fix(release): port store publishing to Forgejo Actions (canonical remote is Forgejo)
git.comunes.org runs Forgejo Actions, not GitLab CI, so the tag-triggered signed-AAB build + fastlane Play upload now lives in .forgejo/workflows/release.yml (single job, no cross-job artifact passing). Removed the equivalent GitLab jobs; .gitlab-ci.yml keeps only the analyze/test gate. Play service account is reused from Ğ1nkgo. docs/release.md updated (Forgejo secrets).
This commit is contained in:
parent
eef99975bf
commit
17d0ff1221
3 changed files with 92 additions and 69 deletions
78
.forgejo/workflows/release.yml
Normal file
78
.forgejo/workflows/release.yml
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
# Release automation for git.comunes.org (Forgejo Actions).
|
||||
#
|
||||
# Password-free: pushing a tag `v*` builds a signed AAB/APK and uploads it to
|
||||
# Google Play's internal track via fastlane. All credentials come from repo
|
||||
# secrets (Settings > Actions > Secrets), never typed:
|
||||
# TANE_KEYSTORE_BASE64 base64 of the dedicated tane-upload.jks
|
||||
# TANE_KEYSTORE_PASSWORD store password
|
||||
# TANE_KEY_ALIAS tane-upload
|
||||
# TANE_KEY_PASSWORD key password
|
||||
# SUPPLY_JSON_KEY_DATA Google Play service-account JSON (reused from Ğ1nkgo)
|
||||
#
|
||||
# Build + deploy live in ONE job so the AAB never has to cross a job boundary.
|
||||
# NOTE: `runs-on` must match a label your Forgejo runner registered with; adjust
|
||||
# if the Comunes runner uses something other than `docker`.
|
||||
|
||||
name: release
|
||||
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- 'v*'
|
||||
|
||||
jobs:
|
||||
android:
|
||||
runs-on: docker
|
||||
container:
|
||||
image: ghcr.io/cirruslabs/flutter:3.41.9
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Generate code (i18n + Drift)
|
||||
working-directory: apps/app_seeds
|
||||
run: |
|
||||
flutter pub get
|
||||
dart run slang
|
||||
dart run build_runner build --delete-conflicting-outputs
|
||||
|
||||
- name: Materialize signing material from secrets
|
||||
working-directory: apps/app_seeds
|
||||
env:
|
||||
TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
|
||||
TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
|
||||
TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
|
||||
TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
|
||||
run: |
|
||||
echo "$TANE_KEYSTORE_BASE64" | base64 -d > "$GITHUB_WORKSPACE/tane-upload.jks"
|
||||
cat > android/key.properties <<EOF
|
||||
storeFile=$GITHUB_WORKSPACE/tane-upload.jks
|
||||
storePassword=$TANE_KEYSTORE_PASSWORD
|
||||
keyAlias=$TANE_KEY_ALIAS
|
||||
keyPassword=$TANE_KEY_PASSWORD
|
||||
EOF
|
||||
|
||||
- name: Build signed AAB + APK
|
||||
working-directory: apps/app_seeds
|
||||
run: |
|
||||
flutter build appbundle --release
|
||||
flutter build apk --release
|
||||
|
||||
- name: Install fastlane
|
||||
working-directory: apps/app_seeds
|
||||
run: |
|
||||
apt-get update -qq
|
||||
apt-get install -y -qq ruby ruby-dev build-essential
|
||||
gem install bundler --no-document
|
||||
bundle install
|
||||
|
||||
- name: Publish to Google Play (internal track)
|
||||
working-directory: apps/app_seeds
|
||||
env:
|
||||
SUPPLY_JSON_KEY_DATA: ${{ secrets.SUPPLY_JSON_KEY_DATA }}
|
||||
run: bundle exec fastlane deploy_play
|
||||
|
||||
- name: Scrub signing material
|
||||
if: always()
|
||||
working-directory: apps/app_seeds
|
||||
run: rm -f android/key.properties "$GITHUB_WORKSPACE/tane-upload.jks"
|
||||
|
|
@ -10,7 +10,6 @@ stages:
|
|||
- analyze
|
||||
- test
|
||||
- build
|
||||
- deploy
|
||||
|
||||
variables:
|
||||
PUB_CACHE: "$CI_PROJECT_DIR/.pub-cache"
|
||||
|
|
@ -84,62 +83,6 @@ test:app_seeds:
|
|||
coverage_format: cobertura
|
||||
path: apps/app_seeds/coverage/cobertura.xml
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Release automation. Runs ONLY on tags, so it never touches the per-push gate.
