi
          if [ -n "${GOOGLE_SERVICES_B64:-}" ]; then
            echo "[Android CI] Decoding GOOGLE_SERVICES_B64 to app/google-services.json"
            echo "$GOOGLE_SERVICES_B64" | base64 -d > app/google-services.json || true
          fi
          if [ -n "${{ secrets.ANDROID_GOOGLE_SERVICES_DEV_B64 }}" ]; then
            echo "${{ secrets.ANDROID_GOOGLE_SERVICES_DEV_B64 }}" | base64 -d > app/google-services.json || true
          fi
          if [ -n "${{ secrets.ANDROID_GOOGLE_SERVICES_PROD_B64 }}" ]; then
            mkdir -p app/src/release
            echo "${{ secrets.ANDROID_GOOGLE_SERVICES_PROD_B64 }}" | base64 -d > app/src/release/google-services.json || true
          fi

          # Optional: key.properties (multiple supported secret names)
          if [ -n "${KEY_PROPERTIES:-}" ]; then
            echo "[Android CI] Writing KEY_PROPERTIES (raw) to key.properties"
            printf '%s' "$KEY_PROPERTIES" > key.properties
          elif [ -n "${KEY_PROPERTIES_B64:-}" ]; then
            echo "[Android CI] Decoding KEY_PROPERTIES_B64 to key.properties"
            echo "$KEY_PROPERTIES_B64" | base64 -d > key.properties
          elif [ -n "${{ secrets.ANDROID_KEY_PROPERTIES_B64 }}" ]; then
            echo "${{ secrets.ANDROID_KEY_PROPERTIES_B64 }}" | base64 -d > key.properties
          fi

          # Optional: Decode keystore if provided and wire via local.properties (safer handling)
          KEYSTORE_DATA='${{ secrets.KEYSTORE_BASE64 }}'
          if [ -n "$KEYSTORE_DATA" ]; then
            echo "[Android CI] Preparing keystore from injected secret"
            # Resolve desired keystore path: honor existing storeFile in local.properties if present
            EXISTING_STORE_FILE=$(grep -E '^storeFile=' local.properties | sed -E 's/^storeFile=//') || true
            if [ -n "${EXISTING_STORE_FILE:-}" ]; then
              case "$EXISTING_STORE_FILE" in
                /*) KEYSTORE_PATH="$EXISTING_STORE_FILE" ;;
                *)  KEYSTORE_PATH="$(pwd)/app/$EXISTING_STORE_FILE" ;;
              esac
            else
              KEYSTORE_PATH="$(pwd)/app/keystore.jks"
            fi
            mkdir -p "$(dirname "$KEYSTORE_PATH")"
            # Use printf to avoid injecting a trailing newline; avoid passing secret on command line
            printf '%s' "$KEYSTORE_DATA" | base64 -d > "$KEYSTORE_PATH"
            chmod 600 "$KEYSTORE_PATH"
            # Ensure local.properties points to the decoded keystore path
            if grep -q '^storeFile=' local.properties; then
              sed -i.bak "s|^storeFile=.*$|storeFile=$KEYSTORE_PATH|" local.properties && rm -f local.properties.bak
            else
              echo "storeFile=$KEYSTORE_PATH" >> local.properties
            fi
          fi

          # Optional: Firebase App Distribution service account
          SERVICE_JSON_PATH=""
          if [ -n "${SERVICE_ACCOUNT_JSON:-}" ]; then
            echo "[Android CI] Writing SERVICE_ACCOUNT_JSON (raw) to firebase-appdist.json"
            printf '%s' "$SERVICE_ACCOUNT_JSON" > firebase-appdist.json
            SERVICE_JSON_PATH="$(pwd)/firebase-appdist.json"
          fi

          # Optional: Google Play Publisher service account (prefer FASTLANE_SA if present)
          PLAY_JSON_PATH=""
          if [ -n "${FASTLANE_SA:-}" ]; then
            echo "[Android CI] Writing FASTLANE_SA (raw) to play-service-account.json"
            printf '%s' "$FASTLANE_SA" > play-service-account.json
            PLAY_JSON_PATH="$(pwd)/play-service-account.json"
          fi

