221 lines
10 KiB
YAML
221 lines
10 KiB
YAML
# Release automation for git.comunes.org (Forgejo Actions).
|
|
#
|
|
# Pushing a tag `v*` runs two independent jobs:
|
|
# play - build the signed AAB and ship it to Google Play (internal).
|
|
# fdroid_reference- build the per-ABI reference APKs the SAME way F-Droid will
|
|
# (fdroid build inside the fdroidserver buildserver image),
|
|
# sign them with the tane-upload key, and attach them to the
|
|
# Forgejo release. F-Droid re-runs `fdroid build` on the same
|
|
# commit+recipe+image, gets byte-identical output, verifies our
|
|
# signature (AllowedAPKSigningKeys) and publishes OUR APK — so
|
|
# F-Droid and Play share the same signing key.
|
|
#
|
|
# All credentials come from repo secrets (Settings > Actions > Secrets):
|
|
# TANE_KEYSTORE_BASE64 base64 of the dedicated tane-upload.jks
|
|
# TANE_KEYSTORE_PASSWORD store password
|
|
# TANE_KEY_ALIAS tane-upload
|
|
# TANE_KEY_PASSWORD key password
|
|
# SUPPLY_JSON_KEY_DATA Google Play service-account JSON
|
|
#
|
|
# NOTE: `runs-on` must match a label your Forgejo runner registered with.
|
|
# The fdroid_reference job pulls a large image (~2 GB) and builds tesseract from
|
|
# source, so it is slow (~20-40 min); the play job is independent and unaffected.
|
|
|
|
name: release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
# Manual trigger to test the fdroid_reference job on a branch without cutting a
|
|
# tag or deploying to Play (the play job below is guarded to tags only).
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
play:
|
|
if: ${{ startsWith(github.ref, 'refs/tags/') }}
|
|
runs-on: docker
|
|
container:
|
|
image: ghcr.io/cirruslabs/flutter:3.41.9
|
|
steps:
|
|
# Manual git checkout (no Node): the flutter image has no node, so JS
|
|
# actions like actions/checkout@v4 fail with "exec: node: not found".
|
|
- name: Checkout
|
|
env:
|
|
TOKEN: ${{ github.token }}
|
|
run: |
|
|
git config --global --add safe.directory '*'
|
|
git init -q .
|
|
git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
|
|
git fetch -q --depth 1 origin "${GITHUB_SHA}"
|
|
git checkout -q FETCH_HEAD
|
|
|
|
- name: Generate code (i18n + Drift)
|
|
working-directory: apps/app_seeds
|
|
run: |
|
|
flutter pub get
|
|
dart run slang
|
|
dart run build_runner build --delete-conflicting-outputs
|
|
|
|
- name: Materialize signing material from secrets
|
|
working-directory: apps/app_seeds
|
|
env:
|
|
TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
|
|
TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
|
|
TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
|
|
TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
|
|
run: |
|
|
echo "$TANE_KEYSTORE_BASE64" | base64 -d > "$GITHUB_WORKSPACE/tane-upload.jks"
|
|
cat > android/key.properties <<EOF
|
|
storeFile=$GITHUB_WORKSPACE/tane-upload.jks
|
|
storePassword=$TANE_KEYSTORE_PASSWORD
|
|
keyAlias=$TANE_KEY_ALIAS
|
|
keyPassword=$TANE_KEY_PASSWORD
|
|
EOF
|
|
|
|
- name: Build signed AAB
|
|
working-directory: apps/app_seeds
|
|
run: flutter build appbundle --release
|
|
|
|
- name: Install fastlane
|
|
working-directory: apps/app_seeds
|
|
run: |
|
|
apt-get update -qq
|
|
apt-get install -y -qq ruby ruby-dev build-essential
|
|
gem install bundler --no-document
|
|
bundle install
|
|
|
|
- name: Publish to Google Play (internal track)
|
|
working-directory: apps/app_seeds
|
|
env:
|
|
SUPPLY_JSON_KEY_DATA: ${{ secrets.SUPPLY_JSON_KEY_DATA }}
|
|
run: bundle exec fastlane deploy_play
|
|
|
|
- name: Scrub signing material
|
|
if: always()
|
|
working-directory: apps/app_seeds
|
|
run: rm -f android/key.properties "$GITHUB_WORKSPACE/tane-upload.jks"
|
|
|
|
fdroid_reference:
|
|
runs-on: docker
|
|
container:
|
|
image: registry.gitlab.com/fdroid/fdroidserver:buildserver-trixie
|
|
steps:
|
|
- name: Build reference APKs with fdroid, sign, and attach to the release
|
|
env:
