name: Android Debug APK

# Builds an unsigned debug APK for manual on-device testing and validates the
# Android release lint path used by stable APK/AAB builds.
on:
  workflow_dispatch:
  pull_request:

# Read-only access is all this build needs; the APK is shared via the
# upload-artifact action rather than by writing to the repo.
permissions:
  contents: read

jobs:
  build-debug-apk:
    name: Build debug APK
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # Pin to Temurin JDK 17 — the version this Android toolchain
      # (AGP 8.2.1 / Gradle 8.7 / Kotlin 1.9.24) is built and tested against.
      # Kept in sync with android-release-build.yml so debug and release CI
      # builds use the same JDK as the release artifacts. setup-java exports
      # JAVA_HOME, which Flutter and the Gradle daemon pick up for the build.
      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "17"

      # Keep this Flutter version in sync with .github/workflows/ci.yml.
      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          channel: stable
          flutter-version: 3.27.4
          cache: true

      # --enforce-lockfile builds the APK from the exact committed dependency
      # set (same as the CI quality job and the reproducible F-Droid build),
      # failing loudly if pubspec.lock has drifted rather than resolving anew.
      - name: Install dependencies
        run: flutter pub get --enforce-lockfile

      - name: Build debug APK
        run: flutter build apk --debug

      # A debug APK does not execute lintVitalRelease. Run that task explicitly
      # so invalid release-only Android resources fail on the PR instead of
      # breaking a stable tag after it has already been created.
      - name: Validate release Android lint
        working-directory: android
        run: ./gradlew lintVitalRelease

      # Fail fast if the build produced no usable artifact. The upload step
      # below also guards with if-no-files-found: error, but checking here gives
      # a clearer "build produced nothing" signal independent of the uploader,
      # and rejects a truncated/empty APK a debug build should never emit.
      - name: Verify build output exists
        run: |
          set -euo pipefail
          apk="build/app/outputs/flutter-apk/app-debug.apk"
          if [ ! -f "$apk" ]; then
            echo "::error::Expected debug APK not found at $apk after the build."
            exit 1
          fi
          bytes=$(stat -c%s "$apk")
          if [ "$bytes" -lt 1000000 ]; then
            echo "::error::Debug APK at $apk is only ${bytes} bytes (<1 MB); the build looks broken."
            exit 1
          fi
          echo "Debug APK present: $apk (${bytes} bytes)."

      - name: Upload debug APK
        uses: actions/upload-artifact@v4
        with:
          name: linthra-debug-apk
          path: build/app/outputs/flutter-apk/app-debug.apk
          if-no-files-found: error
