build.yml

name: Build

on:
  workflow_call:
    inputs:
      config_file:
        required: true
        type: string
      remove_apks:
        required: false
        type: string
        default: ""
  workflow_dispatch:
    inputs:
      config_file:
        description: "Select the config file to use"
        required: true
        type: choice
        default: "configs/config.manual.toml"
        options:
          - "configs/config.manual.toml"
          - "configs/beta_build.json"
          - "configs/stable_build.json"
      remove_apks:
        description: "Optional: APKs to remove from cache (space-separated, e.g., com.brave.browser-1.93.138-*.apk)"
        required: false
        type: string
        default: ""

concurrency:
  group: build
  cancel-in-progress: false

jobs:
  build:
    permissions:
      contents: write
    runs-on: ubuntu-latest
    timeout-minutes: 120
    # Performance tuning knobs — version-controlled here instead of repo
    # variables (visible in PRs, survive forks, git history for the values).
    env:
      # How many app builds run at the same time. 1 = one at a time (normal).
      # Set to 2-4 to speed up builds (runner has 4 cores).
      PARALLEL_JOBS: "6"
      # How many files upload at the same time.
      UPLOAD_CONCURRENCY: "12"
    services:
      cf_solver:
        image: ghcr.io/sarperavci/cloudflarebypassforscraping:latest
        ports:
          - 8000:8000
    steps:
      - name: Setup java
        uses: actions/setup-java@v6
        with:
          distribution: "temurin"
          java-version: "21"

      - name: Checkout
        uses: actions/checkout@v7
        with:
          ref: main
          fetch-depth: 0
          submodules: true

      - name: Fetch configs & state (data branch)
        # Materializes configs/ (human TOMLs + generated *_build.json) and
        # state/ (watcher JSONs) — the data branch is their canonical home.
        run: bash .github/scripts/fetch_data_branch.sh

      - name: Resolve build context
        id: context
        env:
          TG_THREAD_STABLE: ${{ vars.TG_THREAD_STABLE }}
          TG_THREAD_BETA: ${{ vars.TG_THREAD_BETA }}
        run: bash .github/scripts/build_resolve_context.sh "${{ inputs.config_file }}"

      - name: Install Bouncy Castle for BKS Keystore
        run: |
          CFG="${{ steps.context.outputs.CONFIG_FILE }}"
          if [[ "$CFG" == *.json ]]; then
            RESOLVED="$CFG"
          else
            mkdir -p temp
            yq -o=json eval . "$CFG" > temp/resolved_config.json
            RESOLVED=temp/resolved_config.json
          fi
          if python3 .github/scripts/patchers.py needs-bks "$RESOLVED"; then
            bash .github/scripts/build_install_bouncy_castle.sh
          else
            echo "Skipping Bouncy Castle installation (no BKS-needing Xposed modules found in config)."
          fi

      - name: Install signing keystore
        env:
          KEYSTORE_B64: ${{ secrets.KEYSTORE_B64 }}
          KEYSTORE_P12_B64: ${{ secrets.KEYSTORE_P12_B64 }}
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
        run: bash .github/scripts/install_keystore.sh

      - name: Resolve version code
        id: version
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bash .github/scripts/build_resolve_version.sh

      - name: Restore APKs Cache
        uses: actions/cache/restore@v6
        with:
          path: temp/apks
          key: apks-${{ github.run_id }}
          restore-keys: |
            apks-

      - name: Remove specific APKs from cache
        if: ${{ inputs.remove_apks != '' }}
        run: |
          if [ -d "temp/apks" ]; then
            cd temp/apks
            for apk in ${{ inputs.remove_apks }}; do
              echo "Removing $apk from cache..."
              rm -f $apk || true
            done
          fi

      - name: Setup Python dependencies
        run: |
          pip install --no-cache-dir curl_cffi || true

      - name: Build modules and apks
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_TOKEN: ${{ secrets.APKS_REPO_TOKEN }}
          UPLOAD_APKS_REPO: "${{ vars.APKS_REPO || 'nullcpy/apks' }}"
          GITHUB_REPOSITORY: ${{ github.repository }}
          NEXT_VER_CODE: ${{ steps.version.outputs.NEXT_VER_CODE }}
          CF_SOLVER_URL: "http://localhost:8000"
          RVB_MORPHE_PASSTHROUGH: "${{ vars.RVB_MORPHE_PASSTHROUGH || 'true' }}"
          RELEASE_NOTES_TG_LINK: "${{ vars.RELEASE_NOTES_TG_LINK || 'https://t.me/rvb27' }}"
          RELEASE_NOTES_DONATE_LINK: "${{ vars.RELEASE_NOTES_DONATE_LINK || 'https://fahim-ahmed05.github.io/donate' }}"
          RELEASE_NOTES_WEBSITE_LINK: "${{ vars.RELEASE_NOTES_WEBSITE_LINK || 'https://nullcpy.github.io' }}"
        run: |
          set -euo pipefail
          bash scripts/build.sh "${{ steps.context.outputs.CONFIG_FILE }}"

