upload-build-android.yml

name: upload build

# See docs/flutter.md for required `release` environment variables and secrets.
on:
  workflow_call:
    inputs:
      release_tag:
        required: true
        type: string
      track:
        description: >
          The Google Play release track to which the uploaded app bundle will be
          assigned (such as 'internal', 'alpha', 'beta', or 'production').
        required: false
        type: string
        default: internal
      release_status:
        description: >
          The release status to apply after uploading the app bundle.
          Use 'draft' to create a draft release in the Play Console for
          manual review and publishing, or 'completed' to publish
          immediately to the selected track.
        required: false
        type: string
        default: draft

jobs:
  upload_build:
    name: google play console
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout source code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false

      - name: Add Toolbox Envy to PATH
        uses: EarthmanMuons/toolbox-envy/.github/actions/add-to-path@main
        with:
          include_bins: |
            common
            flutter

      - name: Validate upload options
        env:
          INPUTS_TRACK: ${{ inputs.track }}
          INPUTS_RELEASE_STATUS: ${{ inputs.release_status }}
        run: |
          set -euo pipefail

          case "${INPUTS_TRACK}" in
            internal|alpha|beta|production) ;;
            *)
              echo "::error::Invalid track '${INPUTS_TRACK}' (expected internal, alpha, beta, or production)."
              exit 1
              ;;
          esac

          case "${INPUTS_RELEASE_STATUS}" in
            draft|completed|inProgress|halted) ;;
            *)
              echo "::error::Invalid release_status '${INPUTS_RELEASE_STATUS}' (expected draft, completed, inProgress, or halted)."
              exit 1
              ;;
          esac

      - name: Download release assets
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.release_tag }}
        run: |
          set -euo pipefail

          mkdir -p dist
          if ! gh release download "$RELEASE_TAG" \
            --pattern "*.aab" \
            --pattern "sha256sums.txt" \
            --dir dist; then
            echo "::error::Failed to download release assets for tag '${RELEASE_TAG}'. Expected at least one .aab and sha256sums.txt."
            exit 1
          fi

      - name: Verify release assets
        run: verify-checksums --dir dist --pattern '*.aab'

      - name: Validate Google Play authentication configuration
        env:
          GCP_WIF_PROVIDER: ${{ vars.GCP_WIF_PROVIDER }}
          GCP_SERVICE_ACCOUNT: ${{ vars.GCP_SERVICE_ACCOUNT }}
          GOOGLE_PLAY_PACKAGE_NAME: ${{ vars.GOOGLE_PLAY_PACKAGE_NAME }}
        run: |
          set -euo pipefail

          if [[ -z "${GCP_WIF_PROVIDER}" ]]; then
            echo "::error::Missing GCP_WIF_PROVIDER in the release environment."
            exit 1
          fi
          if [[ -z "${GCP_SERVICE_ACCOUNT}" ]]; then
            echo "::error::Missing GCP_SERVICE_ACCOUNT in the release environment."
            exit 1
          fi
          if [[ -z "${GOOGLE_PLAY_PACKAGE_NAME}" ]]; then
            echo "::error::Missing GOOGLE_PLAY_PACKAGE_NAME in the release environment."
            exit 1
          fi

      - id: gcp_auth
        name: Configure Google Cloud authentication
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
        with:
          workload_identity_provider: ${{ vars.GCP_WIF_PROVIDER }}
          service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}

      - name: upload aab
        uses: r0adkll/upload-google-play@935ef9c68bb393a8e6116b1575626a7f5be3a7fb
        with:
          serviceAccountJson: ${{ steps.gcp_auth.outputs.credentials_file_path }}
          packageName: ${{ vars.GOOGLE_PLAY_PACKAGE_NAME }}
          releaseFiles: dist/*.aab
          track: ${{ inputs.track }}
          status: ${{ inputs.release_status }}

      - name: Annotate workflow run with uploaded aab
        run: |
          ASSET_NAME="$(basename dist/*.aab)"
          {
            printf '### :shipit: Uploaded Android build:\n'
            printf '\n'
            printf -- '- [%s]\n' "${ASSET_NAME}"
          } >>"$GITHUB_STEP_SUMMARY"