release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  release:
    name: Build & publish (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    steps:
      - uses: actions/checkout@v4

      - name: Install system dependencies (Linux)
        if: matrix.os == 'ubuntu-latest'
        run: sudo apt-get update && sudo apt-get install -y libasound2-dev libudev-dev libwayland-dev libxkbcommon-dev

      - uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      # Only tetris-app produces a bin (blockfall); --workspace keeps the
      # build identical to CI.
      - name: Build release
        run: cargo build --release --workspace

      - name: Resolve target triple (Linux)
        if: matrix.os == 'ubuntu-latest'
        run: echo "TARGET=x86_64-unknown-linux-gnu" >> "$GITHUB_ENV"

      - name: Resolve target triple (Windows)
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: echo "TARGET=x86_64-pc-windows-msvc" >> $env:GITHUB_ENV

      # macos-latest runners are Apple Silicon; map `uname -m` anyway so the
      # job stays correct on Intel-hosted runners too.
      - name: Resolve target triple (macOS)
        if: matrix.os == 'macos-latest'
        run: |
          case "$(uname -m)" in
            arm64)  echo "TARGET=aarch64-apple-darwin" >> "$GITHUB_ENV" ;;
            x86_64) echo "TARGET=x86_64-apple-darwin"  >> "$GITHUB_ENV" ;;
            *) echo "unsupported arch: $(uname -m)" && exit 1 ;;
          esac

      - name: "Package (Unix: tar.gz)"
        if: matrix.os != 'windows-latest'
        run: tar czf "blockfall-${GITHUB_REF_NAME}-${TARGET}.tar.gz" -C target/release blockfall

      - name: "Package (Windows: zip)"
        if: matrix.os == 'windows-latest'
        shell: pwsh
        run: Compress-Archive -Path target/release/blockfall.exe -DestinationPath "blockfall-${env:GITHUB_REF_NAME}-${env:TARGET}.zip"

      - name: Publish GitHub release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            blockfall-${{ github.ref_name }}-*.tar.gz
            blockfall-${{ github.ref_name }}-*.zip

  # Universal (arm64-v8a + x86_64) sideload APK, built by the same
  # Gradle-less script the dev flow uses. Signed with the release keystore
  # when ANDROID_KEYSTORE_B64 (+_PASS) secrets exist, debug-signed otherwise.
  android:
    name: "Build & publish Android APK"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "21"

      - name: Install Android SDK packages
        uses: android-actions/setup-android@v3
        with:
          packages: "platforms;android-36 build-tools;37.0.0 ndk;30.0.16248370"

      - uses: dtolnay/rust-toolchain@stable

      - name: Add Android targets
        run: rustup target add aarch64-linux-android x86_64-linux-android

      - name: Install cargo-ndk
        run: cargo install cargo-ndk --locked

      - uses: Swatinem/rust-cache@v2

      - name: Unpack release keystore (optional)
        env:
          KS_B64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
          KS_PASS: ${{ secrets.ANDROID_KEYSTORE_PASS }}
        run: |
          if [ -n "$KS_B64" ]; then
              echo "$KS_B64" | base64 -d > "$RUNNER_TEMP/release.keystore"
              {
                  echo "APK_KEYSTORE=$RUNNER_TEMP/release.keystore"
                  echo "APK_STORE_PASS=$KS_PASS"
                  echo "APK_KEY_PASS=$KS_PASS"
              } >> "$GITHUB_ENV"
          fi

      - name: Build APK
        env:
          ANDROID_NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/30.0.16248370
          VERSION_CODE: ${{ github.run_number }}
          APK_OUT: ${{ github.workspace }}/blockfall-${{ github.ref_name }}-android.apk
        run: |
          # Strip the leading "v" so Android sees versionName "0.3.0", not "v0.3.0".
          export VERSION_NAME="${GITHUB_REF_NAME#v}"
          scripts/build-android.sh

      - name: "Publish Android release asset"
        uses: softprops/action-gh-release@v2
        with:
          files: blockfall-${{ github.ref_name }}-android.apk

  # Static musl gateway binary for any opensensor box (gateway-plan.md G4).
  # Independent of the game matrix above; its softprops step only ADDS files
  # with a distinct prefix (blockfall-gateway-*) — no overlap with the game
  # archives, so the concurrent create/update of the same tag is safe.
  gateway:
    name: "Build & publish gateway (linux-musl)"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: "Install musl toolchain"
        run: sudo apt-get update && sudo apt-get install -y musl-tools

      - uses: dtolnay/rust-toolchain@stable

      - name: "Add musl target"
        run: rustup target add x86_64-unknown-linux-musl

      - uses: Swatinem/rust-cache@v2

      - name: "Build gateway (static musl)"
        run: cargo build --release -p netplay-gateway --target x86_64-unknown-linux-musl

      - name: "Gateway self-test"
        run: target/x86_64-unknown-linux-musl/release/netplay-gateway --self-test

      - name: "Package gateway (tar.gz)"
        run: tar czf "blockfall-gateway-${GITHUB_REF_NAME}-x86_64-unknown-linux-musl.tar.gz" -C target/x86_64-unknown-linux-musl/release netplay-gateway

      - name: "Publish gateway release asset"
        uses: softprops/action-gh-release@v2
        with:
          files: blockfall-gateway-${{ github.ref_name }}-*.tar.gz