android.yml

name: Android

on:
  pull_request:
  push:
    branches: [main]
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: android-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '21'
          cache: gradle

      - uses: actions/setup-go@v7
        with:
          go-version: '1.26.8'
          # Native outputs are cached below; Go sources are fetched during the build.
          cache: false

      - uses: android-actions/setup-android@v4
        with:
          packages: 'platform-tools'

      - name: Install Android toolchain
        run: |
          sdkmanager 'platforms;android-36' 'build-tools;35.0.0' 'ndk;29.0.14206865' 'cmake;3.22.1'
          echo "ANDROID_NDK=$ANDROID_HOME/ndk/29.0.14206865" >> "$GITHUB_ENV"

      - name: Cache FlClash core
        uses: actions/cache@v5
        with:
          path: |
            app/src/main/jniLibs
            app/src/main/cpp/includes
          # Exact fork branches, source/compiler pins, and validation live in the
          # build script; the workflow pins the NDK.
          key: ${{ runner.os }}-${{ runner.arch }}-flclash-${{ hashFiles('scripts/build-flclash-core.sh', '.github/workflows/android.yml') }}

      - name: Configure Firebase
        env:
          GOOGLE_SERVICES_JSON_BASE64: ${{ secrets.GOOGLE_SERVICES_JSON_BASE64 }}
        run: |
          if [[ -n "$GOOGLE_SERVICES_JSON_BASE64" ]]; then
            printf '%s' "$GOOGLE_SERVICES_JSON_BASE64" | base64 --decode > app/google-services.json
          fi

      - name: Build debug
        if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
        env:
          WHITEDNS_MIHOMO_SUBSCRIPTION_URL: ${{ vars.WHITEDNS_MIHOMO_SUBSCRIPTION_URL }}
          WHITEDNS_PRIVATE_MIHOMO_SUBSCRIPTION_URL: ${{ secrets.WHITEDNS_PRIVATE_MIHOMO_SUBSCRIPTION_URL }}
        run: ./gradlew testDebugUnitTest assembleDebug

      - name: Configure release signing
        if: github.event_name == 'workflow_dispatch' || github.event_name == 'release'
        env:
          WHITEDNS_RELEASE_KEYSTORE_BASE64: ${{ secrets.WHITEDNS_RELEASE_KEYSTORE_BASE64 }}
          WHITEDNS_PRIVATE_MIHOMO_SUBSCRIPTION_URL: ${{ secrets.WHITEDNS_PRIVATE_MIHOMO_SUBSCRIPTION_URL }}
        run: |
          : "${WHITEDNS_RELEASE_KEYSTORE_BASE64:?Missing WHITEDNS_RELEASE_KEYSTORE_BASE64}"
          : "${WHITEDNS_PRIVATE_MIHOMO_SUBSCRIPTION_URL:?Missing WHITEDNS_PRIVATE_MIHOMO_SUBSCRIPTION_URL}"
          [[ "$WHITEDNS_PRIVATE_MIHOMO_SUBSCRIPTION_URL" == https://* ]] || {
            echo "WHITEDNS_PRIVATE_MIHOMO_SUBSCRIPTION_URL must use HTTPS" >&2
            exit 1
          }
          printf '%s' "$WHITEDNS_RELEASE_KEYSTORE_BASE64" | base64 --decode > "$RUNNER_TEMP/whitedns-release.jks"

      - name: Validate release tag
        if: github.event_name == 'release'
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          version_name="$(sed -n 's/^[[:space:]]*versionName[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' app/build.gradle.kts | head -n 1)"
          [[ "$RELEASE_TAG" == "v$version_name" ]] || {
            echo "Release tag $RELEASE_TAG must match app version v$version_name" >&2
            exit 1
          }

      - name: Build signed release
        if: github.event_name == 'workflow_dispatch' || github.event_name == 'release'
        env:
          WHITEDNS_RELEASE_STORE_FILE: ${{ runner.temp }}/whitedns-release.jks
          WHITEDNS_RELEASE_STORE_PASSWORD: ${{ secrets.WHITEDNS_RELEASE_STORE_PASSWORD }}
          WHITEDNS_RELEASE_KEY_ALIAS: ${{ secrets.WHITEDNS_RELEASE_KEY_ALIAS }}
          WHITEDNS_RELEASE_KEY_PASSWORD: ${{ secrets.WHITEDNS_RELEASE_KEY_PASSWORD }}
          WHITEDNS_MIHOMO_SUBSCRIPTION_URL: ${{ vars.WHITEDNS_MIHOMO_SUBSCRIPTION_URL }}
          WHITEDNS_PRIVATE_MIHOMO_SUBSCRIPTION_URL: ${{ secrets.WHITEDNS_PRIVATE_MIHOMO_SUBSCRIPTION_URL }}
        run: ./scripts/release.sh

      - name: Verify private subscription injection
        if: github.event_name == 'workflow_dispatch' || github.event_name == 'release'
        env:
          WHITEDNS_PRIVATE_MIHOMO_SUBSCRIPTION_URL: ${{ secrets.WHITEDNS_PRIVATE_MIHOMO_SUBSCRIPTION_URL }}
        run: |
          apk="$(find release -maxdepth 1 -name '*-universal.apk' -print -quit)"
          [[ -n "$apk" ]] || {
            echo "Universal release APK was not found" >&2
            exit 1
          }
          dex_dir="$RUNNER_TEMP/whitevpn-release-dex"
          mkdir -p "$dex_dir"
          unzip -q "$apk" 'classes*.dex' -d "$dex_dir"
          dex_strings="$RUNNER_TEMP/whitevpn-release-dex-strings.txt"
          find "$dex_dir" -type f -name 'classes*.dex' -exec strings {} + > "$dex_strings"
          if ! grep -Fq -- "$WHITEDNS_PRIVATE_MIHOMO_SUBSCRIPTION_URL" "$dex_strings"; then
            echo "Private subscription URL was not injected into release bytecode" >&2
            exit 1
          fi
          echo "Private subscription URL is present in release bytecode"

      - name: Upload debug APKs
        if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
        uses: actions/upload-artifact@v7
        with:
          name: whitevpn-debug-${{ github.sha }}
          path: app/build/outputs/apk/debug/*.apk
          if-no-files-found: error
          retention-days: 14

      - name: Upload signed release
        if: github.event_name == 'workflow_dispatch' || github.event_name == 'release'
        uses: actions/upload-artifact@v7
        with:
          name: whitevpn-release-${{ github.run_id }}
          path: release/*
          if-no-files-found: error
          retention-days: 30

  publish:
    if: github.event_name == 'release'
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7

      - uses: actions/download-artifact@v5
        with:
          name: whitevpn-release-${{ github.run_id }}
          path: release

      - name: Attach builds to GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: gh release upload "$RELEASE_TAG" release/* --clobber