Graduately/.github/workflows/build.yml

name: Build

# Packages are published to the `builds` branch instead of to a GitHub
# Release, so everything the installers and the in-app updater fetch comes
# straight from the repository and always matches what is on main.
on:
  push:
    branches:
      - main
    # Nothing to rebuild when only documentation changed.
    paths-ignore:
      - "README.md"
      - "LICENSE"
      - ".gitignore"
  workflow_dispatch:

permissions:
  contents: write

jobs:
  linux:
    name: Linux AppImage
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      # ProGuard and jlink need a JDK that ships jmods; Temurin 21 does.
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - uses: gradle/actions/setup-gradle@v4
        with:
          build-root-directory: android

      - name: Answer checks
        run: |
          chmod +x android/gradlew
          cd android
          ./gradlew :desktop:test --no-daemon

      - name: Build AppImage
        env:
          COMMIT: ${{ github.sha }}
        run: |
          export PACKAGE_JDK="$JAVA_HOME"
          chmod +x scripts/bundle-linux.sh
          ./scripts/bundle-linux.sh

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: graduately-linux
          path: dist/graduately-linux-*.AppImage

  windows:
    name: Windows zip
    runs-on: windows-latest
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - uses: gradle/actions/setup-gradle@v4
        with:
          build-root-directory: android

      - name: Build zip
        env:
          COMMIT: ${{ github.sha }}
        run: |
          export PACKAGE_JDK="$JAVA_HOME"
          bash scripts/bundle-windows.sh

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: graduately-windows
          path: dist/graduately-windows-x64.zip

  macos:
    name: macOS app
    runs-on: macos-26
    steps:
      - uses: actions/checkout@v4

      # Developer ID lives in repo secrets. Without it the bundle is only
      # ad-hoc signed and Gatekeeper still blocks downloaded copies.
      # Do not use `secrets` in `if:` — GitHub rejects the whole workflow.
      - name: Import Developer ID certificate
        env:
          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
        run: |
          set -euo pipefail
          if [ -z "${MACOS_CERTIFICATE:-}" ]; then
            echo "No Developer ID certificate; the bundle will be ad-hoc signed."
            exit 0
          fi
          cert="$RUNNER_TEMP/certificate.p12"
          keychain="$RUNNER_TEMP/signing.keychain-db"
          pass="$(openssl rand -base64 32)"
          echo "$MACOS_CERTIFICATE" | base64 --decode > "$cert"
          security create-keychain -p "$pass" "$keychain"
          security set-keychain-settings -lut 21600 "$keychain"
          security unlock-keychain -p "$pass" "$keychain"
          security import "$cert" -k "$keychain" \
            -P "$MACOS_CERTIFICATE_PASSWORD" \
            -T /usr/bin/codesign -T /usr/bin/security
          security set-key-partition-list -S apple-tool:,apple: -s \
            -k "$pass" "$keychain"
          security list-keychains -d user -s "$keychain" \
            $(security list-keychains -d user | tr -d '"')
          rm -f "$cert"

      - name: Build Swift .app zip
        env:
          COMMIT: ${{ github.sha }}
          DEVELOPER_DIR: /Applications/Xcode.app/Contents/Developer
          MACOS_SIGN_IDENTITY: ${{ secrets.MACOS_SIGN_IDENTITY }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
        run: |
          chmod +x scripts/bundle-macos-swift.sh
          ./scripts/bundle-macos-swift.sh

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: graduately-macos
          path: dist/graduately-macos-*.zip

  android:
    name: Android APK
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17

      # v3 defaults to the retired `tools` package, which sdkmanager no longer
      # serves. Request only packages that still exist.
      - uses: android-actions/setup-android@v3
        with:
          packages: platform-tools

      - name: Install Android SDK platform
        run: |
          set -euo pipefail
          sdkmanager --install "build-tools;36.0.0"
          if ! sdkmanager --install "platforms;android-37.0"; then
            sdkmanager --install "platforms;android-37"
          fi
          if [ -d "$ANDROID_HOME/platforms/android-37.0" ] && [ ! -e "$ANDROID_HOME/platforms/android-37" ]; then
            ln -sfn android-37.0 "$ANDROID_HOME/platforms/android-37"
          fi
          ls "$ANDROID_HOME/platforms"

      - uses: gradle/actions/setup-gradle@v4
        with:
          build-root-directory: android

