nessi/Yuvomi-App
SHA256
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: target Gitea Ubuntu and native Apple Silicon runners
iOS validation / simulator (push) Failing after 3s
Details
Android validation / emulator (35) (push) Failing after 9s
Details
Android validation / emulator (37.0) (push) Failing after 9s
Details
Android validation / build (push) Successful in 3m40s
Details

Browse Source 
Move workflows into Gitea's workflow directory and use the supplied ubuntu-latest and macos-arm64 labels. Provision the Android SDK, require KVM without changing host permissions, support SHA-256 checkout and Gitea artifact uploads, and isolate scratch output on persistent runners. Skip untrusted fork PRs and keep release builds unsigned because Gitea ignores GitHub environment approval gates. Local workflow lint, repository invariants, ten preflight regressions, eight evidence-verifier tests, inline shell checks, scratch cleanup and SHA-256 fetch checks pass; remote runner execution remains unverified.
This commit is contained in:
Yuvomi Mobile Contributors committed 2026-10-21 07:40:19 +02:00
1 parent 2d12491516
commit 11bf4ca620
16 files changed
+442 -192
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/release-process.md
+14 -17
View File
@@ -23,19 +23,16 @@ to either store. A debug APK or unsigned archive is not a production release.
## Android
The manual `release.yml` workflow uses a protected GitHub environment named
`release`. Configure branch restrictions and required reviewers before adding
secrets. With `sign_android=false` it emits unsigned artifacts. Signing requires:
The manual `.gitea/workflows/release.yml` workflow runs on `ubuntu-latest` and
emits **unsigned** artifacts only. Gitea ignores GitHub environment approval gates,
so this workflow does not load signing secrets or offer a signing toggle.
- `ANDROID_KEYSTORE_BASE64`
- `ANDROID_STORE_PASSWORD`
- `ANDROID_KEY_PASSWORD`
- `ANDROID_KEY_ALIAS`
The workflow uses `zipalign`, `apksigner`, and `jarsigner`; private material exists
only in a restrictive runner-temporary file removed on exit. Securely back up the
real upload key and use Play App Signing according to the owner's policy. No
production key is generated here. Manually verify APK/AAB signatures and inspect
An authorized maintainer must separately sign the verified APK/AAB using their
own keystore, alias and passwords with `zipalign`, `apksigner`, and `jarsigner`.
Keep private material in a protected signing environment, never on the general
validation runners. Securely back up the real upload key and use Play App Signing
according to the owner's policy. No production key is generated here.
Manually verify APK/AAB signatures and inspect
the final manifest: no debuggable flag, HTTP/test CA or unintended exported component.
Never distribute an `.integration` package or include its generated test resources.
Run `python3 scripts/collect-android-artifacts.py` immediately after the clean-source
@@ -65,8 +62,8 @@ privacy need physical-device validation beyond simulator tests.
## CI hosting
GitHub Actions files are provided, but the configured community remote is hosted
on a different forge. GitHub workflows will not automatically run there. Enable
an authorized GitHub mirror/repository (or port the jobs to the forge's runner)
and inspect real runs before claiming CI is operational. No destination is
created automatically. CI service availability is not an application dependency.
Gitea Actions workflows are provided in `.gitea/workflows/`, using the supplied
`ubuntu-latest` and `macos-arm64` runner labels. See [runner setup](ci-runners.md)
for SDK, KVM, Xcode, simulator and security requirements. Repository Actions must
be enabled. Inspect actual runs before claiming CI is operational; no GitHub
mirror or store destination is created. CI is not an application dependency.