cd.yml

name: CD

on:
  push:
    branches: [develop]
  workflow_dispatch:

concurrency:
  group: cd-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  distribute:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          lfs: true

      - name: Set up JDK 17
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '17'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@v4
        with:
          validate-wrappers: true

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.3'
          bundler-cache: true

      - name: Prepare secret directories
        run: mkdir -p fastlane/config keystore

      - name: Write google-services.json
        run: echo "${{ secrets.GOOGLE_SERVICES_JSON }}" | base64 -d > app/google-services.json

      - name: Write local.properties
        shell: bash
        env:
          DEV_BASE_URL: ${{ secrets.DEV_BASE_URL }}
          PROD_BASE_URL: ${{ secrets.PROD_BASE_URL }}
        run: |
          : "${DEV_BASE_URL:?DEV_BASE_URL secret is not configured}"
          : "${PROD_BASE_URL:?PROD_BASE_URL secret is not configured}"
          printf 'DEV_BASE_URL=%s\n' "$DEV_BASE_URL" > local.properties
          printf 'PROD_BASE_URL=%s\n' "$PROD_BASE_URL" >> local.properties

      - name: Write Firebase service account key
        run: echo "${{ secrets.FIREBASE_SERVICE_ACCOUNT_JSON }}" | base64 -d > fastlane/config/gamss-key.json

      - name: Write release keystore
        run: echo "${{ secrets.RELEASE_KEYSTORE }}" | base64 -d > keystore/release.jks

      - name: Compute CI version
        run: |
          echo "VERSION_CODE=$((100000 + GITHUB_RUN_NUMBER))" >> "$GITHUB_ENV"

      - name: Distribute to Firebase App Distribution
        env:
          RELEASE_KEYSTORE_PATH: ${{ github.workspace }}/keystore/release.jks
          RELEASE_KEYSTORE_PASSWORD: ${{ secrets.RELEASE_KEYSTORE_PASSWORD }}
          RELEASE_KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
          RELEASE_KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
          FIREBASE_SERVICE_CREDENTIALS_FILE: ${{ github.workspace }}/fastlane/config/gamss-key.json
          FIREBASE_APP_ID: ${{ secrets.FIREBASE_APP_ID }}
          FIREBASE_TESTER_GROUPS: inner-tester
        run: bundle exec fastlane android distribute

      # 위 Firebase 배포는 installTimeModels 로 모델을 박아 넣은 전용 AAB(~400MB)를 쓴다. 이 스텝은
      # 그거와 별개로, 실제 운영 배포 형태(on-demand/fast-follow 유지, 작은 크기)의 AAB 를 워크플로
      # 아티팩트로 남긴다 — Play Console 내부 테스트 트랙에 수동으로 올리거나 bundletool
      # --local-testing 으로 로컬 설치해 PAD 동작을 검증할 때 쓴다. 실패해도 위 Firebase 배포는 이미
      # 끝났으므로 파이프라인 전체를 실패시키지 않는다.
      - name: Build release AAB
        continue-on-error: true
        env:
          RELEASE_KEYSTORE_PATH: ${{ github.workspace }}/keystore/release.jks
          RELEASE_KEYSTORE_PASSWORD: ${{ secrets.RELEASE_KEYSTORE_PASSWORD }}
          RELEASE_KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
          RELEASE_KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
        run: ./gradlew :app:bundleRelease -PversionCode="$VERSION_CODE" --stacktrace

      - name: Upload release AAB artifact
        continue-on-error: true
        uses: actions/upload-artifact@v4
        with:
          name: app-release-aab
          path: app/build/outputs/bundle/release/*.aab
          if-no-files-found: error
          retention-days: 7

      - name: Upload reports
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: cd-reports
          path: |
            **/build/reports/**
          if-no-files-found: ignore
          retention-days: 7