test_release2.yml

name: Test Release 2
on:
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Get the source
        uses: actions/checkout@v5

      - name: Set up JDK 21
        uses: actions/setup-java@v5
        with:
          distribution: 'temurin'
          java-version: '21'

      - name: Cache Gradle dependencies
        uses: actions/cache@v4
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      - name: Grant execute permission for gradlew
        run: chmod +x ./gradlew

      - name: Generate Release AAB
        run: ./gradlew bundlePsRelease

      - name: Sign AAB with jarsigner
        id: sign_aab
        env:
          KEYSTORE_FILE_2: ${{ secrets.KEYSTORE_FILE_2 }}
          KEYSTORE_PASSWORD_2: ${{ secrets.KEYSTORE_PASSWORD_2 }}
          KEY_PASSWORD_2: ${{ secrets.KEY_PASSWORD_2 }}
          KEY_ALIAS_2: ${{ secrets.KEY_ALIAS_2 }}
        run: |
          set -e
          AAB_SRC="app/build/outputs/bundle/psRelease/app-ps-release.aab"
          AAB_DST="app/build/outputs/bundle/psRelease/app-ps-release-signed.aab"

          if [ ! -f "$AAB_SRC" ]; then
            echo "Error: AAB not found at $AAB_SRC"
            exit 1
          fi

          # Decode the base64 keystore secret into a file
          echo "$KEYSTORE_FILE_2" | base64 --decode > upload-keystore.jks
          chmod 600 upload-keystore.jks

          # Copy bundle to new file so original remains untouched
          cp "$AAB_SRC" "$AAB_DST"

          # Sign the AAB
          jarsigner -verbose -keystore upload-keystore.jks -storepass "$KEYSTORE_PASSWORD_2" -keypass "$KEY_PASSWORD_2" "$AAB_DST" "$KEY_ALIAS_2"

          # Verify signature
          jarsigner -verify -verbose -certs "$AAB_DST"

          # Clean up keystore file
          rm -f upload-keystore.jks

          echo "signed_aab=$AAB_DST" >> $GITHUB_OUTPUT

      - name: Install curl
        run: sudo apt-get update && sudo apt-get install -y curl

      - name: Upload signed AAB to Telegram
        env:
          TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
          TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
        run: |
          set -e
          SIGNED_AAB="${{ steps.sign_aab.outputs.signed_aab }}"

          if [ -z "$SIGNED_AAB" ] || [ ! -f "$SIGNED_AAB" ]; then
            echo "Signed AAB not found: $SIGNED_AAB"
            exit 1
          fi

          echo "Uploading signed AAB: $SIGNED_AAB"
          curl -s -X POST "https://api.telegram.org/bot${{ env.TELEGRAM_BOT_TOKEN }}/sendDocument" \
            -F chat_id=${{ env.TELEGRAM_CHAT_ID }} \
            -F document=@"$SIGNED_AAB"