ci: integration tests with DeepSeek key, release APK signing, auto-release on tags

.gitea/workflows/build-apk.yml

@@ -3,13 +3,14 @@ name: build-apk
 on:
   push:
     branches: [master]
+    tags: ['v*']
   workflow_dispatch:
 
 jobs:
   build:
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/cirruslabs/flutter:stable
+      image: ghcr.io/cirruslabs/flutter:latest
     steps:
       # The cirruslabs/flutter image has no Node.js; actions/checkout and
       # actions/upload-artifact are JS actions that need `node` inside the job container.
@@ -50,14 +51,58 @@ jobs:
       - name: Analyze
         run: flutter analyze
 
-      - name: Test
+      - name: Unit tests
         run: flutter test
 
+      - name: Integration tests (DeepSeek AI)
+        run: flutter test test/features/notification_parsing/integration/ --dart-define=DEEPSEEK_API_KEY=${{ secrets.DEEPSEEK_API_KEY }}
+        env:
+          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
+
       - name: Build debug APK
         run: flutter build apk --debug
 
-      - name: Upload APK
+      - name: Restore release keystore
+        run: |
+          mkdir -p android/app
+          echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > android/app/release-keystore.p12
+          printf 'storeFile=release-keystore.p12\nstorePassword=%s\nkeyAlias=%s\nkeyPassword=%s\n' \
+            "${{ secrets.KEYSTORE_PASSWORD }}" \
+            "${{ secrets.KEY_ALIAS }}" \
+            "${{ secrets.KEY_PASSWORD }}" > android/key.properties
+
+      - name: Build release APK
+        run: flutter build apk --release
+
+      - name: Upload debug APK
         uses: actions/upload-artifact@v4
         with:
           name: onbudget-debug-apk
           path: build/app/outputs/flutter-apk/app-debug.apk
+
+      - name: Upload release APK
+        uses: actions/upload-artifact@v4
+        with:
+          name: onbudget-release-apk
+          path: build/app/outputs/flutter-apk/app-release.apk
+
+      - name: Create Gitea release
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -eux
+          TAG=${GITHUB_REF_NAME}
+          API="${{ github.api_url }}/repos/${GITHUB_REPOSITORY}"
+          REL=$(curl -s -X POST "$API/releases" \
+            -H "Authorization: token ${GITHUB_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"${TAG}\",\"name\":\"${TAG}\",\"body\":\"OnBudget ${TAG} — debug + release APKs\"}")
+          ID=$(echo "$REL" | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
+          echo "release id: ${ID}"
+          for f in build/app/outputs/flutter-apk/app-debug.apk build/app/outputs/flutter-apk/app-release.apk; do
+            echo "uploading $(basename "$f")"
+            curl -s -X POST "$API/releases/${ID}/assets?name=$(basename "$f")" \
+              -H "Authorization: token ${GITHUB_TOKEN}" \
+              -F "attachment=@$f" | python3 -c "import json,sys; d=json.load(sys.stdin); print('  ok:', d.get('name'))"
+          done