      - name: Update Usage Tracker
        env:
          APKS_REPO_TOKEN: ${{ secrets.APKS_REPO_TOKEN }}
          APKS_REPO: "${{ vars.APKS_REPO || 'nullcpy/apks' }}"
        run: python3 .github/scripts/update_usage_tracker.py || true
        
      - name: Cleanup old cached APKs
        run: bash .github/scripts/build_cache_cleanup.sh

      - name: Generate Cache Manifest
        if: always()
        run: |
          mkdir -p temp/apks
          find temp/apks/ -maxdepth 1 -type f -printf "%s %f\n" | sort > temp/cache_manifest.txt
          [ -s temp/cache_manifest.txt ] || rm -f temp/cache_manifest.txt

      - name: Save APKs Cache
        uses: actions/cache/save@v6
        if: always() && hashFiles('temp/cache_manifest.txt') != ''
        with:
          path: temp/apks
          key: apks-${{ hashFiles('temp/cache_manifest.txt') }}

      - name: Get output
        id: get_output
        run: bash .github/scripts/build_get_output.sh

      - name: Generate release manifest
        env:
          NEXT_VER_CODE: ${{ steps.version.outputs.NEXT_VER_CODE }}
          IS_PRERELEASE: ${{ steps.context.outputs.IS_PRERELEASE }}
        run: python3 .github/scripts/build_make_manifest.py

      - name: Upload to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ steps.version.outputs.NEXT_VER_CODE }}
          RELEASE_TITLE: "Build No. ${{ steps.version.outputs.NEXT_VER_CODE }}"
          RELEASE_BODY_FILE: build.md
          IS_PRERELEASE: ${{ steps.context.outputs.IS_PRERELEASE }}
          UPLOAD_FILES: "./build/*"
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: bash .github/scripts/build_upload_release.sh

      - name: Update changelog and module update files
        id: update_changelog
        env:
          NEXT_VER_CODE: ${{ steps.version.outputs.NEXT_VER_CODE }}
          ARCHIVE_TAG: ${{ steps.context.outputs.ARCHIVE_TAG }}
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: bash .github/scripts/build_update_changelog.sh

      - name: Commit updated build and module update files
        if: steps.update_changelog.outputs.has_modules == 'true'
        # Explicit staging (the auto-commit action's default would sweep in
        # unrelated dirt): pointers listed by build_update_changelog.sh plus
        # this build's changelog. Branch already checked out by that script.
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add --pathspec-from-file=.updated_pointers
          git add changelogs
          if git diff --cached --quiet; then
            echo "No update-branch changes to commit."
          else
            git commit -m "Bump version ${{ steps.version.outputs.NEXT_VER_CODE }}"
            git push origin update
          fi

      - name: Remove frequently updated apps
        run: |
          git checkout -f main
          bash .github/scripts/build_exclude_from_archive.sh

      - name: Upload to release (Archive)
        id: archive_upload
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ steps.context.outputs.ARCHIVE_TAG }}
          # Assets only: no metadata field is named, so the archive releases keep
          # the title, notes and pre-release badge written by hand while files are
          # (re)uploaded with --clobber. Why: docs/decisions/0001-release-metadata-ownership.md
          RELEASE_TARGET: main
          UPLOAD_FILES: "./build/*"
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: bash .github/scripts/build_upload_release.sh

      - name: Merge archive manifest into website branch
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ARCHIVE_TAG: ${{ steps.context.outputs.ARCHIVE_TAG }}
          BUILD_TAG: ${{ steps.version.outputs.NEXT_VER_CODE }}
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: bash .github/scripts/merge_archive_branch.sh

      - name: Notify telegram
        env:
          TG_TOKEN: ${{ secrets.TG_TOKEN }}
          TG_CHAT_ID: "${{ vars.TG_CHAT_ID || '@rvb27' }}"
          TG_CHAT_ID_BROADCAST: "${{ vars.TG_CHAT_ID_BROADCAST || '@rvb28' }}"
          TG_THREAD_ID: ${{ steps.context.outputs.TG_THREAD_ID }}
          TITLE_SUFFIX: ${{ steps.context.outputs.TITLE_SUFFIX }}
          NEXT_VER_CODE: ${{ steps.version.outputs.NEXT_VER_CODE }}
          GITHUB_SERVER_URL: ${{ github.server_url }}
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: bash .github/scripts/build_notify_telegram.sh