          if [ -n "$SERVICE_JSON_PATH" ] || [ -n "$PLAY_JSON_PATH" ]; then
            # Ensure local.properties includes serviceCredentialsFile & testers
            # First, guarantee file ends with a newline to avoid concatenation
            if [ -s local.properties ]; then
              LAST_CHAR=$(tail -c1 local.properties || true)
              if [ -n "${LAST_CHAR}" ] && [ "${LAST_CHAR}" != $'\n' ]; then
                printf '\n' >> local.properties
              fi
            fi
            # Remove any existing (possibly malformed) lines and append fresh ones
            sed -i.bak -E '/^serviceCredentialsFile=/d; /^playServiceAccountFile=/d' local.properties && rm -f local.properties.bak || true
            if [ -n "$SERVICE_JSON_PATH" ]; then
              echo "serviceCredentialsFile=$SERVICE_JSON_PATH" >> local.properties
              echo "[Android CI] serviceCredentialsFile set to: $SERVICE_JSON_PATH"
            fi
            # For Play: prefer dedicated FASTLANE_SA; otherwise fallback to SERVICE_ACCOUNT_JSON if present
            if [ -n "$PLAY_JSON_PATH" ]; then
              echo "playServiceAccountFile=$PLAY_JSON_PATH" >> local.properties
              echo "[Android CI] playServiceAccountFile set to: $PLAY_JSON_PATH"
            elif [ -n "$SERVICE_JSON_PATH" ]; then
              echo "playServiceAccountFile=$SERVICE_JSON_PATH" >> local.properties
              echo "[Android CI] playServiceAccountFile set to (fallback): $SERVICE_JSON_PATH"
            fi
            # Prefer Environment variable for testers
            if ! grep -q '^testers=' local.properties; then
              echo "testers=${FIREBASE_TESTERS:-}" >> local.properties
            else
              # If testers already present but empty and we have a value, update it
              CURR_TESTERS=$(grep -E '^testers=' local.properties | sed -E 's/^testers=//') || true
              if [ -z "$CURR_TESTERS" ] && [ -n "${FIREBASE_TESTERS:-}" ]; then
                sed -i.bak "s|^testers=.*$|testers=${FIREBASE_TESTERS}|" local.properties && rm -f local.properties.bak
              fi
            fi
            # Minimal diagnostics: confirm paths set
            grep -E '^(serviceCredentialsFile|playServiceAccountFile)=' local.properties || true
          fi

      - name: Ensure debug keystore path is writable
        shell: bash
        run: |
          set -euo pipefail
          # Use writable temp directory for debug keystore
          XDG_CONFIG_HOME="${RUNNER_TEMP:-$HOME}"
          ANDROID_SDK_HOME="${RUNNER_TEMP:-$HOME}"
          echo "XDG_CONFIG_HOME=$XDG_CONFIG_HOME" >> $GITHUB_ENV
          echo "ANDROID_SDK_HOME=$ANDROID_SDK_HOME" >> $GITHUB_ENV
          mkdir -p "$XDG_CONFIG_HOME/.android"
          if [ ! -f "$XDG_CONFIG_HOME/.android/debug.keystore" ]; then
            echo "[Android CI] Generating default debug.keystore under $XDG_CONFIG_HOME/.android"
            keytool -genkeypair -v -noprompt \
              -keystore "$XDG_CONFIG_HOME/.android/debug.keystore" \
              -storepass android \
              -alias androiddebugkey \
              -keypass android \
              -keyalg RSA \
              -keysize 2048 \
              -validity 10000 \
              -dname "CN=Android Debug,O=Android,C=US" || true
          fi

      - name: Determine build type
        id: meta
        shell: bash
        run: |
          # Decide buildType: PRs -> debug; Tag-based releases -> release
          INPUT="${{ github.event_name }}:${{ github.ref }}:${{ inputs.buildType }}"
          TYPE="release"
          if [[ "${{ github.event_name }}" == "schedule" ]]; then
            TYPE="release"
          fi
          # Compute REF from push/create
          REF="${{ github.ref }}"
          if [ -z "$REF" ]; then REF="${{ github.event.ref }}"; fi
          case "$REF" in
            refs/tags/release/android-*|release/android-*)
              TYPE="release" ;;
            refs/tags/release/mob-*|release/mob-*)
              TYPE="release" ;;
            refs/tags/release/rn-*|release/rn-*)
              TYPE="release" ;;
            refs/heads/release/*)
              TYPE="dev" ;;
          esac
          if [[ -n "${{ inputs.buildType }}" ]]; then TYPE="${{ inputs.buildType }}"; fi
          echo "buildType=$TYPE" >> $GITHUB_OUTPUT
          echo "Resolved build type: $TYPE"