|
|
TOKEN: ${{ github.token }}
|
|
TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
|
|
TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
|
|
TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
|
|
TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
|
|
run: |
|
|
set -eu
|
|
|
|
# 1) Reproduce F-Droid's build environment (ANDROID_HOME, PATH, NDK...).
|
|
sh /opt/buildserver/setup-env-vars /opt/android-sdk
|
|
. /etc/profile.d/bsenv.sh
|
|
|
|
# 2) fdroidserver from master, exactly like the fdroiddata CI.
|
|
fds=/opt/fdroidserver-src
|
|
mkdir -p "$fds"
|
|
curl -sL https://gitlab.com/fdroid/fdroidserver/-/archive/master/fdroidserver-master.tar.gz \
|
|
| tar -xz -C "$fds" --strip-components=1
|
|
export PATH="$fds:$PATH"
|
|
export PYTHONPATH="$fds:$fds/examples"
|
|
git config --global --add safe.directory '*'
|
|
# The job container reaches github.com but not the host's public git.comunes.org
|
|
# (NAT hairpin); redirect the app clone to the internal Forgejo host so
|
|
# `fdroid build` can fetch the source (and SOURCE_DATE_EPOCH from its commit).
|
|
git config --global url."http://x-access-token:${TOKEN}@forgejo:3000/".insteadOf "https://git.comunes.org/"
|
|
|
|
# 3) Fetch our in-repo recipe (the single source of truth) at this commit,
|
|
# plus the pubspec versionCode base for the per-ABI codes.
|
|
work=/tmp/tane-src
|
|
mkdir -p "$work" && cd "$work"
|
|
git init -q .
|
|
git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
|
|
git fetch -q --depth 1 origin "${GITHUB_SHA}"
|
|
git checkout -q FETCH_HEAD
|
|
base=$(sed -n -E 's/^version:.*\+([0-9]+)$/\1/p' apps/app_seeds/pubspec.yaml)
|
|
[ -n "$base" ]
|
|
|
|
# 4) Assemble a minimal fdroiddata (config.yml + srclibs + our recipe) from the
|
|
# in-repo files. No external host needed — the job container reaches
|
|
# git.comunes.org (via forgejo:3000) but not gitlab.com.
|
|
fdd=/tmp/fdroiddata
|
|
mkdir -p "$fdd/metadata" "$fdd/srclibs"
|
|
cp "$work/fdroid-ci/config.yml" "$fdd/config.yml"
|
|
cp "$work"/fdroid-ci/srclibs/*.yml "$fdd/srclibs/"
|
|
cp "$work/docs/fdroid/org.comunes.tane.yml" "$fdd/metadata/org.comunes.tane.yml"
|
|
cd "$fdd"
