name: fdroid-publish
description: >
  Publish an already-built, signed APK to a SilverLABS F-Droid channel
  (beta = apps.silverlined.uk/fdroid-test, stable = apps.silverlined.uk/fdroid).
  The host verifies the signer against the app's pinned cert; the action refuses
  to publish a versionCode that is not newer than what the channel serves, and
  reads the index back afterwards.
inputs:
  app:
    description: silverchat | silvervpn | silverstore | silvermail | silverbeats
    required: true
  apk:
    description: Path to the signed APK
    required: true
  channel:
    description: beta | stable
    required: false
    default: beta
  version-code:
    description: The APK's versionCode (read from the APK with aapt2 when omitted)
    required: false
    default: ''
  ssh-key:
    description: Private key authorised for the repo host's incoming dir (secrets.FDROID_SSH_KEY)
    required: true
  dry-run:
    description: "'true' to validate everything and stop before uploading"
    required: false
    default: 'false'
  ssh-host:
    required: false
    default: silverlined.uk
  ssh-user:
    required: false
    default: sysadmin
runs:
  using: composite
  steps:
    - name: Publish to F-Droid ${{ inputs.channel }}
      shell: bash
      env:
        INPUT_APP: ${{ inputs.app }}
        INPUT_APK: ${{ inputs.apk }}
        INPUT_CHANNEL: ${{ inputs.channel }}
        INPUT_VERSION_CODE: ${{ inputs.version-code }}
        INPUT_SSH_KEY: ${{ inputs.ssh-key }}
        INPUT_DRY_RUN: ${{ inputs.dry-run }}
        INPUT_SSH_HOST: ${{ inputs.ssh-host }}
        INPUT_SSH_USER: ${{ inputs.ssh-user }}
      run: bash "${{ github.action_path }}/publish.sh"