SHA256
Yuvomi Mobile Contributors
9088ee7e6a
Provide Android API 35/37 and Xcode jobs, dependency advisory checks, source invariants, and checksum-verified tools. Actions lint and available Linux static checks pass; hosted CI and all Apple-platform builds still require authorized runners. The manual release workflow never publishes and uses only owner-supplied signing credentials.
49 lines
2.4 KiB
YAML
49 lines
2.4 KiB
YAML
name: Maintainer release build (never publishes)
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
sign_android:
|
|
description: Sign APK and AAB using the protected release environment
|
|
type: boolean
|
|
default: false
|
|
permissions:
|
|
contents: read
|
|
jobs:
|
|
android:
|
|
runs-on: ubuntu-24.04
|
|
environment: release
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
|
|
- uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3
|
|
with:
|
|
distribution: temurin
|
|
java-version: '17'
|
|
- run: bash android/gradlew -p android testDebugUnitTest lintRelease assembleRelease bundleRelease
|
|
- name: Sign with maintainer-supplied credentials
|
|
if: inputs.sign_android
|
|
env:
|
|
KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
|
|
STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
|
|
KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
|
|
KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
|
|
run: |
|
|
set -euo pipefail
|
|
umask 077
|
|
test -n "$KEYSTORE_BASE64" && test -n "$STORE_PASSWORD" && test -n "$KEY_PASSWORD" && test -n "$KEY_ALIAS"
|
|
trap 'rm -f "$RUNNER_TEMP/release.jks"' EXIT
|
|
printf '%s' "$KEYSTORE_BASE64" | base64 --decode > "$RUNNER_TEMP/release.jks"
|
|
tools="$ANDROID_HOME/build-tools/36.0.0"
|
|
"$tools/zipalign" -p -f 4 android/app/build/outputs/apk/release/app-release-unsigned.apk "$RUNNER_TEMP/aligned.apk"
|
|
"$tools/apksigner" sign --ks "$RUNNER_TEMP/release.jks" --ks-key-alias "$KEY_ALIAS" --ks-pass env:STORE_PASSWORD --key-pass env:KEY_PASSWORD --out android/app/build/outputs/apk/release/yuvomi-release-signed.apk "$RUNNER_TEMP/aligned.apk"
|
|
"$tools/apksigner" verify --verbose android/app/build/outputs/apk/release/yuvomi-release-signed.apk
|
|
jarsigner -keystore "$RUNNER_TEMP/release.jks" -storepass:env STORE_PASSWORD -keypass:env KEY_PASSWORD android/app/build/outputs/bundle/release/app-release.aab "$KEY_ALIAS"
|
|
jarsigner -verify android/app/build/outputs/bundle/release/app-release.aab
|
|
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
|
|
with:
|
|
name: maintainer-android-release-builds
|
|
path: |
|
|
android/app/build/outputs/apk/release/*.apk
|
|
android/app/build/outputs/bundle/release/*.aab
|
|
retention-days: 7
|