diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index 01a63cf..2d86d99 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -2,39 +2,62 @@ # Gitea release, so Obtainium can track updates. See issue #3. # # Required repository secrets (Settings → Secrets → Actions): -# KEYSTORE_PASSPHRASE — decrypts android/release-keystore.enc (committed) +# KEYSTORE_PASSPHRASE — decrypts android/release-keystore.enc (committed). +# Use 32+ random chars; enables rotation without code changes. # RELEASE_STORE_PASSWORD — keystore password -# RELEASE_KEY_ALIAS — key alias (mindlist) +# RELEASE_KEY_ALIAS — key alias (mindlist; not secret, kept as secret for uniformity) # RELEASE_KEY_PASSWORD — key password # -# Obtainium: Add App → Gitea → paste the repo URL. If the repo is private, -# enter an access token (account → Settings → Applications → token with -# repo scope) in the Obtainium source settings. +# Obtainium: Add App → Gitea → paste the repo URL, APK filter +# `mindlist-.*\.apk`. If the repo is private, enter an access token +# (account → Settings → Applications → token with `repo` scope) in the +# Obtainium source settings. Keep "include prereleases" off: this pipeline +# only ships stable releases (prerelease:false). name: Release APK on: push: + # Semver tags only — vtest/vwip must never cut a public release. tags: - - 'v*' + - 'v[0-9]*.[0-9]*.[0-9]*' + workflow_dispatch: + inputs: + dry_run: + description: 'Build + sign only, do not create a release' + type: boolean + default: true + +concurrency: + group: release-${{ github.ref }} + cancel-in-progress: false jobs: release: runs-on: ubuntu-latest + timeout-minutes: 30 permissions: contents: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + with: + fetch-depth: 0 # needed for changelog + previous-tag versionCode check + + - name: Validate tag + if: github.event_name == 'push' + run: | + TAG="${GITHUB_REF_NAME}" + [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "::error::Tag $TAG is not semver vX.Y.Z"; exit 1; } - name: Setup Node - uses: actions/setup-node@v4 + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 with: node-version: 22 cache: npm - name: Setup JDK 21 - uses: actions/setup-java@v4 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5 with: distribution: temurin java-version: 21 @@ -45,7 +68,8 @@ jobs: run: | SDK="$HOME/android-sdk" mkdir -p "$SDK/cmdline-tools" - curl -sS -o /tmp/cmdtools.zip https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip + curl -fsSL --retry 3 -o /tmp/cmdtools.zip https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip + echo "2d2d50857e4eb553af5a6dc3ad507a17adf43d115264b1afc116f95c92e5e258 /tmp/cmdtools.zip" | sha256sum -c - unzip -q /tmp/cmdtools.zip -d "$SDK/cmdline-tools" mv "$SDK/cmdline-tools/cmdline-tools" "$SDK/cmdline-tools/latest" export PATH="$SDK/cmdline-tools/latest/bin:$PATH" @@ -61,6 +85,9 @@ jobs: echo "$SDK/cmdline-tools/latest/bin" >> "$GITHUB_PATH" echo "$SDK/platform-tools" >> "$GITHUB_PATH" + - name: Validate Gradle wrapper + uses: gradle/actions/wrapper-validation@4c125117fe7c5aed11272ec4213f602f012f89f2 # v4 + - name: Install dependencies run: npm ci @@ -74,8 +101,9 @@ jobs: - name: Restore release keystore # The keystore lives in git AES-encrypted (android/release-keystore.enc); - # only this short passphrase travels as a secret, so there is no - # multi-KB paste to corrupt. Decryption is verified by hash + keytool. + # only the short passphrase travels as a secret, so there is no + # multi-KB paste to corrupt. Secrets via env: (never -pass pass:) + # so they don't appear in the process table. env: ENC_PASS: ${{ secrets.KEYSTORE_PASSPHRASE }} STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }} @@ -84,7 +112,7 @@ jobs: run: | test -n "$ENC_PASS" || { echo "::error::Missing KEYSTORE_PASSPHRASE secret"; exit 1; } openssl enc -d -aes-256-cbc -pbkdf2 -in android/release-keystore.enc \ - -out android/mindlist-release.keystore -pass pass:"$ENC_PASS" + -out android/mindlist-release.keystore -pass env:ENC_PASS printf 'storeFile=../mindlist-release.keystore\nstorePassword=%s\nkeyAlias=%s\nkeyPassword=%s\n' \ "$STORE_PASSWORD" "$KEY_ALIAS" "$KEY_PASSWORD" > android/keystore.properties echo "sdk.dir=$ANDROID_HOME" > android/local.properties @@ -92,34 +120,90 @@ jobs: # (safe to publish: file is password-encrypted) and open with the # given alias/password. Fails fast with a clear message otherwise. echo "632509e5f1bdda0633736e8bcdc0bc0ce405ebd02fd7187738029240b860b9b6 android/mindlist-release.keystore" | sha256sum -c - - keytool -list -keystore android/mindlist-release.keystore -storepass "$STORE_PASSWORD" -alias "$KEY_ALIAS" | head -2 + keytool -list -keystore android/mindlist-release.keystore -storepass:env STORE_PASSWORD -alias "$KEY_ALIAS" | head -2 + + - name: Check versionCode bump + # Android/Obtainium