puzzle-quest/.gitea/workflows/build.yml

name: Build Puzzle Quest

on:
  push:
    branches: [dev, main, feature/godot-migration]
  pull_request:
    branches: [dev, main]
  workflow_dispatch:

env:
  GODOT_VERSION: "4.6"

jobs:
  # ---------------------------------------------------------------------------
  # 1. GDScript validation — parse every script and fail on errors / warnings.
  # ---------------------------------------------------------------------------
  validate:
    name: Validate GDScript
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: ./.gitea/actions/setup-godot
        with:
          version: ${{ env.GODOT_VERSION }}

      - name: Import project (parses every .gd / .tscn)
        run: |
          godot --headless --import 2>&1 | tee /tmp/godot-import.log || true

      - name: Fail on parse / script errors
        run: |
          if grep -qE "SCRIPT ERROR|Parse Error|ERROR: .*\.gd" /tmp/godot-import.log; then
            echo "::error::GDScript errors detected during import"
            grep -E "SCRIPT ERROR|Parse Error|ERROR: .*\.gd" /tmp/godot-import.log
            exit 1
          fi

  # ---------------------------------------------------------------------------
  # 2. Static analysis — gdlint from Scony's gdtoolkit (Python, no Godot).
  #    Runs in parallel with `validate`. Exports do NOT depend on this job,
  #    so a lint failure does not block builds while the Godot-3 leftovers
  #    are still being cleaned up. Once the tree is clean, add this job to
  #    the `needs:` of the export jobs to make it a hard gate.
  # ---------------------------------------------------------------------------
  lint:
    name: Lint GDScript
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install gdtoolkit
        run: |
          python3 -m venv /tmp/gdlint-venv
          /tmp/gdlint-venv/bin/pip install --quiet "gdtoolkit==4.*"
          echo "/tmp/gdlint-venv/bin" >> "$GITHUB_PATH"

      - name: Run gdlint
        run: gdlint scripts db scenes

  # ---------------------------------------------------------------------------
  # 3. Desktop exports — runs in parallel.
  #    macOS is commented out until a preset is added in the Godot editor
  #    (export_presets.cfg has none today). Restore the entry once the preset
  #    exists; the matrix is otherwise ready to take it.
  # ---------------------------------------------------------------------------
  export-desktop:
    name: Export ${{ matrix.platform }}
    needs: validate
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: Windows
            preset: WindowsDebug
            output: releases/windows/Puzzle-Quest.exe
            artifact_path: releases/windows
          - platform: Linux
            preset: Linux/X11Debug
            output: releases/linux/Puzzle-Quest.x86_64
            artifact_path: releases/linux
          # - platform: macOS
          #   preset: macOS
          #   output: releases/macos/Puzzle-Quest.zip
          #   artifact_path: releases/macos
    steps:
      - uses: actions/checkout@v4

      - uses: ./.gitea/actions/setup-godot
        with:
          version: ${{ env.GODOT_VERSION }}
          templates: "true"

      - name: Import project
        run: godot --headless --import || true

      - name: Prepare output dir
        run: mkdir -p "${{ matrix.artifact_path }}"

      - name: Export ${{ matrix.platform }}
        run: godot --headless --export-debug "${{ matrix.preset }}" "${{ matrix.output }}"

      - name: Upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: PuzzleQuest-${{ matrix.platform }}
          path: ${{ matrix.artifact_path }}
          if-no-files-found: error
          retention-days: 14

  # ---------------------------------------------------------------------------
  # 4. Android export — Godot + JDK 17 + Android SDK installed in $HOME.
  #    Provide ANDROID_KEYSTORE_BASE64 as a Gitea secret for a stable signature;
  #    otherwise a fresh debug keystore is generated on each run.
  # ---------------------------------------------------------------------------
  export-android:
    name: Export Android
    needs: validate
    runs-on: ubuntu-latest
    env:
      ANDROID_HOME: ${{ github.workspace }}/.android-sdk
    steps:
      - uses: actions/checkout@v4

