default_platform :android

platform :android do
  desc "Build the Android release APK and AAB"
  lane :build_android_release do
    android_dir = File.expand_path('..', Dir.pwd)

    # Create google-services.json from GitHub secret
    File.write(
      File.join(android_dir, "app/google-services.json"),
      ENV["GOOGLE_SERVICES_JSON"]
    )

    # Build APK for GitHub Release.
    # flavor: "prod" is MANDATORY — task: "assemble" is a gradle meta-task
    # that, post-flavor, would build both prodRelease AND e2eRelease
    # (variantFilter kills e2eRelease but the meta-task would still run
    # through both flavors' dependency graphs). Pinning the flavor makes
    # the invocation unambiguous and halves CI time.
    gradle(
      task: "assemble",
      flavor: "prod",
      build_type: "Release",
      # The properties below are rendered into the command line fastlane echoes
      # before running it, and that echo is what put the signing passwords in
      # plaintext into android-build.log. Output stays on — the payload check's
      # allowlist assertion reads gradle's stdout.
      print_command: false,
      properties: {
        "android.injected.signing.store.file" => File.join(android_dir, "app/pocketpal-release-key.keystore"),
        "android.injected.signing.store.password" => ENV["KEYSTORE_PASSWORD"],
        "android.injected.signing.key.alias" => ENV["KEY_ALIAS"],
        "android.injected.signing.key.password" => ENV["KEY_PASSWORD"]
      }
    )

    # Build Bundle for Play Store (same reasoning — pin to prod flavor).
    gradle(
      task: "bundle",
      flavor: "prod",
      build_type: "Release",
      # The properties below are rendered into the command line fastlane echoes
      # before running it, and that echo is what put the signing passwords in
      # plaintext into android-build.log. Output stays on — the payload check's
      # allowlist assertion reads gradle's stdout.
      print_command: false,
      properties: {
        "android.injected.signing.store.file" => File.join(android_dir, "app/pocketpal-release-key.keystore"),
        "android.injected.signing.store.password" => ENV["KEYSTORE_PASSWORD"],
        "android.injected.signing.key.alias" => ENV["KEY_ALIAS"],
        "android.injected.signing.key.password" => ENV["KEY_PASSWORD"]
      }
    )
  end

  desc "Upload the built Android bundle to the Alpha track"
  lane :upload_android_alpha do
    android_dir = File.expand_path('..', Dir.pwd)
    aab = File.join(android_dir, "app/build/outputs/bundle/prodRelease/app-prod-release.aab")

    sh(File.expand_path("../../scripts/verify-plus-gate.sh", Dir.pwd), aab, "--gated")

    upload_to_play_store(
      track: "alpha",
      package_name: "com.pocketpalai",
      # Passed explicitly, and must stay that way. supply otherwise takes the
      # bundle from lane_context[SharedValues::GRADLE_AAB_OUTPUT_PATH], which
      # only exists in the process that ran `gradle(task: "bundle")` — a
      # separate one from this lane's. Its fallback globs do not match this
      # project's flavored output path, so an absent value uploads the
      # metadata, no binary, and reports success.
      aab: aab,
      skip_upload_metadata: false,
      skip_upload_images: true,
      skip_upload_screenshots: true,
      skip_upload_apk: true,
      metadata_path: File.join(android_dir, "..", "fastlane", "metadata", "android"),
      json_key: File.join(android_dir, "play-store-key.json")
    )
  end
end
