name: Auto Publish to Google Play on Release

on:
  release:
    types: [published]
  # Manual trigger for Android-only releases: promote the build already on the
  # internal track (uploaded by build-android.yml on the v* tag push) straight to
  # production, without publishing a GitHub release that would fan out to the
  # desktop/web channels (AUR, Docker, snap, web).
  workflow_dispatch:
    inputs: {}

jobs:
  auto-publish-google-play:
    runs-on: ubuntu-latest

    # Run on manual dispatch, or for actual (non-pre-) releases.
    if: ${{ github.event_name == 'workflow_dispatch' || !github.event.release.prerelease }}

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            androidpublisher.googleapis.com:443
            play.google.com:443
            oauth2.googleapis.com:443
            www.googleapis.com:443

      - name: Promote Internal Release to Production
        uses: kevin-david/promote-play-release@d1ed59ca4fd7456b9d8cae062a3684e93b412425 # v1.2.0
        with:
          service-account-json-raw: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
          package-name: com.superproductivity.superproductivity
          from-track: internal
          to-track: production
          inapp-update-priority: 3