|
|
# Build THIS commit; drop binary: (we PRODUCE the reference here, not verify it).
|
|
sed -i "s#^\( *commit: \).*#\1${GITHUB_SHA}#" metadata/org.comunes.tane.yml
|
|
sed -i '/^ *binary: /d' metadata/org.comunes.tane.yml
|
|
|
|
# Pre-clone the app into fdroid's build dir: fdroidserver computes
|
|
# SOURCE_DATE_EPOCH from this checkout BEFORE it clones anything — on a
|
|
# fresh dir it falls back to `git log` of the fdroiddata tree, which our
|
|
# assembled skeleton doesn't have, and crashes on None. With the clone in
|
|
# place the primary path pins SOURCE_DATE_EPOCH to the app commit
|
|
# timestamp (deterministic; the public URL is redirected to forgejo:3000
|
|
# by the insteadOf rule above).
|
|
mkdir -p build
|
|
git clone -q https://git.comunes.org/comunes/tane.git build/org.comunes.tane
|
|
git -C build/org.comunes.tane checkout -q "${GITHUB_SHA}"
|
|
|
|
# 5) Build the three per-ABI splits with F-Droid's own toolchain.
|
|
fdroid build --verbose --no-tarball \
|
|
"org.comunes.tane:$((base * 10 + 1))" \
|
|
"org.comunes.tane:$((base * 10 + 2))" \
|
|
"org.comunes.tane:$((base * 10 + 3))"
|
|
|
|
# `fdroid build` exits 0 even when builds fail — demand the 3 APKs.
|
|
apk_count=$(ls unsigned/org.comunes.tane_*.apk 2>/dev/null | wc -l)
|
|
if [ "$apk_count" -ne 3 ]; then
|
|
echo "expected 3 unsigned APKs, got $apk_count" >&2
|
|
tail -n 80 logs/*.log 2>/dev/null || true
|
|
exit 1
|
|
fi
|
|
|
|
# 6) Sign each unsigned APK with tane-upload and attach to the Forgejo release.
|
|
apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
|
|
if [ -z "$apksigner" ]; then
|
|
yes | sdkmanager "build-tools;34.0.0" >/dev/null 2>&1 || true
|
|
apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
|
|
fi
|
|
echo "$TANE_KEYSTORE_BASE64" | base64 -d > /tmp/ks.jks
|
|
api="http://forgejo:3000/api/v1/repos/${GITHUB_REPOSITORY}"
|
|
tag="${GITHUB_REF_NAME}"
|
|
is_tag=false; [ "${GITHUB_REF_TYPE:-}" = tag ] && is_tag=true
|
|
rid=""
|
|
if $is_tag; then
|
|
curl -sf -X POST "$api/releases" \
|
|
-H "Authorization: token ${TOKEN}" -H 'Content-Type: application/json' \
|
|
-d "{\"tag_name\":\"${tag}\",\"name\":\"${tag}\"}" >/dev/null || true
|
|
rid=$(curl -sf -H "Authorization: token ${TOKEN}" "$api/releases/tags/${tag}" \
|
|
| python3 -c 'import sys,json;print(json.load(sys.stdin)["id"])')
|
|
fi
|
|
for f in unsigned/org.comunes.tane_*.apk; do
|
|
vc=$(echo "$f" | sed -E 's/.*_([0-9]+)\.apk/\1/')
|
|
case $((vc % 10)) in
|
|
1) abi=armeabi-v7a ;;
|
|
2) abi=arm64-v8a ;;
|
|
3) abi=x86_64 ;;
|
|
*) echo "unexpected versionCode $vc"; exit 1 ;;
|
|
esac
|
|
out="/tmp/app-${abi}-release.apk"
|
|
"$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
|
|
--ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
|
|
--out "$out" "$f"
|
|
# Prove the signer cert matches AllowedAPKSigningKeys.
|
|
"$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
|
|
if $is_tag; then
|
|
curl -sf -X POST "$api/releases/${rid}/assets?name=app-${abi}-release.apk" \
|
|
-H "Authorization: token ${TOKEN}" \
|
|
-F "attachment=@${out};type=application/vnd.android.package-archive"
|
|
echo "uploaded app-${abi}-release.apk (from ${f##*/})"
|
|
else
|
|
echo "built+signed app-${abi}-release.apk (dispatch: upload skipped)"
|
|
fi
|
|
done
|
|
rm -f /tmp/ks.jks
|