      - name: Build content and APK
        env:
          COMMIT: ${{ github.sha }}
        run: |
          python3 scripts/build-content.py
          chmod +x android/gradlew
          cd android
          ./gradlew :app:assembleRelease --no-daemon
          mkdir -p ../dist-android
          cp app/build/outputs/apk/release/app-release.apk \
            ../dist-android/graduately-android.apk

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: graduately-android
          path: dist-android/graduately-android.apk

  ios:
    name: iOS IPA
    # The app targets iOS 26; this image ships Xcode 26 as the default.
    runs-on: macos-26
    steps:
      - uses: actions/checkout@v4

      - name: Answer checks
        env:
          DEVELOPER_DIR: /Applications/Xcode.app/Contents/Developer
        run: |
          chmod +x scripts/test-answers-swift.sh
          ./scripts/test-answers-swift.sh

      - name: Build content and IPA
        env:
          COMMIT: ${{ github.sha }}
          DEVELOPER_DIR: /Applications/Xcode.app/Contents/Developer
        run: |
          chmod +x scripts/bundle-ios.sh
          ./scripts/bundle-ios.sh

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: graduately-ios
          path: dist-ios/graduately-ios.ipa

  publish:
    name: Publish to builds branch
    needs: [linux, windows, macos, android, ios]
    # One broken platform must not freeze the others: publish whatever was
    # built and keep the previous package for anything that failed.
    if: ${{ !cancelled() && contains(needs.*.result, 'success') }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Start from the previous builds branch
        run: |
          mkdir -p staged
          if git fetch --depth 1 origin builds 2>/dev/null; then
            git archive FETCH_HEAD | tar -x -C staged
            rm -f staged/VERSION
          fi

      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          path: fresh
          merge-multiple: true

      - name: Collect installers
        run: |
          set -euo pipefail
          cp -f fresh/* staged/ 2>/dev/null || true
          rm -f staged/graduately-macos-swift-*.zip staged/VERSION-macos-swift
          chmod +x installers/pack-installer-zips.sh
          ./installers/pack-installer-zips.sh
          cp installers/graduately-installer-linux.sh staged/
          cp installers/graduately-installer-windows.cmd staged/
          cp installers/graduately-installer-*.zip staged/
          # The updaters download this to see whether they are behind.
          echo "${{ github.sha }}" > staged/VERSION
          # Per-platform markers name the commit whose package is really
          # here, so a platform that failed this run is not offered as new.
          [ -f fresh/graduately-android.apk ] && echo "${{ github.sha }}" > staged/VERSION-android
          [ -f fresh/graduately-ios.ipa ] && echo "${{ github.sha }}" > staged/VERSION-ios
          ls fresh/graduately-macos-*.zip >/dev/null 2>&1 && echo "${{ github.sha }}" > staged/VERSION-macos
          [ -f fresh/graduately-windows-x64.zip ] && echo "${{ github.sha }}" > staged/VERSION-windows
          [ -f fresh/graduately-linux-x86_64.AppImage ] && echo "${{ github.sha }}" > staged/VERSION-linux
          # Compatibility aliases so older installers/updaters still find packages.
          [ -f staged/graduately-macos-arm64.zip ] && cp -f staged/graduately-macos-arm64.zip staged/maturita-macos-arm64.zip
          [ -f staged/graduately-macos-x86_64.zip ] && cp -f staged/graduately-macos-x86_64.zip staged/maturita-macos-x86_64.zip
          [ -f staged/graduately-windows-x64.zip ] && cp -f staged/graduately-windows-x64.zip staged/maturita-windows-x64.zip
          [ -f staged/graduately-linux-x86_64.AppImage ] && cp -f staged/graduately-linux-x86_64.AppImage staged/maturita-linux-x86_64.AppImage
          [ -f staged/graduately-android.apk ] && cp -f staged/graduately-android.apk staged/maturita-android.apk
          [ -f staged/graduately-ios.ipa ] && cp -f staged/graduately-ios.ipa staged/maturita-ios.ipa
          ls fresh staged

      # The branch is rewritten from scratch every time rather than added to,
      # so the repository keeps one copy of the packages instead of a new
      # ~70 MB set per commit.
      - name: Push to builds branch
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          rm -rf .git/index.lock
          git checkout --orphan builds
          git rm -rf --cached . >/dev/null
          find . -maxdepth 1 ! -name . ! -name .git ! -name staged \
            -exec rm -rf {} +
          mv staged/* .
          rmdir staged
          ls -la
          git add -A
          git commit -q -m "Build from ${{ github.sha }}"
          git push -f origin builds