|
||||
# Password-free: signing + Play credentials come from masked+protected CI vars.
|
||||
# Required CI variables (Settings > CI/CD > Variables), set once:
|
||||
# TANE_KEYSTORE_BASE64 base64 of the dedicated Tane upload keystore (.jks)
|
||||
# TANE_KEYSTORE_PASSWORD store password
|
||||
# TANE_KEY_ALIAS key alias (tane-upload)
|
||||
# TANE_KEY_PASSWORD key password
|
||||
# SUPPLY_JSON_KEY_DATA Google Play service-account JSON (raw file contents)
|
||||
# Tag a commit (e.g. `git tag v0.1.0 && git push --tags`) to build + publish.
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
# Build the signed release artifacts (AAB for Play, APK for sideload/QA).
|
||||
build:android:
|
||||
stage: build
|
||||
rules:
|
||||
- if: '$CI_COMMIT_TAG'
|
||||
script:
|
||||
- cd apps/app_seeds
|
||||
- dart run slang
|
||||
- dart run build_runner build --delete-conflicting-outputs
|
||||
# Materialize the signing material from CI secrets (never in the repo).
|
||||
- echo "$TANE_KEYSTORE_BASE64" | base64 -d > "$CI_PROJECT_DIR/tane-upload.jks"
|
||||
- |
|
||||
cat > android/key.properties <<EOF
|
||||
storeFile=$CI_PROJECT_DIR/tane-upload.jks
|
||||
storePassword=$TANE_KEYSTORE_PASSWORD
|
||||
keyAlias=$TANE_KEY_ALIAS
|
||||
keyPassword=$TANE_KEY_PASSWORD
|
||||
EOF
|
||||
- flutter build appbundle --release
|
||||
- flutter build apk --release
|
||||
# Don't leave signing material in the workspace/cache.
|
||||
- rm -f android/key.properties "$CI_PROJECT_DIR/tane-upload.jks"
|
||||
artifacts:
|
||||
paths:
|
||||
- apps/app_seeds/build/app/outputs/bundle/release/app-release.aab
|
||||
- apps/app_seeds/build/app/outputs/flutter-apk/app-release.apk
|
||||
expire_in: 90 days
|
||||
|
||||
# Upload the AAB + store listing to Google Play (internal track) via fastlane.
|
||||
# Needs a Ruby image, not the Flutter one, so it overrides the global setup.
|
||||
deploy:play:
|
||||
stage: deploy
|
||||
image: ruby:3.2
|
||||
needs:
|
||||
- job: build:android
|
||||
artifacts: true
|
||||
rules:
|
||||
- if: '$CI_COMMIT_TAG'
|
||||
before_script:
|
||||
- cd apps/app_seeds
|
||||
- bundle install --path vendor/bundle
|
||||
script:
|
||||
- bundle exec fastlane deploy_play
|
||||
cache:
|
||||
key: "fastlane-gems"
|
||||
paths:
|
||||
- apps/app_seeds/vendor/bundle/
|
||||
# Release automation (signed AAB + Play upload on tag) lives in Forgejo Actions,
|
||||
# since the canonical remote (git.comunes.org) is Forgejo, not GitLab:
|
||||
# .forgejo/workflows/release.yml
|
||||
|
|
|
|||
|
|
@ -14,8 +14,8 @@ Once the one-time setup below is done:
|
|||
git tag v0.1.0 && git push origin v0.1.0
|
||||
```
|
||||
|
||||
CI (`build:android` → `deploy:play` in [`../.gitlab-ci.yml`](../.gitlab-ci.yml)) builds
|
||||
the signed AAB/APK and uploads to Play's **internal** track. No passwords are typed.
|
||||
Forgejo Actions ([`../.forgejo/workflows/release.yml`](../.forgejo/workflows/release.yml))
|
||||
builds the signed AAB/APK and uploads to Play's **internal** track. No passwords are typed.
|
||||
|
||||
## Versioning
|
||||
|
||||
|
|
@ -55,11 +55,11 @@ With **Play App Signing** (recommended, enabled once in the console) this is the
|
|||
*upload key*; Google holds the app signing key and can help rotate the upload key
|
||||
if it is ever lost.
|
||||
|
||||
### CI secrets (one-time, GitLab → Settings → CI/CD → Variables)
|
||||
### CI secrets (one-time, Forgejo → repo Settings → Actions → Secrets)
|
||||
|
||||
Set these as **masked + protected** so releases never prompt for a password:
|
||||
Set these so releases never prompt for a password:
|
||||
|
||||
| Variable | What |
|
||||
| Secret | What |
|
||||
|---|---|
|
||||
| `TANE_KEYSTORE_BASE64` | `base64 -w0 tane-upload.jks` |
|
||||
| `TANE_KEYSTORE_PASSWORD` | store password |
|
||||
|
|
@ -67,10 +67,12 @@ Set these as **masked + protected** so releases never prompt for a password:
|
|||
| `TANE_KEY_PASSWORD` | key password |
|
||||
| `SUPPLY_JSON_KEY_DATA` | Google Play service-account JSON (raw file contents) |
|
||||
|
||||
The Play service account is created in Google Cloud and granted release access in
|
||||
Play Console; it is what lets `fastlane supply` upload without a human. The first
|
||||
upload of a brand-new app must still be done by hand in the console (Play requires
|
||||
the app to exist before the API accepts uploads).
|
||||
The Play service account is **reused from Ğ1nkgo** (`ginkgo-play-uploader@…`,
|
||||
`/home/vjrj/etc/ginkgo_play_api_key.json`) — it belongs to the Comunes Play account,
|
||||
not to one app, so it just needs access granted to `org.comunes.tane` in Play Console.
|
||||
`fastlane supply` uses it to upload without a human. The first upload of the brand-new
|
||||
app must still be done by hand in the console (Play requires the app to exist before
|
||||
the API accepts uploads).
|
||||
|
||||
## Build by hand (fallback / first Play upload)
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue