vjrj
92cc2e6232
F-Droid's reproducible-build verification failed: the native .so (Flutter libapp/libdartjni + tesseract4android libjpeg/leptonica/pngx/ libtesseract) differed byte-for-byte. Root cause: F-Droid builds under /home/vagrant/build/<appid> (its buildserver path) while our reference built under /tmp/fdroiddata/build/<appid> — the differing absolute build path leaks into the native libs (debug info / embedded paths). Build the reference under /home/vagrant so app + srclib paths match F-Droid's. Also: add a workflow_dispatch ref_tag input to rebuild+re-upload an existing release's reference APKs (idempotent asset replace) without cutting a new tag or re-deploying to Play — so reproducibility fixes can be iterated on the same v* release.
462 lines
24 KiB
YAML
462 lines
24 KiB
YAML
# Release automation for git.comunes.org (Forgejo Actions).
|
|
#
|
|
# Pushing a tag `v*` runs two independent jobs:
|
|
# play - build the signed AAB and ship it to Google Play (production, 100%).
|
|
# fdroid_reference- build the per-ABI reference APKs the SAME way F-Droid will
|
|
# (fdroid build inside the fdroidserver buildserver image),
|
|
# sign them with the tane-upload key, and attach them to the
|
|
# Forgejo release. F-Droid re-runs `fdroid build` on the same
|
|
# commit+recipe+image, gets byte-identical output, verifies our
|
|
# signature (AllowedAPKSigningKeys) and publishes OUR APK — so
|
|
# F-Droid and Play share the same signing key.
|
|
#
|
|
# All credentials come from repo secrets (Settings > Actions > Secrets):
|
|
# TANE_KEYSTORE_BASE64 base64 of the dedicated tane-upload.jks
|
|
# TANE_KEYSTORE_PASSWORD store password
|
|
# TANE_KEY_ALIAS tane-upload
|
|
# TANE_KEY_PASSWORD key password
|
|
# SUPPLY_JSON_KEY_DATA Google Play service-account JSON
|
|
#
|
|
# NOTE: `runs-on` must match a label your Forgejo runner registered with.
|
|
# fdroid_reference is 3 separate jobs chained with `needs:` (armeabi-v7a ->
|
|
# arm64-v8a -> x86_64), NOT a matrix: this runner's act_runner does not honor
|
|
# `strategy.max-parallel`, so a matrix always ran all 3 concurrently — 2-3
|
|
# simultaneous cold NDK/CMake/Gradle builds contend for RAM and get OOM-killed
|
|
# (silent "Gradle build daemon disappeared", no error message). `needs:` is
|
|
# core Actions syntax with no such gap, so it actually serializes them. Each
|
|
# needs its own full cold NDK+tesseract-native+flutter compile (~30-35min
|
|
# alone), which is why they're chained rather than run in one job (that alone
|
|
# was too slow even for a 90m timeout).
|
|
|
|
name: release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
# Manual trigger to test the fdroid_reference job on a branch without cutting a
|
|
# tag or deploying to Play (the play job below is guarded to tags only).
|
|
# Pass ref_tag (e.g. v0.1.10) to rebuild the reference APKs for an EXISTING
|
|
# release and re-upload them (idempotently), without cutting a new tag — used
|
|
# to iterate on build-reproducibility fixes without re-deploying to Play.
|
|
workflow_dispatch:
|
|
inputs:
|
|
ref_tag:
|
|
description: 'Existing tag to rebuild+re-upload reference APKs for (e.g. v0.1.10). Empty = build-only, no upload.'
|
|
required: false
|
|
default: ''
|
|
|
|
jobs:
|
|
play:
|
|
if: ${{ startsWith(github.ref, 'refs/tags/') }}
|
|
runs-on: docker
|
|
container:
|
|
image: ghcr.io/cirruslabs/flutter:3.41.9
|
|
steps:
|
|
# Manual git checkout (no Node): the flutter image has no node, so JS
|
|
# actions like actions/checkout@v4 fail with "exec: node: not found".
|
|
- name: Checkout
|
|
env:
|
|
TOKEN: ${{ github.token }}
|
|
run: |
|
|
git config --global --add safe.directory '*'
|
|
git init -q .
