frosty/.github/workflows/release-dryrun.yml

# Dry-runs the full store release pipeline without publishing, to catch
# credential, signing, dependency, and store-validation breakage before an
# actual release. Mirrors store-release.yml but stops short of publishing:
# Android validates the AAB against Google Play (validate_only); iOS builds a
# fully signed archive via match (readonly) and skips the App Store upload.
name: Release dry-run
on:
  # Run on demand before cutting a release.
  workflow_dispatch:
  # Weekly heartbeat so cert expiry, secret rotation, and dependency drift
  # surface on their own between releases.
  schedule:
    - cron: '0 9 * * 1' # Mondays 09:00 UTC
# Setup environment variables for use in all jobs.
env:
  # Gemfile path used for caching dependencies.
  BUNDLE_GEMFILE: ${{ github.workspace }}/android/Gemfile
  CLIENT_ID: ${{ secrets.CLIENT_ID }}
  SECRET: ${{ secrets.SECRET }}
  LC_ALL: en_US.UTF-8
  LANG: en_US.UTF-8
jobs:
  android:
    name: Dry-run Android release
    runs-on: ubuntu-latest
    environment: release-android
    env:
      UPLOAD_KEYSTORE: ${{ secrets.UPLOAD_KEYSTORE }}
      STORE_PASSWORD: ${{ secrets.STORE_PASSWORD }}
      KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
      KEY_FILE_PATH: android/key.properties
      PLAY_STORE_CREDENTIALS: ${{ secrets.PLAY_STORE_CREDENTIALS }}

    steps:
      - name: Checkout Frosty repo
        uses: actions/checkout@v6

      # Install Ruby and install/cache dependencies with bundler in order to use fastlane.
      - name: Set up Ruby and Bundler
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: 3.3
          bundler-cache: true

      # Setup Java so that we can build the appbundle.
      - name: Set up Java
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 21

      # Setup and cache Flutter to install packages and build.
      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version-file: pubspec.yaml
          cache: true

      # Decode and create the upload-keystore.jks file, used for signing the app.
      - name: Decode and create upload-keystore.jks
        run: echo $UPLOAD_KEYSTORE | base64 --decode > $GITHUB_WORKSPACE/android/upload-keystore.jks

      # Create the key.properties file, used for signing the app.
      - name: Create key.properties
        run: |
          echo storePassword=$STORE_PASSWORD >> $KEY_FILE_PATH
          echo keyPassword=$KEY_PASSWORD >> $KEY_FILE_PATH
          echo keyAlias=upload >> $KEY_FILE_PATH
          echo storeFile=$GITHUB_WORKSPACE/android/upload-keystore.jks >> $KEY_FILE_PATH

      # Build the Android app bundle (AAB) and pass the environment variables.
      #
      # The version code is overridden because Play rejects one it has already
      # seen, and pubspec's code is by definition already published between
      # releases — so the dry-run would fail on every scheduled run and never
      # reach the validation it exists to perform. Epoch seconds is always
      # unused, always increasing, and well under Play's 2100000000 cap. The
      # bundle is only ever validated, never published, so the value is thrown
      # away. versionName still comes from pubspec.
      - name: Build the Android AAB
        run: flutter build appbundle --build-number=$(date +%s) --dart-define CLIENT_ID=$CLIENT_ID --dart-define SECRET=$SECRET

      # Validate the AAB and credentials against Google Play without publishing.
      - name: Validate release with fastlane (no publish)
        run: cd android && bundle exec fastlane deploy dry_run:true
  ios:
    name: Dry-run iOS release
    runs-on: macos-latest
    environment: release-ios
    env:
      APP_STORE_KEY_ID: ${{ secrets.APP_STORE_KEY_ID }}
      APP_STORE_ISSUER_ID: ${{ secrets.APP_STORE_ISSUER_ID }}
      APP_STORE_CREDENTIALS: ${{ secrets.APP_STORE_CREDENTIALS }}
      MATCH_GIT_BASIC_AUTHORIZATION: ${{ secrets.MATCH_GIT_BASIC_AUTHORIZATION }}
      MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
    steps:
      - name: Checkout Frosty repo
        uses: actions/checkout@v6

      # Always pick the newest production Xcode on the runner.
      - uses: maxim-lobanov/setup-xcode@v1
        with:
          xcode-version: latest-stable

      # Install Ruby and install/cache dependencies with bundler in order to use fastlane.
      - name: Set up Ruby and Bundler
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: 3.3
          bundler-cache: true

      # Setup and cache Flutter to install packages and build.
      - name: Set up Flutter
        uses: subosito/flutter-action@v2
        with:
          flutter-version-file: pubspec.yaml
          cache: true

      # Setup the iOS project with environment variables without signing (building and signing will happen in fastlane).
      - name: Config the iOS build
        run: flutter build ios --no-codesign --config-only --dart-define CLIENT_ID=$CLIENT_ID --dart-define SECRET=$SECRET

      # Authenticate ASC API key, resolve signing via match (readonly), and build a
      # fully signed archive without uploading to the App Store.
      - name: Sign and build with fastlane (no publish)
        run: cd ios && bundle exec fastlane release dry_run:true

  # A heartbeat nobody reads is worse than none: it reads as green by default.
  # This one broke on the release after 5.1.0 and stayed broken for weeks
  # without surfacing, so scheduled failures now open a tracking issue and
  # comment on it each week it stays red. Only on `schedule` — a failed
  # workflow_dispatch is already in front of whoever pressed the button.
  notify:
    name: Report scheduled failure
    needs: [android, ios]
    if: failure() && github.event_name == 'schedule'
    runs-on: ubuntu-latest
    permissions:
      issues: write
    steps:
      - name: Open or update the tracking issue
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          LABEL: release-dryrun
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          set -euo pipefail

          # Idempotent: `gh issue create --label` fails outright if the label
          # is missing, and it won't exist on the first failure.
          gh label create "$LABEL" \
            --color B60205 \
            --description "Automated: the weekly release dry-run is failing" \
            2>/dev/null || true

          existing=$(gh issue list --state open --label "$LABEL" --limit 1 \
            --json number --jq '.[0].number // empty')

          if [ -n "$existing" ]; then
            gh issue comment "$existing" --body \
              "Still failing as of $(date -u +%Y-%m-%d). $RUN_URL"
          else
            gh issue create \
              --title "Release dry-run is failing" \
              --label "$LABEL" \
              --body "$(printf '%s\n' \
                "The weekly release dry-run failed: $RUN_URL" \
                "" \
                "This checks the release pipeline between releases — Play and App Store credentials, signing certs and provisioning profiles, and that a release build still validates against both stores. A failure here means the next release is likely to fail too, so it's worth fixing before cutting one." \
                "" \
                "Closing this issue is fine once the run is green; a later failure opens a new one.")"
          fi