      - name: Resolve next versionCode (release only)
        if: steps.meta.outputs.buildType == 'release'
        shell: bash
        working-directory: ${{ env.ANDROID_DIR }}
        run: |
          set -euo pipefail
          # Simple scheme: vCode = 400000000 + GITHUB_RUN_NUMBER
          BASE=400000000
          RUN_NUM=${GITHUB_RUN_NUMBER:-0}
          NEXT=$(( BASE + RUN_NUM ))
          # Ensure we never go backwards vs current file value
          CUR=$(grep -E '^vCode=' gradle.properties | sed -E 's/^vCode=//' || true)
          if [[ -n "${CUR:-}" ]] && [ "$NEXT" -le "$CUR" ]; then
            NEXT=$(( CUR + 1 ))
          fi
          echo "[Android CI] Using versionCode (vCode) = $NEXT"
          if grep -q '^vCode=' gradle.properties; then
            sed -i.bak "s/^vCode=.*/vCode=$NEXT/" gradle.properties && rm -f gradle.properties.bak
          else
            echo "vCode=$NEXT" >> gradle.properties
          fi

      - name: Signing diagnostics
        shell: bash
        working-directory: ${{ env.ANDROID_DIR }}
        run: |
          set -euo pipefail
          echo "[Diag] Environment: ${{ needs.determine-env.outputs.env_name }}"
          echo "[Diag] buildType: ${{ steps.meta.outputs.buildType }}"
          if [ -f local.properties ]; then
            echo "[Diag] local.properties exists"
            # Only print non-sensitive fields
            grep -E '^(storeFile|keyAlias)=' local.properties || true
            # Print Firebase/Play credentials file paths from local.properties
            SVC_FILE=$(grep -E '^serviceCredentialsFile=' local.properties | sed -E 's/^serviceCredentialsFile=//') || true
            PLAY_FILE=$(grep -E '^playServiceAccountFile=' local.properties | sed -E 's/^playServiceAccountFile=//') || true
            REL_NOTES=$(grep -E '^releaseNotesFile=' local.properties | sed -E 's/^releaseNotesFile=//') || true
            if [ -n "${SVC_FILE:-}" ]; then
              echo "[Diag] serviceCredentialsFile: $SVC_FILE"
              if [ -f "$SVC_FILE" ]; then
                echo "[Diag] Firebase credentials present at: $SVC_FILE (size: $(wc -c < "$SVC_FILE" | tr -d ' '))"
              else
                echo "[Diag] Firebase credentials file not found at: $SVC_FILE"
                ls -la "$(dirname "$SVC_FILE")" || true
              fi
            else
              echo "[Diag] serviceCredentialsFile not set in local.properties"
            fi
            if [ -n "${PLAY_FILE:-}" ]; then
              echo "[Diag] playServiceAccountFile: $PLAY_FILE"
              if [ -f "$PLAY_FILE" ]; then
                echo "[Diag] Play credentials present at: $PLAY_FILE (size: $(wc -c < "$PLAY_FILE" | tr -d ' '))"
              else
                echo "[Diag] Play credentials file not found at: $PLAY_FILE"
                ls -la "$(dirname "$PLAY_FILE")" || true
              fi
            else
              echo "[Diag] playServiceAccountFile not set in local.properties"
            fi
            if [ -n "${REL_NOTES:-}" ]; then
              echo "[Diag] releaseNotesFile: $REL_NOTES"
            fi
            STORE_FILE=$(grep -E '^storeFile=' local.properties | sed -E 's/^storeFile=//') || true
            if [ -n "${STORE_FILE:-}" ]; then
              if [ -f "$STORE_FILE" ]; then
                echo "[Diag] Keystore file exists at: $STORE_FILE"
                echo "[Diag] Keystore size (bytes): $(wc -c < "$STORE_FILE" | tr -d ' ')"
              else
                echo "[Diag] Keystore file not found at: $STORE_FILE"
                ls -la "$(dirname "$STORE_FILE")" || true
              fi
            else
              echo "[Diag] storeFile not set in local.properties"
            fi
          else
            echo "[Diag] local.properties missing"
          fi

      - name: Build Android (${{ steps.meta.outputs.buildType }})
        working-directory: ${{ env.ANDROID_DIR }}
        run: |
          case "${{ steps.meta.outputs.buildType }}" in
            debug)
              ./gradlew :app:assembleDebug --stacktrace
              ;;
            dev)
              ./gradlew :app:assembleDev --stacktrace
              ;;
            release)
              ./gradlew :app:assembleRelease --stacktrace
              ;;
          esac

      - name: Build Android App Bundle (.aab)
        if: steps.meta.outputs.buildType == 'dev' || steps.meta.outputs.buildType == 'release'
        working-directory: ${{ env.ANDROID_DIR }}
        run: |
          case "${{ steps.meta.outputs.buildType }}" in
            dev)
              ./gradlew :app:bundleDev --stacktrace
              ;;
            release)
              ./gradlew :app:bundleRelease --stacktrace
              ;;
          esac

      - name: Generate release notes (last 3 days)
        if: steps.meta.outputs.buildType == 'dev' || steps.meta.outputs.buildType == 'release'
        shell: bash
        run: |
          set -euo pipefail
          REPO_ROOT="$GITHUB_WORKSPACE"
          NOTES_FILE="$REPO_ROOT/apps/react-native/android/release-notes.txt"
          echo "[Android CI] Generating release notes..."

          # Ensure sufficient git history for logs
          (git fetch --unshallow 2>/dev/null || git fetch --deepen=50) || true

          # Compute date 3 days ago (GNU date on ubuntu)
          SINCE_DATE=$(date -d '3 days ago' '+%Y-%m-%d')

          {
            echo "What's New in This Build"
            echo "========================"
            echo

            # Collect merge commits and extract PR + issue info
            MERGES=$(git log --since="$SINCE_DATE" --merges --pretty=format:'%H|%s|%b|%ct' 2>/dev/null || true)
            if [ -n "$MERGES" ]; then
              TMP_ITEMS=$(mktemp)
              while IFS='|' read -r commit_hash subject body ts; do
                [ -z "${commit_hash:-}" ] && continue
                PR_AND_SLUG=$(echo "$subject" | sed -n 's/.*Merge pull request #\([0-9][0-9]*\) from [^/]*\/\([^ ]*\).*/\1|\2/p')
                [ -z "${PR_AND_SLUG:-}" ] && continue
                PR_NUM=$(echo "$PR_AND_SLUG" | cut -d'|' -f1)
                BRANCH_SLUG=$(echo "$PR_AND_SLUG" | cut -d'|' -f2)
                ISSUE_NUM=$(echo "$BRANCH_SLUG" | sed -n 's/^\([0-9][0-9]*\).*/\1/p')
                PR_TITLE=$(echo "$body" | sed -n '/./{s/^\s*//;p;q;}')
                if [ -z "${PR_TITLE:-}" ]; then
                  PR_TITLE=$(echo "$BRANCH_SLUG" | sed -E 's/^[0-9]+-//' | sed -E 's/[-_]+/ /g')
                  PR_TITLE=$(awk 'BEGIN{FS="\n"} {if (length($0)>0){$1=toupper(substr($1,1,1)) substr($1,2)}; print}' <<< "$PR_TITLE")
                fi
                echo "$ts|$ISSUE_NUM|$PR_TITLE|$PR_NUM" >> "$TMP_ITEMS"
              done < <(echo "$MERGES")

              if [ -s "$TMP_ITEMS" ]; then
                echo "Resolved Issues:"
                sort -t'|' -k1 -nr "$TMP_ITEMS" | awk -F'|' 'BEGIN{OFS="|"} { key = ($2 != "" ? $2 : $4); if (!seen[key]++) print $0; }' |
                while IFS='|' read -r _ts issue title pr; do
                  if [ -n "$issue" ]; then
                    echo "  • #$issue: $title (PR #$pr)"
                  else
                    echo "  • $title (PR #$pr)"
                  fi
                done
                echo
                echo "------------------------"
                echo
              fi
            fi

            echo "Recent Changes:"
            echo
            git log --since="$SINCE_DATE" --pretty=format:'  • %s (%an)' | head -8 || true
            RECENT_COUNT=$(git log --since="$SINCE_DATE" --oneline 2>/dev/null | wc -l | tr -d ' ')
            if [ "${RECENT_COUNT:-0}" -eq 0 ]; then
              echo "  • No commits in last 3 days"
              git log --pretty=format:'  • %s (%an, %ar)' | head -5 || true
            fi

            echo
            echo "------------------------"
            echo
            echo "Build Information:"
            echo "  • Build Date (Sydney): $(TZ=Australia/Sydney date '+%Y-%m-%d %H:%M %Z')"
            echo "  • Branch: $(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo 'detached')"
            echo "  • Latest Commit: $(git log -1 --pretty=format:'%h - %s' 2>/dev/null || true)"
            echo "  • Total Commits (3 days): $(git log --since="$SINCE_DATE" --oneline 2>/dev/null | wc -l | tr -d ' ')"