|
|
git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
|
|
git fetch -q --depth 1 origin "${GITHUB_SHA}"
|
|
git checkout -q FETCH_HEAD
|
|
|
|
- name: Generate code (i18n + Drift)
|
|
working-directory: apps/app_seeds
|
|
run: |
|
|
flutter pub get
|
|
# Same two hardenings the fdroid recipe applies (this job builds the AAB
|
|
# directly, not via the recipe, so a cold cache is still exposed):
|
|
# 1) strip flutter_tesseract_ocr's dead-jcenter buildscript (AGP 7.1.2) so
|
|
# it inherits the app's AGP instead of hitting jcenter.bintray.com;
|
|
# 2) cap the Gradle heap so the build fits the shared CI host's RAM.
|
|
find "${PUB_CACHE:-$HOME/.pub-cache}" -path '*flutter_tesseract_ocr-*/android/build.gradle' -exec sed -i '/^buildscript {/,/^}/d' {} +
|
|
printf 'org.gradle.jvmargs=-Xmx4g -XX:MaxMetaspaceSize=1g\norg.gradle.daemon=false\n' >> android/gradle.properties
|
|
dart run slang
|
|
dart run build_runner build --delete-conflicting-outputs
|
|
|
|
- name: Materialize signing material from secrets
|
|
working-directory: apps/app_seeds
|
|
env:
|
|
TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
|
|
TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
|
|
TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
|
|
TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
|
|
run: |
|
|
echo "$TANE_KEYSTORE_BASE64" | base64 -d > "$GITHUB_WORKSPACE/tane-upload.jks"
|
|
cat > android/key.properties <<EOF
|
|
storeFile=$GITHUB_WORKSPACE/tane-upload.jks
|
|
storePassword=$TANE_KEYSTORE_PASSWORD
|
|
keyAlias=$TANE_KEY_ALIAS
|
|
keyPassword=$TANE_KEY_PASSWORD
|
|
EOF
|
|
|
|
- name: Build signed AAB
|
|
working-directory: apps/app_seeds
|
|
run: flutter build appbundle --release
|
|
|
|
- name: Install fastlane
|
|
working-directory: apps/app_seeds
|
|
run: |
|
|
apt-get update -qq
|
|
apt-get install -y -qq ruby ruby-dev build-essential
|
|
gem install bundler --no-document
|
|
bundle install
|
|
|
|
- name: Publish to Google Play (production track, 100%)
|
|
working-directory: apps/app_seeds
|
|
env:
|
|
SUPPLY_JSON_KEY_DATA: ${{ secrets.SUPPLY_JSON_KEY_DATA }}
|
|
run: bundle exec fastlane deploy_play
|
|
|
|
- name: Scrub signing material
|
|
if: always()
|
|
working-directory: apps/app_seeds
|
|
run: rm -f android/key.properties "$GITHUB_WORKSPACE/tane-upload.jks"
|
|
|
|
fdroid_reference_armeabi_v7a:
|
|
# Serialize after play so two heavy Android builds never run concurrently on
|
|
# the shared host (capacity:2) — that contention OOM-killed play's Gradle
|
|
# daemon. `if: always()` keeps the fdroid chain independent of play's result
|
|
# (runs after play whether it succeeded, failed, or — on workflow_dispatch —
|
|
# was skipped).
|
|
needs: play
|
|
if: ${{ always() }}
|
|
runs-on: docker
|
|
container:
|
|
image: registry.gitlab.com/fdroid/fdroidserver:buildserver-trixie
|
|
steps:
|
|
- name: Build the armeabi-v7a reference APK with fdroid, sign, and attach it
|
|
env:
|
|
TOKEN: ${{ github.token }}
|
|
TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
|
|
TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
|
|
TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
|
|
TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
|
|
REF_TAG: ${{ github.event.inputs.ref_tag }}
|
|
ABI: armeabi-v7a
|
|
OFFSET: 1
|
|
run: |
|
|
set -eu
|
|
|
|
# 1) Reproduce F-Droid's build environment (ANDROID_HOME, PATH, NDK...).
|
|
sh /opt/buildserver/setup-env-vars /opt/android-sdk
|
|
. /etc/profile.d/bsenv.sh
|
|
|
|
# 2) fdroidserver from master, exactly like the fdroiddata CI.
|
|
fds=/opt/fdroidserver-src
|
|
mkdir -p "$fds"
|
|
curl -sL https://gitlab.com/fdroid/fdroidserver/-/archive/master/fdroidserver-master.tar.gz \
|
|
| tar -xz -C "$fds" --strip-components=1
|
|
export PATH="$fds:$PATH"
|
|
export PYTHONPATH="$fds:$fds/examples"
|
|
git config --global --add safe.directory '*'
|
|
# The job container reaches github.com but not the host's public git.comunes.org
|
|
# (NAT hairpin); redirect the app clone to the internal Forgejo host so
|
|
# `fdroid build` can fetch the source (and SOURCE_DATE_EPOCH from its commit).
|
|
git config --global url."http://x-access-token:${TOKEN}@forgejo:3000/".insteadOf "https://git.comunes.org/"
|
|
|
|
# 3) Fetch our in-repo recipe (the single source of truth) at this commit,
|
|
# plus the pubspec versionCode base for this ABI's versionCode.
|
|
# Which app commit/tag to build: on a tag push, the pushed commit; on a
|
|
# manual dispatch with ref_tag set, that tag (to rebuild+re-upload an
|
|
# existing release's references without cutting a new tag / Play deploy).
|
|
BUILD_REF="${REF_TAG:-$GITHUB_SHA}"
|
|
work=/tmp/tane-src
|
|
mkdir -p "$work" && cd "$work"
|
|
git init -q .
|
|
git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
|
|
git fetch -q --depth 1 origin "$BUILD_REF"
|
|
git checkout -q FETCH_HEAD
|
|
base=$(sed -n -E 's/^version:.*\+([0-9]+)$/\1/p' apps/app_seeds/pubspec.yaml)
|
|
[ -n "$base" ]
|
|
vc=$((base * 10 + OFFSET))
|
|
|
|
# 4) Assemble a minimal fdroiddata (config.yml + srclibs + our recipe) from the
|
|
# in-repo files. No external host needed — the job container reaches
|
|
# git.comunes.org (via forgejo:3000) but not gitlab.com.
|
|
# Match F-Droid's buildserver path (~/build/<appid>) so the native .so
|
|
# embed identical build paths — required for the byte-for-byte repro check.
|
|
fdd=/home/vagrant
|
|
mkdir -p "$fdd/metadata" "$fdd/srclibs"
|
|
cp "$work/fdroid-ci/config.yml" "$fdd/config.yml"
|
|
cp "$work"/fdroid-ci/srclibs/*.yml "$fdd/srclibs/"
|
|
cp "$work/docs/fdroid/org.comunes.tane.yml" "$fdd/metadata/org.comunes.tane.yml"
|
|
cd "$fdd"
