comunes/tane
1
0
Fork 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions

fix(release): port store publishing to Forgejo Actions (canonical remote is Forgejo)

Browse source 
git.comunes.org runs Forgejo Actions, not GitLab CI, so the tag-triggered
signed-AAB build + fastlane Play upload now lives in .forgejo/workflows/release.yml
(single job, no cross-job artifact passing). Removed the equivalent GitLab jobs;
.gitlab-ci.yml keeps only the analyze/test gate. Play service account is reused
from Ğ1nkgo. docs/release.md updated (Forgejo secrets).
This commit is contained in:
vjrj 2026-07-16 03:05:33 +02:00
parent eef99975bf
commit 17d0ff1221
3 changed files with 92 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

20
docs/release.md
View file

@ -14,8 +14,8 @@ Once the one-time setup below is done:
git tag v0.1.0 && git push origin v0.1.0
```
CI (`build:android` → `deploy:play` in [`../.gitlab-ci.yml`](../.gitlab-ci.yml)) builds
the signed AAB/APK and uploads to Play's **internal** track. No passwords are typed.
Forgejo Actions ([`../.forgejo/workflows/release.yml`](../.forgejo/workflows/release.yml))
builds the signed AAB/APK and uploads to Play's **internal** track. No passwords are typed.
## Versioning
@ -55,11 +55,11 @@ With **Play App Signing** (recommended, enabled once in the console) this is the
*upload key*; Google holds the app signing key and can help rotate the upload key
if it is ever lost.
### CI secrets (one-time, GitLab → Settings → CI/CD → Variables)
### CI secrets (one-time, Forgejo → repo Settings → Actions → Secrets)
Set these as **masked + protected** so releases never prompt for a password:
Set these so releases never prompt for a password:
| Variable | What |
| Secret | What |
|---|---|
| `TANE_KEYSTORE_BASE64` | `base64 -w0 tane-upload.jks` |
| `TANE_KEYSTORE_PASSWORD` | store password |
@ -67,10 +67,12 @@ Set these as **masked + protected** so releases never prompt for a password:
| `TANE_KEY_PASSWORD` | key password |
| `SUPPLY_JSON_KEY_DATA` | Google Play service-account JSON (raw file contents) |
The Play service account is created in Google Cloud and granted release access in
Play Console; it is what lets `fastlane supply` upload without a human. The first
upload of a brand-new app must still be done by hand in the console (Play requires
the app to exist before the API accepts uploads).
The Play service account is **reused from Ğ1nkgo** (`ginkgo-play-uploader@…`,
`/home/vjrj/etc/ginkgo_play_api_key.json`) — it belongs to the Comunes Play account,
not to one app, so it just needs access granted to `org.comunes.tane` in Play Console.
`fastlane supply` uses it to upload without a human. The first upload of the brand-new
app must still be done by hand in the console (Play requires the app to exist before
the API accepts uploads).
## Build by hand (fallback / first Play upload)