            echo
            echo "------------------------"
            echo
            echo "Thank you for testing!"
          } > "$NOTES_FILE"

          echo "[Android CI] Release notes written to $NOTES_FILE"
          # Ensure Gradle plugin reads the release notes file via local.properties
          ANDROID_DIR_PATH="$REPO_ROOT/${{ env.ANDROID_DIR }}"
          if [ -f "$ANDROID_DIR_PATH/local.properties" ]; then
            if grep -q '^releaseNotesFile=' "$ANDROID_DIR_PATH/local.properties"; then
              sed -i.bak "s|^releaseNotesFile=.*$|releaseNotesFile=$NOTES_FILE|" "$ANDROID_DIR_PATH/local.properties" && rm -f "$ANDROID_DIR_PATH/local.properties.bak"
            else
              echo "releaseNotesFile=$NOTES_FILE" >> "$ANDROID_DIR_PATH/local.properties"
            fi
          fi

      - name: Prepare Play release notes (whatsnew)
        if: steps.meta.outputs.buildType == 'release'
        shell: bash
        run: |
          set -euo pipefail
          SRC_FILE="apps/react-native/android/release-notes.txt"
          DEST_DIR="apps/react-native/android/app/src/release/play/release-notes/en-US"
          DEST_FILE="$DEST_DIR/default.txt"
          if [ ! -f "$SRC_FILE" ]; then
            echo "[Android CI] No release notes file found at $SRC_FILE; skipping whatsnew preparation."
            exit 0
          fi
          mkdir -p "$DEST_DIR"
          # Ensure <= 500 bytes while preserving the tail (keeps build info)
          BYTES=$(wc -c < "$SRC_FILE" | tr -d ' ' || echo 0)
          mkdir -p "$DEST_DIR"
          if [ "${BYTES:-0}" -le 500 ]; then
            # Normalize CRLF to LF
            sed -e 's/\r$//' "$SRC_FILE" > "$DEST_FILE"
          else
            # Keep last 500 bytes so the trailing build info is preserved
            tail -c 500 "$SRC_FILE" | sed -e 's/\r$//' > "$DEST_FILE"
          fi
          echo "[Android CI] Wrote Play whatsnew to $DEST_FILE ($(wc -c < "$DEST_FILE" | tr -d ' ') bytes)"
          echo "[Android CI] Prepared Play 'whatsnew' at $DEST_FILE"

      - name: Upload release notes
        if: steps.meta.outputs.buildType == 'dev' || steps.meta.outputs.buildType == 'release'
        uses: actions/upload-artifact@v4
        with:
          name: android-${{ steps.meta.outputs.buildType }}-release-notes
          path: apps/react-native/android/release-notes.txt
          if-no-files-found: warn

      - name: Upload APK artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: android-${{ steps.meta.outputs.buildType }}-apk
          path: |
            apps/react-native/android/app/build/outputs/apk/**/**/*.apk
          if-no-files-found: warn

      - name: Upload AAB artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: android-${{ steps.meta.outputs.buildType }}-aab
          path: |
            apps/react-native/android/app/build/outputs/bundle/**/**/*.aab
          if-no-files-found: warn

      - name: Attach APK/AAB to GitHub Release (release only)
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/release/') && steps.meta.outputs.buildType == 'release'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPOSITORY: ${{ github.repository }}
          TAG_NAME: ${{ github.ref_name }}
        shell: bash
        run: |
          set -euo pipefail
          echo "[Android CI] Attaching assets to release: $TAG_NAME"

          # URL-encode tag for API path
          TAG_ENC=$(jq -rn --arg x "$TAG_NAME" '$x|@uri')

          # Find or create release by tag
          API="https://api.github.com/repos/${REPOSITORY}"
          REL_ID=$(curl -s -L             -H "Accept: application/vnd.github+json"             -H "Authorization: Bearer $GITHUB_TOKEN"             -H "X-GitHub-Api-Version: 2022-11-28"             "$API/releases/tags/$TAG_ENC" | jq -r '.id // empty')

          if [ -z "$REL_ID" ]; then
            echo "[Android CI] Release not found for tag $TAG_NAME; creating it now."
            BODY=$(jq -n --arg tag "$TAG_NAME" '{tag_name:$tag, name:$tag, draft:false, prerelease:false}')
            REL_ID=$(curl -s -L -X POST               -H "Accept: application/vnd.github+json"               -H "Authorization: Bearer $GITHUB_TOKEN"               -H "X-GitHub-Api-Version: 2022-11-28"               "$API/releases" -d "$BODY" | jq -r '.id // empty')
            if [ -z "$REL_ID" ]; then
              echo "::error::Failed to create GitHub Release for tag $TAG_NAME"; exit 1
            fi
          fi

          echo "[Android CI] Using release id: $REL_ID"

          # Collect candidate files
          mapfile -t FILES < <(find apps/react-native/android/app/build/outputs -type f \( -name '*.apk' -o -name '*.aab' \) | sort)
          if [ ${#FILES[@]} -eq 0 ]; then
            echo "::warning::No APK/AAB files found to attach."; exit 0
          fi

          # Fetch existing assets to handle collisions
          EXISTING=$(curl -s -L             -H "Accept: application/vnd.github+json"             -H "Authorization: Bearer $GITHUB_TOKEN"             -H "X-GitHub-Api-Version: 2022-11-28"             "$API/releases/$REL_ID/assets")

          for f in "${FILES[@]}"; do
            name=$(basename "$f")
            echo "[Android CI] Uploading asset: $name"

            # Delete existing asset with same name (if any)
            ASSET_ID=$(echo "$EXISTING" | jq -r --arg n "$name" '.[] | select(.name==$n) | .id' 2>/dev/null || true)
            if [ -n "${ASSET_ID:-}" ]; then
              echo "[Android CI] Removing existing asset with same name: $name (id=$ASSET_ID)"
              curl -s -L -X DELETE                 -H "Accept: application/vnd.github+json"                 -H "Authorization: Bearer $GITHUB_TOKEN"                 -H "X-GitHub-Api-Version: 2022-11-28"                 "$API/releases/assets/$ASSET_ID" >/dev/null || true
            fi

            # Pick content-type
            ctype="application/octet-stream"
            case "$name" in
              *.apk) ctype="application/vnd.android.package-archive" ;;
              *.aab) ctype="application/octet-stream" ;;
            esac

            # Upload
            UPLOAD_URL="https://uploads.github.com/repos/${REPOSITORY}/releases/${REL_ID}/assets?name=${name}"
            HTTP=$(curl -s -L -o /tmp/upload.json -w "%{http_code}" -X POST               -H "Authorization: Bearer $GITHUB_TOKEN"               -H "Content-Type: $ctype"               --data-binary @"$f" "$UPLOAD_URL")
            if [ "$HTTP" != "201" ]; then
              echo "::error::Failed to upload $name (HTTP $HTTP)"; cat /tmp/upload.json || true; exit 1
            fi
            echo "[Android CI] Uploaded: $name"
          done

      - name: Firebase App Distribution (dev)
        if: steps.meta.outputs.buildType == 'dev'
        working-directory: ${{ env.ANDROID_DIR }}
        run: |
          if [ ! -f firebase-appdist.json ]; then
            echo "[Android CI] Firebase credentials not configured; skipping App Distribution upload."
            exit 0
          fi
          ./gradlew :app:appDistributionUploadDev -PserviceCredentialsFile="$PWD/firebase-appdist.json" --stacktrace

      - name: Firebase App Distribution (release)
        if: steps.meta.outputs.buildType == 'release'
        working-directory: ${{ env.ANDROID_DIR }}
        run: |
          if [ ! -f firebase-appdist.json ]; then
            echo "[Android CI] Firebase credentials not configured; skipping App Distribution upload."
            exit 0
          fi
          ./gradlew :app:appDistributionUploadRelease -PserviceCredentialsFile="$PWD/firebase-appdist.json" --stacktrace

      - name: Google Play Internal (release)
        if: steps.meta.outputs.buildType == 'release'
        working-directory: ${{ env.ANDROID_DIR }}
        run: |
          # Determine which credentials to use for Play
          PLAY_JSON=""
          if [ -f play-service-account.json ]; then
            PLAY_JSON="$PWD/play-service-account.json"
          elif [ -f firebase-appdist.json ]; then
            PLAY_JSON="$PWD/firebase-appdist.json"
          fi
          if [ -z "${PLAY_JSON}" ]; then
            echo "[Android CI] Play credentials not configured; skipping Play upload."
            exit 0
          fi
          echo "[Android CI] Using Play credentials: $PLAY_JSON"
          # Publish the release bundle to the Internal track
          ./gradlew :app:publishReleaseBundle --stacktrace