|
|
# Build THIS commit; drop binary: (we PRODUCE the reference here, not verify it).
|
|
sed -i "s#^\( *commit: \).*#\1${BUILD_REF}#" metadata/org.comunes.tane.yml
|
|
sed -i '/^ *binary: /d' metadata/org.comunes.tane.yml
|
|
|
|
# Pre-clone the app into fdroid's build dir: fdroidserver computes
|
|
# SOURCE_DATE_EPOCH from this checkout BEFORE it clones anything — on a
|
|
# fresh dir it falls back to `git log` of the fdroiddata tree, which our
|
|
# assembled skeleton doesn't have, and crashes on None. With the clone in
|
|
# place the primary path pins SOURCE_DATE_EPOCH to the app commit
|
|
# timestamp (deterministic; the public URL is redirected to forgejo:3000
|
|
# by the insteadOf rule above).
|
|
mkdir -p build
|
|
git clone -q https://git.comunes.org/comunes/tane.git build/org.comunes.tane
|
|
git -C build/org.comunes.tane checkout -q "${BUILD_REF}"
|
|
|
|
# 5) Build ONLY this ABI's split with F-Droid's own toolchain. Splitting
|
|
# per-ABI into its own job/matrix-entry (rather than all 3 sequentially in
|
|
# one job) is what keeps each build inside the runner's max-job-runtime —
|
|
# each needs a full cold NDK+tesseract-native+flutter compile.
|
|
fdroid build --verbose --no-tarball "org.comunes.tane:${vc}"
|
|
|
|
# `fdroid build` exits 0 even when builds fail — demand the APK.
|
|
f="unsigned/org.comunes.tane_${vc}.apk"
|
|
if [ ! -f "$f" ]; then
|
|
echo "expected $f, not found" >&2
|
|
tail -n 80 logs/*.log 2>/dev/null || true
|
|
exit 1
|
|
fi
|
|
|
|
# 6) Sign the unsigned APK with tane-upload and attach it to the Forgejo release.
|
|
apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
|
|
if [ -z "$apksigner" ]; then
|
|
yes | sdkmanager "build-tools;34.0.0" >/dev/null 2>&1 || true
|
|
apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
|
|
fi
|
|
echo "$TANE_KEYSTORE_BASE64" | base64 -d > /tmp/ks.jks
|
|
out="/tmp/app-${ABI}-release.apk"
|
|
"$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
|
|
--ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
|
|
--out "$out" "$f"
|
|
# Prove the signer cert matches AllowedAPKSigningKeys.
|
|
"$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
|
|
rm -f /tmp/ks.jks
|
|
|
|
# Upload target: the pushed tag, or (on a manual dispatch) the ref_tag
|
|
# input. A plain dispatch with no ref_tag just builds+signs, no upload.
|
|
api="http://forgejo:3000/api/v1/repos/${GITHUB_REPOSITORY}"
|
|
UPLOAD_TAG=""
|
|
if [ "${GITHUB_REF_TYPE:-}" = tag ]; then
|
|
UPLOAD_TAG="${GITHUB_REF_NAME}"
|
|
elif [ -n "${REF_TAG:-}" ]; then
|
|
UPLOAD_TAG="${REF_TAG}"
|
|
fi
|
|
if [ -n "$UPLOAD_TAG" ]; then
|
|
curl -sf -X POST "$api/releases" \
|
|
-H "Authorization: token ${TOKEN}" -H 'Content-Type: application/json' \
|
|
-d "{\"tag_name\":\"${UPLOAD_TAG}\",\"name\":\"${UPLOAD_TAG}\"}" >/dev/null || true
|
|
rid=$(curl -sf -H "Authorization: token ${TOKEN}" "$api/releases/tags/${UPLOAD_TAG}" \
|
|
| python3 -c 'import sys,json;print(json.load(sys.stdin)["id"])')
