name: Android Signing
description: >
  Restore an Android release-signing keystore from repo secrets so Gradle can
  sign the release APK. Writes <key-alias>-release.jks plus keystore.properties
  in the workspace. When the keystore secret is empty the step is a no-op and
  the build stays unsigned — same optional-signing behavior the app repos had
  with their copy-pasted versions of this step.

inputs:
  keystore-b64:
    description: Base64-encoded release keystore (ANDROID_KEYSTORE_B64 secret).
    required: false
    default: ""
  keystore-password:
    description: Keystore/key password (ANDROID_KEYSTORE_PASSWORD secret).
    required: false
    default: ""
  key-alias:
    description: Key alias; also names the keystore file (<alias>-release.jks).
    required: true

runs:
  using: composite
  steps:
    - id: restore
      shell: bash
      env:
        KEYSTORE_B64: ${{ inputs.keystore-b64 }}
        KEYSTORE_PASSWORD: ${{ inputs.keystore-password }}
        KEY_ALIAS: ${{ inputs.key-alias }}
      run: |
        set -euo pipefail
        if [[ -z "${KEYSTORE_B64}" ]]; then
          echo "No keystore secret configured; release build stays unsigned."
          exit 0
        fi
        : "${KEYSTORE_PASSWORD:?keystore-b64 is set but keystore-password is empty}"
        printf '%s' "${KEYSTORE_B64}" | base64 -d > "${KEY_ALIAS}-release.jks"
        {
          echo "storeFile=${PWD}/${KEY_ALIAS}-release.jks"
          echo "storePassword=${KEYSTORE_PASSWORD}"
          echo "keyAlias=${KEY_ALIAS}"
          echo "keyPassword=${KEYSTORE_PASSWORD}"
        } > keystore.properties
        echo "Restored ${KEY_ALIAS}-release.jks and keystore.properties."