refuse to install over an equal-or-lower versionCode, + # so a tag without a bump would strand users on the old build. + run: | + CUR=$(grep -oP 'versionCode \K[0-9]+' android/app/build.gradle | head -1) + PREV_TAG=$(git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -2 | tail -1) + if [ -n "$PREV_TAG" ]; then + PREV=$(git show "$PREV_TAG:android/app/build.gradle" | grep -oP 'versionCode \K[0-9]+' | head -1) + echo "versionCode: $PREV ($PREV_TAG) -> $CUR (${GITHUB_REF_NAME})" + [ "$CUR" -gt "$PREV" ] || { echo "::error::Bump versionCode in android/app/build.gradle above $PREV before tagging"; exit 1; } + else + echo "No previous release tag; versionCode=$CUR accepted" + fi - name: Assemble signed release working-directory: android - env: - JAVA_HOME: ${{ env.JAVA_HOME }} run: ./gradlew assembleRelease - - name: Verify signature - run: $ANDROID_HOME/build-tools/36.0.0/apksigner verify app/build/outputs/apk/release/app-release.apk + - name: Verify signature + fingerprint + # The fingerprint pins OUR key: a rotated/wrong secret would sign fine + # but break Obtainium updates (signature mismatch on install). + run: | + $ANDROID_HOME/build-tools/36.0.0/apksigner verify --print-certs app/build/outputs/apk/release/app-release.apk | tee /tmp/certs.txt + grep -q '60:C5:2C:FE:CA:C0:A5:2A:9D:B9:24:1A:25:A1:40:EA:79:F6:C3:FE:04:F8:18:DA:E9:16:93:76:8E:D0:DE:BA' /tmp/certs.txt \ + || { echo "::error::APK not signed with the Mindlist release key"; exit 1; } working-directory: android - name: Stage artifact - run: cp android/app/build/outputs/apk/release/app-release.apk "mindlist-${GITHUB_REF_NAME}.apk" + run: | + cp android/app/build/outputs/apk/release/app-release.apk "mindlist-${GITHUB_REF_NAME}.apk" + sha256sum "mindlist-${GITHUB_REF_NAME}.apk" | cut -d' ' -f1 > "mindlist-${GITHUB_REF_NAME}.apk.sha256" - name: Create Gitea release + upload APK + if: github.event_name == 'push' env: TOKEN: ${{ secrets.GITHUB_TOKEN }} TAG: ${{ github.ref_name }} SERVER: ${{ github.server_url }} REPO: ${{ github.repository }} run: | - REL=$(curl -sS -H "Authorization: token $TOKEN" -H 'Content-Type: application/json' \ - -d "{\"tag_name\":\"$TAG\",\"name\":\"Mindlist $TAG\",\"draft\":false,\"prerelease\":false}" \ - "$SERVER/api/v1/repos/$REPO/releases") - echo "$REL" | head -c 300; echo - RID=$(echo "$REL" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])') - curl -sS -H "Authorization: token $TOKEN" -H 'Content-Type: application/vnd.android.package-archive' \ - --data-binary "@mindlist-$TAG.apk" \ - "$SERVER/api/v1/repos/$REPO/releases/$RID/assets?name=mindlist-$TAG.apk" - echo; echo "Uploaded mindlist-$TAG.apk to release $RID" + NOTES=$(git log --format='- %s' "$(git describe --tags --abbrev=0 HEAD~1 2>/dev/null || echo '')..HEAD" 2>/dev/null | head -30) + python3 - "$SERVER" "$TOKEN" "$REPO" "$TAG" "$NOTES" <<'EOF' + import json, sys, urllib.request, urllib.error + server, token, repo, tag, notes = sys.argv[1:6] + def api(path, data=None, raw=None, ctype='application/json'): + req = urllib.request.Request(server + path, data=data, + headers={'Authorization': 'token ' + token, 'Content-Type': ctype}) + try: + with urllib.request.urlopen(req) as r: + return r.status, r.read() + except urllib.error.HTTPError as e: + return e.code, e.read() + # Idempotent: reuse the release if the tag already has one (re-runs). + status, body = api(f'/api/v1/repos/{repo}/releases/tags/{tag}') + if status == 200: + rid = json.loads(body)['id'] + print(f'Reusing existing release {rid} for {tag}') + else: + status, body = api(f'/api/v1/repos/{repo}/releases', + json.dumps({'tag_name': tag, 'name': f'Mindlist {tag}', + 'body': notes, 'draft': False, 'prerelease': False}).encode()) + assert status == 201, f'create release failed: {status} {body[:300]}' + rid = json.loads(body)['id'] + print(f'Created release {rid} for {tag}') + for asset in (f'mindlist-{tag}.apk', f'mindlist-{tag}.apk.sha256'): + with open(asset, 'rb') as f: + blob = f.read() + # Replace same-name asset from an earlier run instead of duplicating. + status, body = api(f'/api/v1/repos/{repo}/releases/{rid}/assets') + for a in json.loads(body): + if a['name'] == asset: + req = urllib.request.Request( + f'{server}/api/v1/repos/{repo}/releases/{rid}/assets/{a["id"]}', + headers={'Authorization': 'token ' + token}, method='DELETE') + with urllib.request.urlopen(req) as r: + print(f'Deleted old asset {asset}: {r.status}') + status, body = api(f'/api/v1/repos/{repo}/releases/{rid}/assets?name={asset}', + blob, ctype='application/vnd.android.package-archive') + assert status == 201, f'upload {asset} failed: {status} {body[:300]}' + print(f'Uploaded {asset} ({len(blob)} bytes)') + EOF + + - name: Scrub key material + if: always() + run: rm -f android/keystore.properties android/mindlist-release.keystore