122 lines
5.1 KiB
YAML
122 lines
5.1 KiB
YAML
# Builds a signed release APK on every version tag and attaches it to the
|
|
# Gitea release, so Obtainium can track updates. See issue #3.
|
|
#
|
|
# Required repository secrets (Settings → Secrets → Actions):
|
|
# RELEASE_KEYSTORE_BASE64 — base64 of android/mindlist-release.keystore
|
|
# RELEASE_STORE_PASSWORD — keystore password
|
|
# RELEASE_KEY_ALIAS — key alias (mindlist)
|
|
# RELEASE_KEY_PASSWORD — key password
|
|
#
|
|
# Obtainium: Add App → Gitea → paste the repo URL. If the repo is private,
|
|
# enter an access token (account → Settings → Applications → token with
|
|
# repo scope) in the Obtainium source settings.
|
|
|
|
name: Release APK
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
|
|
- name: Setup JDK 21
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
distribution: temurin
|
|
java-version: 21
|
|
|
|
- name: Setup Android SDK
|
|
# Manual install: android-actions/setup-android pulls the removed
|
|
# legacy "tools" package and fails on current SDK repositories.
|
|
run: |
|
|
SDK="$HOME/android-sdk"
|
|
mkdir -p "$SDK/cmdline-tools"
|
|
curl -sS -o /tmp/cmdtools.zip https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip
|
|
unzip -q /tmp/cmdtools.zip -d "$SDK/cmdline-tools"
|
|
mv "$SDK/cmdline-tools/cmdline-tools" "$SDK/cmdline-tools/latest"
|
|
export PATH="$SDK/cmdline-tools/latest/bin:$PATH"
|
|
# NB: `yes` dies with SIGPIPE (141) once sdkmanager quits — not a
|
|
# failure under `pipefail`, so neutralize only that code. A real
|
|
# license/install problem still fails loudly below.
|
|
set +o pipefail
|
|
yes | sdkmanager --licenses > /dev/null || true
|
|
set -o pipefail
|
|
sdkmanager "platform-tools" "platforms;android-36" "build-tools;36.0.0"
|
|
echo "ANDROID_HOME=$SDK" >> "$GITHUB_ENV"
|
|
echo "ANDROID_SDK_ROOT=$SDK" >> "$GITHUB_ENV"
|
|
echo "$SDK/cmdline-tools/latest/bin" >> "$GITHUB_PATH"
|
|
echo "$SDK/platform-tools" >> "$GITHUB_PATH"
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Test
|
|
run: npm test
|
|
|
|
- name: Build PWA + sync
|
|
run: |
|
|
npm run build
|
|
npx cap sync android
|
|
|
|
- name: Restore release keystore
|
|
env:
|
|
KEYSTORE_BASE64: ${{ secrets.RELEASE_KEYSTORE_BASE64 }}
|
|
STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }}
|
|
KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
|
|
KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
|
|
run: |
|
|
test -n "$KEYSTORE_BASE64" || { echo "::error::Missing RELEASE_KEYSTORE_BASE64 secret"; exit 1; }
|
|
echo "$KEYSTORE_BASE64" | base64 -d > android/mindlist-release.keystore
|
|
printf 'storeFile=../mindlist-release.keystore\nstorePassword=%s\nkeyAlias=%s\nkeyPassword=%s\n' \
|
|
"$STORE_PASSWORD" "$KEY_ALIAS" "$KEY_PASSWORD" > android/keystore.properties
|
|
echo "sdk.dir=$ANDROID_HOME" > android/local.properties
|
|
# Self-check: the decoded keystore must match the committed hash
|
|
# (safe to publish: file is password-encrypted) and open with the
|
|
# given alias/password. Fails fast with a clear message otherwise.
|
|
echo "632509e5f1bdda0633736e8bcdc0bc0ce405ebd02fd7187738029240b860b9b6 android/mindlist-release.keystore" | sha256sum -c -
|
|
keytool -list -keystore android/mindlist-release.keystore -storepass "$STORE_PASSWORD" -alias "$KEY_ALIAS" | head -2
|
|
|
|
- name: Assemble signed release
|
|
working-directory: android
|
|
env:
|
|
JAVA_HOME: ${{ env.JAVA_HOME }}
|
|
run: ./gradlew assembleRelease
|
|
|
|
- name: Verify signature
|
|
run: $ANDROID_HOME/build-tools/36.0.0/apksigner verify app/build/outputs/apk/release/app-release.apk
|
|
working-directory: android
|
|
|
|
- name: Stage artifact
|
|
run: cp android/app/build/outputs/apk/release/app-release.apk "mindlist-${GITHUB_REF_NAME}.apk"
|
|
|
|
- name: Create Gitea release + upload APK
|
|
env:
|
|
TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
TAG: ${{ github.ref_name }}
|
|
SERVER: ${{ github.server_url }}
|
|
REPO: ${{ github.repository }}
|
|
run: |
|
|
REL=$(curl -sS -H "Authorization: token $TOKEN" -H 'Content-Type: application/json' \
|
|
-d "{\"tag_name\":\"$TAG\",\"name\":\"Mindlist $TAG\",\"draft\":false,\"prerelease\":false}" \
|
|
"$SERVER/api/v1/repos/$REPO/releases")
|
|
echo "$REL" | head -c 300; echo
|
|
RID=$(echo "$REL" | python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
|
|
curl -sS -H "Authorization: token $TOKEN" -H 'Content-Type: application/vnd.android.package-archive' \
|
|
--data-binary "@mindlist-$TAG.apk" \
|
|
"$SERVER/api/v1/repos/$REPO/releases/$RID/assets?name=mindlist-$TAG.apk"
|
|
echo; echo "Uploaded mindlist-$TAG.apk to release $RID"
|