auto-version-release.yml

name: Auto-Version & Release

on:
  schedule:
    # 23:00 UTC = 07:00 Asia/Shanghai the following day.
    - cron: '0 23 * * *'
  workflow_dispatch:

concurrency:
  group: simplexray-auto-version-release
  cancel-in-progress: false

jobs:
  check-for-updates:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      GH_TOKEN: ${{ secrets.PAT }}
      HEV_PATH: app/src/main/jni/hev-socks5-tunnel

    steps:
      - name: Check release token
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "$GH_TOKEN" ]]; then
            echo '::error::Set the PAT repository secret with Contents read/write access.'
            exit 1
          fi

      - name: Checkout main and submodules
        uses: actions/checkout@v7
        with:
          ref: main
          fetch-depth: 0
          submodules: recursive
          # A PAT-created Release can trigger the separate Build workflow.
          token: ${{ secrets.PAT }}

      - name: Check Xray-core release
        id: xray
        shell: bash
        run: |
          set -euo pipefail
          current=$(sed -n 's/^XRAY_CORE_VERSION=//p' version.properties | tr -d '\r')
          latest=$(gh api repos/XTLS/Xray-core/releases/latest --jq '.tag_name')
          if [[ ! "$current" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ||
                ! "$latest" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo '::error::Invalid or missing Xray-core version.'
            exit 1
          fi
          changed=false
          if [[ "${current#v}" != "${latest#v}" &&
                "$(printf '%s\n' "${current#v}" "${latest#v}" | sort -V | tail -n 1)" == "${latest#v}" ]]; then
            changed=true
          fi
          printf 'changed=%s\ncurrent=%s\nlatest=%s\n' "$changed" "$current" "$latest" >> "$GITHUB_OUTPUT"
          printf 'Xray-core: %s -> %s; release required: %s\n' "$current" "$latest" "$changed"

      - name: Update HEV submodule without creating a release
        id: hev
        shell: bash
        run: |
          set -euo pipefail
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
          current=$(git -C "$HEV_PATH" rev-parse HEAD)
          git -C "$HEV_PATH" fetch origin --tags --no-recurse-submodules
          # Track numbered stable tags, including an optional leading v.
          latest=$(git -C "$HEV_PATH" tag --list |
            sed -nE 's/^(v?([0-9]+\.[0-9]+\.[0-9]+))$/\2 \1/p' |
            sort -k1,1V | tail -n 1 | cut -d ' ' -f 2)
          if [[ -z "$latest" ]]; then
            echo '::error::No stable HEV version tag was found.'
            exit 1
          fi
          target=$(git -C "$HEV_PATH" rev-parse "${latest}^{commit}")
          if [[ "$current" != "$target" ]]; then
            if git -C "$HEV_PATH" merge-base --is-ancestor "$current" "$target"; then
              git -C "$HEV_PATH" checkout --detach "$target"
              # Use each dependency commit recorded by the selected HEV tag.
              git -C "$HEV_PATH" submodule update --init --recursive
              git add "$HEV_PATH"
              git commit -m "chore: update hev-socks5-tunnel to $latest"
              git push origin HEAD:main
            else
              echo 'HEV pin is ahead of or diverges from the latest stable tag; keeping the existing pin.'
            fi
          fi
          actual=$(git -C "$HEV_PATH" rev-parse HEAD)
          label=$(git -C "$HEV_PATH" describe --tags --exact-match 2>/dev/null || printf '%s' "${actual:0:12}")
          printf 'version=%s\ncommit=%s\n' "$label" "$actual" >> "$GITHUB_OUTPUT"
          printf 'HEV pinned at %s (%s). HEV changes do not create a Release.\n' "$label" "$actual"

      - name: Check latest stable Android NDK
        id: ndk
        run: python3 scripts/update_ndk_version.py

      - name: Commit NDK version without creating a release
        if: steps.ndk.outputs.changed == 'true'
        env:
          NDK_VERSION: ${{ steps.ndk.outputs.version }}
        run: |
          set -euo pipefail
          git add version.properties
          git commit -m "chore: update Android NDK to $NDK_VERSION"
          git push origin HEAD:main

