flutter.yml

name: Flutter Build & Release

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

permissions:
  contents: write
  checks: write
  pull-requests: write
  packages: write

env:
  WEB_ARTIFACT_NAME: tablemaster-web-prod.zip
  IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/tablemaster-mobile-web

jobs:
  build-and-test:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        flutter-version: ['3.38.9']

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version: ${{ matrix.flutter-version }}
          channel: stable
          cache: true

      - name: Show Flutter version
        run: flutter --version

      - name: Check prod config exists
        run: test -f config/prod.json

      - name: Check Sentry Flutter secret exists
        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
        env:
          SENTRY_DSN: ${{ secrets.SENTRY_DSN_FLUTTER }}
        run: test -n "$SENTRY_DSN"

      - name: Define release version
        run: |
          VERSION_NAME=$(awk '/^version:/ { split($2, parts, "+"); print parts[1] }' pubspec.yaml)
          test -n "$VERSION_NAME"
          echo "MOBILE_VERSION_NAME=$VERSION_NAME" >> "$GITHUB_ENV"
          echo "MOBILE_VERSION=$VERSION_NAME+${GITHUB_RUN_NUMBER}" >> "$GITHUB_ENV"
          echo "SENTRY_RELEASE=tablemaster-mobile@$VERSION_NAME+${GITHUB_RUN_NUMBER}" >> "$GITHUB_ENV"

      - name: Get dependencies
        run: flutter pub get

      - name: Audit outdated dependencies
        run: flutter pub outdated | tee flutter-dependencies-report.txt

      - name: Run Flutter Analyze
        run: flutter analyze

      - name: Run Flutter Tests
        run: |
          set +e
          flutter test --machine > flutter-test-output.log 2>&1
          test_exit_code=$?

          awk '/^\{/ { print }' flutter-test-output.log > flutter-test-results.json

          if [ ! -s flutter-test-results.json ]; then
            cat flutter-test-output.log
            echo "No valid Flutter JSON test output was generated."
            exit 1
          fi

          exit "$test_exit_code"

      - name: Upload Flutter Test Results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: flutter-test-results
          path: |
            flutter-test-results.json
            flutter-test-output.log

      - name: Test Report
        if: always()
        uses: dorny/test-reporter@v1
        with:
          name: Flutter Test Results
          path: flutter-test-results.json
          reporter: 'flutter-json'

      - name: Run Flutter Format Check
        run: dart format --output=none --set-exit-if-changed lib test

      - name: Build Web Production
        env:
          SENTRY_DSN: ${{ secrets.SENTRY_DSN_FLUTTER }}
        run: >
          flutter build web --release
          --dart-define-from-file=config/prod.json
          --dart-define=SENTRY_DSN="$SENTRY_DSN"
          --dart-define=SENTRY_RELEASE="$SENTRY_RELEASE"
          --build-name="$MOBILE_VERSION_NAME"
          --build-number="$GITHUB_RUN_NUMBER"

      - name: Zip Web Build
        run: |
          cd build/web
          zip -r ../../${WEB_ARTIFACT_NAME} .

      - name: Prepare stable Android signing
        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
          ANDROID_STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        run: |
          set -euo pipefail
          test -n "$ANDROID_KEYSTORE_BASE64"
          test -n "$ANDROID_KEY_ALIAS"
          test -n "$ANDROID_STORE_PASSWORD"
          test -n "$ANDROID_KEY_PASSWORD"

          printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 --decode > android/app/upload-keystore.jks
          chmod 600 android/app/upload-keystore.jks

          {
            printf 'storePassword=%s\n' "$ANDROID_STORE_PASSWORD"
            printf 'keyPassword=%s\n' "$ANDROID_KEY_PASSWORD"
            printf 'keyAlias=%s\n' "$ANDROID_KEY_ALIAS"
            printf 'storeFile=app/upload-keystore.jks\n'
          } > android/key.properties
          chmod 600 android/key.properties

      - name: Build APK Production
        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
        env:
          SENTRY_DSN: ${{ secrets.SENTRY_DSN_FLUTTER }}
        run: >
          flutter build apk --release
          --dart-define-from-file=config/prod.json
          --dart-define=SENTRY_DSN="$SENTRY_DSN"
          --dart-define=SENTRY_RELEASE="$SENTRY_RELEASE"
          --build-name="$MOBILE_VERSION_NAME"
          --build-number="$GITHUB_RUN_NUMBER"

      - name: Rename APK
        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
        run: |
          cp build/app/outputs/flutter-apk/app-release.apk tablemaster-prod.apk

      - name: Prepare release checksums
        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
        run: |
          sha256sum \
            tablemaster-prod.apk \
            "${WEB_ARTIFACT_NAME}" \
            CHANGELOG.md \
            flutter-test-results.json \
            > SHA256SUMS

