vjrj
50edb5ff75
Some checks failed
ci / test-commons-core (push) Successful in 59s
ci / analyze (push) Successful in 1m53s
site / deploy (push) Successful in 33s
ci / test-app-seeds (push) Successful in 9m52s
release / fdroid_reference (push) Failing after 13s
release / play (push) Successful in 19m22s
180 lines
8 KiB
YAML
180 lines
8 KiB
YAML
# Release automation for git.comunes.org (Forgejo Actions).
|
|
#
|
|
# Pushing a tag `v*` runs two independent jobs:
|
|
# play - build the signed AAB and ship it to Google Play (internal).
|
|
# fdroid_reference- build the per-ABI reference APKs the SAME way F-Droid will
|
|
# (fdroid build inside the fdroidserver buildserver image),
|
|
# sign them with the tane-upload key, and attach them to the
|
|
# Forgejo release. F-Droid re-runs `fdroid build` on the same
|
|
# commit+recipe+image, gets byte-identical output, verifies our
|
|
# signature (AllowedAPKSigningKeys) and publishes OUR APK — so
|
|
# F-Droid and Play share the same signing key.
|
|
#
|
|
# All credentials come from repo secrets (Settings > Actions > Secrets):
|
|
# TANE_KEYSTORE_BASE64 base64 of the dedicated tane-upload.jks
|
|
# TANE_KEYSTORE_PASSWORD store password
|
|
# TANE_KEY_ALIAS tane-upload
|
|
# TANE_KEY_PASSWORD key password
|
|
# SUPPLY_JSON_KEY_DATA Google Play service-account JSON
|
|
#
|
|
# NOTE: `runs-on` must match a label your Forgejo runner registered with.
|
|
# The fdroid_reference job pulls a large image (~2 GB) and builds tesseract from
|
|
# source, so it is slow (~20-40 min); the play job is independent and unaffected.
|
|
|
|
name: release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
jobs:
|
|
play:
|
|
runs-on: docker
|
|
container:
|
|
image: ghcr.io/cirruslabs/flutter:3.41.9
|
|
steps:
|
|
# Manual git checkout (no Node): the flutter image has no node, so JS
|
|
# actions like actions/checkout@v4 fail with "exec: node: not found".
|
|
- name: Checkout
|
|
env:
|
|
TOKEN: ${{ github.token }}
|
|
run: |
|
|
git config --global --add safe.directory '*'
|
|
git init -q .
|
|
git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
|
|
git fetch -q --depth 1 origin "${GITHUB_SHA}"
|
|
git checkout -q FETCH_HEAD
|
|
|
|
- name: Generate code (i18n + Drift)
|
|
working-directory: apps/app_seeds
|
|
run: |
|
|
flutter pub get
|
|
dart run slang
|
|
dart run build_runner build --delete-conflicting-outputs
|
|
|
|
- name: Materialize signing material from secrets
|
|
working-directory: apps/app_seeds
|
|
env:
|
|
TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
|
|
TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
|
|
TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
|
|
TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
|
|
run: |
|
|
echo "$TANE_KEYSTORE_BASE64" | base64 -d > "$GITHUB_WORKSPACE/tane-upload.jks"
|
|
cat > android/key.properties <<EOF
|
|
storeFile=$GITHUB_WORKSPACE/tane-upload.jks
|
|
storePassword=$TANE_KEYSTORE_PASSWORD
|
|
keyAlias=$TANE_KEY_ALIAS
|
|
keyPassword=$TANE_KEY_PASSWORD
|
|
EOF
|
|
|
|
- name: Build signed AAB
|
|
working-directory: apps/app_seeds
|
|
run: flutter build appbundle --release
|
|
|
|
- name: Install fastlane
|
|
working-directory: apps/app_seeds
|
|
run: |
|
|
apt-get update -qq
|
|
apt-get install -y -qq ruby ruby-dev build-essential
|
|
gem install bundler --no-document
|
|
bundle install
|
|
|
|
- name: Publish to Google Play (internal track)
|
|
working-directory: apps/app_seeds
|
|
env:
|
|
SUPPLY_JSON_KEY_DATA: ${{ secrets.SUPPLY_JSON_KEY_DATA }}
|
|
run: bundle exec fastlane deploy_play
|
|
|
|
- name: Scrub signing material
|
|
if: always()
|
|
working-directory: apps/app_seeds
|
|
run: rm -f android/key.properties "$GITHUB_WORKSPACE/tane-upload.jks"
|
|
|
|
fdroid_reference:
|
|
runs-on: docker
|
|
container:
|
|
image: registry.gitlab.com/fdroid/fdroidserver:buildserver-trixie
|
|
steps:
|
|
- name: Build reference APKs with fdroid, sign, and attach to the release
|
|
env:
|
|
TOKEN: ${{ github.token }}
|
|
TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
|
|
TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
|
|
TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
|
|
TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
|
|
run: |
|
|
set -eu
|
|
|
|
# 1) Reproduce F-Droid's build environment (ANDROID_HOME, PATH, NDK...).
|
|
sh /opt/buildserver/setup-env-vars /opt/android-sdk
|
|
. /etc/profile.d/bsenv.sh
|
|
|
|
# 2) fdroidserver from master, exactly like the fdroiddata CI.
|
|
fds=/opt/fdroidserver-src
|
|
mkdir -p "$fds"
|
|
curl -sL https://gitlab.com/fdroid/fdroidserver/-/archive/master/fdroidserver-master.tar.gz \
|
|
| tar -xz -C "$fds" --strip-components=1
|
|
export PATH="$fds:$PATH"
|
|
export PYTHONPATH="$fds:$fds/examples"
|
|
git config --global --add safe.directory '*'
|
|
|
|
# 3) Fetch our in-repo recipe (the single source of truth) at this commit,
|
|
# plus the pubspec versionCode base for the per-ABI codes.
|
|
work=/tmp/tane-src
|
|
mkdir -p "$work" && cd "$work"
|
|
git init -q .
|
|
git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
|
|
git fetch -q --depth 1 origin "${GITHUB_SHA}"
|
|
git checkout -q FETCH_HEAD
|
|
base=$(sed -n -E 's/^version:.*\+([0-9]+)$/\1/p' apps/app_seeds/pubspec.yaml)
|
|
[ -n "$base" ]
|
|
|
|
# 4) Assemble a minimal fdroiddata (config.yml + srclibs + our recipe) from the
|
|
# in-repo files. No external host needed — the job container reaches
|
|
# git.comunes.org (via forgejo:3000) but not gitlab.com.
|
|
fdd=/tmp/fdroiddata
|
|
mkdir -p "$fdd/metadata" "$fdd/srclibs"
|
|
cp "$work/fdroid-ci/config.yml" "$fdd/config.yml"
|
|
cp "$work"/fdroid-ci/srclibs/*.yml "$fdd/srclibs/"
|
|
cp "$work/docs/fdroid/org.comunes.tane.yml" "$fdd/metadata/org.comunes.tane.yml"
|
|
cd "$fdd"
|
|
# Build THIS commit; drop binary: (we PRODUCE the reference here, not verify it).
|
|
sed -i "s#^\( *commit: \).*#\1${GITHUB_SHA}#" metadata/org.comunes.tane.yml
|
|
sed -i '/^ *binary: /d' metadata/org.comunes.tane.yml
|
|
|
|
# 5) Build the three per-ABI splits with F-Droid's own toolchain.
|
|
fdroid build --verbose --no-tarball \
|
|
"org.comunes.tane:$((base * 10 + 1))" \
|
|
"org.comunes.tane:$((base * 10 + 2))" \
|
|
"org.comunes.tane:$((base * 10 + 3))"
|
|
|
|
# 6) Sign each unsigned APK with tane-upload and attach to the Forgejo release.
|
|
apksigner=$(ls -d "$ANDROID_HOME"/build-tools/*/apksigner | sort -V | tail -1)
|
|
echo "$TANE_KEYSTORE_BASE64" | base64 -d > /tmp/ks.jks
|
|
api="http://forgejo:3000/api/v1/repos/${GITHUB_REPOSITORY}"
|
|
tag="${GITHUB_REF_NAME}"
|
|
curl -sf -X POST "$api/releases" \
|
|
-H "Authorization: token ${TOKEN}" -H 'Content-Type: application/json' \
|
|
-d "{\"tag_name\":\"${tag}\",\"name\":\"${tag}\"}" >/dev/null || true
|
|
rid=$(curl -sf -H "Authorization: token ${TOKEN}" "$api/releases/tags/${tag}" \
|
|
| python3 -c 'import sys,json;print(json.load(sys.stdin)["id"])')
|
|
for f in unsigned/org.comunes.tane_*.apk; do
|
|
vc=$(echo "$f" | sed -E 's/.*_([0-9]+)\.apk/\1/')
|
|
case $((vc % 10)) in
|
|
1) abi=armeabi-v7a ;;
|
|
2) abi=arm64-v8a ;;
|
|
3) abi=x86_64 ;;
|
|
*) echo "unexpected versionCode $vc"; exit 1 ;;
|
|
esac
|
|
out="/tmp/app-${abi}-release.apk"
|
|
"$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
|
|
--ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
|
|
--out "$out" "$f"
|
|
curl -sf -X POST "$api/releases/${rid}/assets?name=app-${abi}-release.apk" \
|
|
-H "Authorization: token ${TOKEN}" \
|
|
-F "attachment=@${out};type=application/vnd.android.package-archive"
|
|
echo "uploaded app-${abi}-release.apk (from ${f##*/})"
|
|
done
|
|
rm -f /tmp/ks.jks
|