      - name: Read Go version from the official Xray binary
        if: steps.xray.outputs.changed == 'true'
        id: go
        shell: bash
        env:
          XRAY_TAG: ${{ steps.xray.outputs.latest }}
        run: |
          set -euo pipefail
          task_dir=$(mktemp -d "$RUNNER_TEMP/xray-update.XXXXXX")
          gh release download "$XRAY_TAG" --repo XTLS/Xray-core --pattern Xray-linux-64.zip --dir "$task_dir"
          unzip -q -o "$task_dir/Xray-linux-64.zip" -d "$task_dir"
          chmod +x "$task_dir/xray"
          core_version=$("$task_dir/xray" version)
          go_version=$(printf '%s\n' "$core_version" | sed -nE 's/.*go([0-9]+\.[0-9]+(\.[0-9]+)?).*/\1/p' | head -n 1)
          if [[ -z "$go_version" ]]; then
            echo '::error::Could not determine the official Xray Go version.'
            exit 1
          fi
          printf 'version=%s\n' "$go_version" >> "$GITHUB_OUTPUT"

      - name: Match app version to Xray and increment versionCode
        if: steps.xray.outputs.changed == 'true'
        id: app
        shell: bash
        env:
          XRAY_TAG: ${{ steps.xray.outputs.latest }}
          GO_VERSION: ${{ steps.go.outputs.version }}
        run: |
          set -euo pipefail
          python3 - <<'PY'
          import os
          import re
          from pathlib import Path

          path = Path('version.properties')
          text = path.read_text()

          def value(key):
              matches = re.findall(rf'^{re.escape(key)}=(.*)$', text, re.M)
              if len(matches) != 1:
                  raise SystemExit(f'Expected exactly one {key} property')
              return matches[0].strip()

          code = str(int(value('APP_VERSION_CODE')) + 1)
          name = os.environ['XRAY_TAG'].removeprefix('v')
          if not re.fullmatch(r'\d+\.\d+\.\d+', name):
              raise SystemExit('Xray version must be a dotted numeric version')
          updates = {
              'XRAY_CORE_VERSION': os.environ['XRAY_TAG'],
              'GO_VERSION': os.environ['GO_VERSION'],
              'APP_VERSION_CODE': code,
          }
          for key, replacement in updates.items():
              value(key)
              text = re.sub(rf'^{re.escape(key)}=.*$', lambda _: f'{key}={replacement}', text, flags=re.M)
          path.write_text(text)
          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
              output.write(f'version={name}\n')
          PY
          git add version.properties
          git commit -m "chore: update Xray-core and app version to $XRAY_TAG"
          git push origin HEAD:main
          printf 'commit=%s\n' "$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Create release only for a new Xray release
        if: steps.xray.outputs.changed == 'true'
        shell: bash
        env:
          RELEASE_TAG: v${{ steps.app.outputs.version }}
          RELEASE_COMMIT: ${{ steps.app.outputs.commit }}
          XRAY_TAG: ${{ steps.xray.outputs.latest }}
          HEV_VERSION: ${{ steps.hev.outputs.version }}
          HEV_COMMIT: ${{ steps.hev.outputs.commit }}
          NDK_VERSION: ${{ steps.ndk.outputs.version }}
        run: |
          set -euo pipefail
          notes_file="$RUNNER_TEMP/simplexray-release-notes.md"
          {
            printf '### Changes\n\n- Xray-core updated to **%s**.\n' "$XRAY_TAG"
            printf '\n### Bundled HEV\n\n- Version: **%s**\n- Commit: `%s`\n' "$HEV_VERSION" "$HEV_COMMIT"
            printf '\n### Build toolchain\n\n- Android NDK: **%s**\n' "$NDK_VERSION"
          } > "$notes_file"
          gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --target "$RELEASE_COMMIT" --title "$RELEASE_TAG" --notes-file "$notes_file"

      - name: No Xray release required
        if: steps.xray.outputs.changed != 'true'
        run: echo 'Xray-core is unchanged. HEV or NDK may have been updated, but the app version and Releases are unchanged.'