      - name: Upload workflow artifacts
        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
        uses: actions/upload-artifact@v4
        with:
          name: flutter-builds
          path: |
            tablemaster-prod.apk
            ${{ env.WEB_ARTIFACT_NAME }}
            SHA256SUMS
            CHANGELOG.md
            flutter-dependencies-report.txt

      - name: Create GitHub Release
        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          TAG="mobile-v${MOBILE_VERSION}"
          TITLE="TableMaster Mobile ${MOBILE_VERSION}"

          gh release create "$TAG" \
            tablemaster-prod.apk \
            "${WEB_ARTIFACT_NAME}" \
            SHA256SUMS \
            CHANGELOG.md \
            flutter-test-results.json \
            flutter-test-output.log \
            flutter-dependencies-report.txt \
            --title "$TITLE" \
            --notes "Release Flutter de production depuis main.

          Version: ${MOBILE_VERSION}
          Commit: ${{ github.sha }}
          Release Sentry: ${SENTRY_RELEASE}

          Validation:
          - flutter analyze
          - flutter test
          - dart format
          - audit flutter pub outdated
          - build web release
          - APK release avec signature stable

          Fichiers principaux:
          - tablemaster-prod.apk
          - ${WEB_ARTIFACT_NAME}
          - SHA256SUMS
          - CHANGELOG.md" \
            --latest

  docker-build-and-push:
    name: Build and push web Docker image
    runs-on: ubuntu-latest
    needs: build-and-test

    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Download web artifact
        uses: actions/download-artifact@v4
        with:
          name: flutter-builds

      - name: Extract web build
        run: |
          mkdir -p web-deploy
          unzip -q "${WEB_ARTIFACT_NAME}" -d web-deploy
          mkdir -p build
          mv web-deploy build/web

      - name: Normalize image name
        run: |
          IMAGE_NAME_LOWER=$(echo "${IMAGE_NAME}" | tr '[:upper:]' '[:lower:]')
          echo "IMAGE_NAME_LOWER=$IMAGE_NAME_LOWER" >> $GITHUB_ENV

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push web image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: |
            ${{ env.IMAGE_NAME_LOWER }}:prod
            ${{ env.IMAGE_NAME_LOWER }}:${{ github.sha }}

  deploy-web:
    name: Deploy web to Oracle VPS
    runs-on: ubuntu-latest
    needs: docker-build-and-push

    if: github.event_name == 'push' && github.ref == 'refs/heads/main'

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Prepare SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.ORACLE_SSH_KEY_B64 }}" | base64 -d > ~/.ssh/oracle_key
          chmod 600 ~/.ssh/oracle_key
          ssh-keyscan -H ${{ secrets.ORACLE_HOST }} >> ~/.ssh/known_hosts

      - name: Copy Docker Compose file
        env:
          ORACLE_USER: ${{ secrets.ORACLE_USER }}
          ORACLE_HOST: ${{ secrets.ORACLE_HOST }}
        run: |
          set -e
          REMOTE_APP_DIR="/opt/tablemaster/prod/TableMasterMobile"
          test -n "$ORACLE_USER"
          test -n "$ORACLE_HOST"

          ssh -i ~/.ssh/oracle_key "$ORACLE_USER@$ORACLE_HOST" "mkdir -p '$REMOTE_APP_DIR'"
          scp -i ~/.ssh/oracle_key docker-compose.prod.yml "$ORACLE_USER@$ORACLE_HOST:$REMOTE_APP_DIR/docker-compose.yml"

      - name: Deploy with Docker Compose
        env:
          ORACLE_USER: ${{ secrets.ORACLE_USER }}
          ORACLE_HOST: ${{ secrets.ORACLE_HOST }}
          GHCR_OWNER: ${{ github.repository_owner }}
          GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
          GHCR_READ_TOKEN: ${{ secrets.GHCR_READ_TOKEN }}
        run: |
          set -e
          REMOTE_APP_DIR="/opt/tablemaster/prod/TableMasterMobile"

          test -n "$ORACLE_USER"
          test -n "$ORACLE_HOST"
          test -n "$GHCR_USERNAME"
          test -n "$GHCR_READ_TOKEN"

          GHCR_OWNER_LOWER=$(echo "$GHCR_OWNER" | tr '[:upper:]' '[:lower:]')

          ssh -i ~/.ssh/oracle_key "$ORACLE_USER@$ORACLE_HOST" << EOF
            set -e

            cd "$REMOTE_APP_DIR"
            export GHCR_OWNER="$GHCR_OWNER_LOWER"

            echo "$GHCR_READ_TOKEN" | docker login ghcr.io -u "$GHCR_USERNAME" --password-stdin

            docker compose pull
            docker compose up -d
            docker image prune -f

            docker compose ps
          EOF