      - uses: ./.gitea/actions/setup-godot
        with:
          version: ${{ env.GODOT_VERSION }}
          templates: "true"

      - name: Install JDK 17
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends openjdk-17-jdk
          echo "JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64" >> "$GITHUB_ENV"

      - name: Install Android command-line tools + SDK
        run: |
          set -euo pipefail
          mkdir -p "$ANDROID_HOME/cmdline-tools"
          wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -O /tmp/cmdline.zip
          unzip -q /tmp/cmdline.zip -d "$ANDROID_HOME/cmdline-tools"
          mv "$ANDROID_HOME/cmdline-tools/cmdline-tools" "$ANDROID_HOME/cmdline-tools/latest"
          # `yes |` returns 141 (SIGPIPE) under `set -o pipefail` once sdkmanager
          # closes its stdin — feed a finite stream of "y" answers instead.
          printf 'y\n%.0s' {1..50} | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses >/dev/null
          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" \
            "platform-tools" "platforms;android-34" "build-tools;34.0.0" >/dev/null

      - name: Provision debug keystore
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
        run: |
          if [ -n "${ANDROID_KEYSTORE_BASE64:-}" ]; then
            echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > /tmp/debug.keystore
          else
            keytool -keyalg RSA -genkeypair -alias androiddebugkey -keypass android \
              -keystore /tmp/debug.keystore -storepass android \
              -dname "CN=Android Debug,O=Android,C=US" -validity 9999
          fi
          # Godot rejects exports unless all three keystore/debug{,_user,_password}
          # are set together (or all three empty) — patch every one.
          sed -i 's@keystore/debug=".*"@keystore/debug="/tmp/debug.keystore"@g' export_presets.cfg
          sed -i 's@keystore/debug_user=".*"@keystore/debug_user="androiddebugkey"@g' export_presets.cfg
          sed -i 's@keystore/debug_password=".*"@keystore/debug_password="android"@g' export_presets.cfg

      - name: Write Godot editor settings (Android SDK / JDK paths)
        run: |
          mkdir -p ~/.config/godot
          # Godot 4.5+ uses a minor-version-suffixed settings file
          # (editor_settings-4.6.tres for 4.6), not the major-only -4.tres.
          cat > ~/.config/godot/editor_settings-${GODOT_VERSION}.tres <<EOF
          [gd_resource type="EditorSettings" format=3]
          [resource]
          export/android/android_sdk_path = "${ANDROID_HOME}"
          export/android/java_sdk_path = "/usr/lib/jvm/java-17-openjdk-amd64"
          export/android/debug_keystore = "/tmp/debug.keystore"
          export/android/debug_keystore_user = "androiddebugkey"
          export/android/debug_keystore_pass = "android"
          EOF

      - name: Import project
        run: godot --headless --import || true

      - name: Prepare output dir
        run: mkdir -p releases/android

      - name: Export Android APK
        run: godot --headless --export-debug "AndroidDebug" "releases/android/Puzzle-Quest.apk"

      - name: Sign + verify APK
        run: |
          set -euo pipefail
          APK="releases/android/Puzzle-Quest.apk"
          APKSIGNER="$ANDROID_HOME/build-tools/34.0.0/apksigner"
          # Godot 4.6 sometimes ships an unsigned APK from the headless
          # export (sign step skips silently when its internal apksigner
          # call can't locate java). Re-sign unconditionally — idempotent
          # if Godot did sign, and guarantees a valid APK if it didn't.
          "$APKSIGNER" sign \
            --ks /tmp/debug.keystore \
            --ks-pass pass:android \
            --ks-key-alias androiddebugkey \
            --key-pass pass:android \
            --v1-signing-enabled true \
            --v2-signing-enabled true \
            --v3-signing-enabled true \
            "$APK"
          "$APKSIGNER" verify --verbose "$APK"

      - name: Upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: PuzzleQuest-Android
          path: releases/android
          if-no-files-found: error
          retention-days: 14