|
|
# Idempotent re-upload: delete any existing asset of this name first
|
|
# (the assets POST rejects a duplicate name).
|
|
curl -sf -H "Authorization: token ${TOKEN}" "$api/releases/${rid}/assets" \
|
|
| python3 -c "import sys,json;[print(a['id']) for a in json.load(sys.stdin) if a['name']=='app-${ABI}-release.apk']" 2>/dev/null \
|
|
| while read -r aid; do [ -n "$aid" ] && curl -sf -X DELETE -H "Authorization: token ${TOKEN}" "$api/releases/${rid}/assets/${aid}" >/dev/null || true; done
|
|
curl -sf -X POST "$api/releases/${rid}/assets?name=app-${ABI}-release.apk" \
|
|
-H "Authorization: token ${TOKEN}" \
|
|
-F "attachment=@${out};type=application/vnd.android.package-archive"
|
|
echo "uploaded app-${ABI}-release.apk to ${UPLOAD_TAG} (from ${f##*/})"
|
|
else
|
|
echo "built+signed app-${ABI}-release.apk (dispatch: no ref_tag, upload skipped)"
|
|
fi
|
|
|
|
fdroid_reference_arm64_v8a:
|
|
needs: fdroid_reference_armeabi_v7a
|
|
runs-on: docker
|
|
container:
|
|
image: registry.gitlab.com/fdroid/fdroidserver:buildserver-trixie
|
|
steps:
|
|
- name: Build the arm64-v8a reference APK with fdroid, sign, and attach it
|
|
env:
|
|
TOKEN: ${{ github.token }}
|
|
TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
|
|
TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
|
|
TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
|
|
TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
|
|
REF_TAG: ${{ github.event.inputs.ref_tag }}
|
|
ABI: arm64-v8a
|
|
OFFSET: 2
|
|
run: |
|
|
set -eu
|
|
sh /opt/buildserver/setup-env-vars /opt/android-sdk
|
|
. /etc/profile.d/bsenv.sh
|
|
fds=/opt/fdroidserver-src
|
|
mkdir -p "$fds"
|
|
curl -sL https://gitlab.com/fdroid/fdroidserver/-/archive/master/fdroidserver-master.tar.gz \
|
|
| tar -xz -C "$fds" --strip-components=1
|
|
export PATH="$fds:$PATH"
|
|
export PYTHONPATH="$fds:$fds/examples"
|
|
git config --global --add safe.directory '*'
|
|
git config --global url."http://x-access-token:${TOKEN}@forgejo:3000/".insteadOf "https://git.comunes.org/"
|
|
# Which app commit/tag to build: on a tag push, the pushed commit; on a
|
|
# manual dispatch with ref_tag set, that tag (to rebuild+re-upload an
|
|
# existing release's references without cutting a new tag / Play deploy).
|
|
BUILD_REF="${REF_TAG:-$GITHUB_SHA}"
|
|
work=/tmp/tane-src
|
|
mkdir -p "$work" && cd "$work"
|
|
git init -q .
|
|
git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
|
|
git fetch -q --depth 1 origin "$BUILD_REF"
|
|
git checkout -q FETCH_HEAD
|
|
base=$(sed -n -E 's/^version:.*\+([0-9]+)$/\1/p' apps/app_seeds/pubspec.yaml)
|
|
[ -n "$base" ]
|
|
vc=$((base * 10 + OFFSET))
|
|
# Match F-Droid's buildserver path (~/build/<appid>) so the native .so
|
|
# embed identical build paths — required for the byte-for-byte repro check.
|
|
fdd=/home/vagrant
|
|
mkdir -p "$fdd/metadata" "$fdd/srclibs"
|
|
cp "$work/fdroid-ci/config.yml" "$fdd/config.yml"
|
|
cp "$work"/fdroid-ci/srclibs/*.yml "$fdd/srclibs/"
|
|
cp "$work/docs/fdroid/org.comunes.tane.yml" "$fdd/metadata/org.comunes.tane.yml"
|
|
cd "$fdd"
|
|
sed -i "s#^\( *commit: \).*#\1${BUILD_REF}#" metadata/org.comunes.tane.yml
|
|
sed -i '/^ *binary: /d' metadata/org.comunes.tane.yml
|
|
mkdir -p build
|
|
git clone -q https://git.comunes.org/comunes/tane.git build/org.comunes.tane
|
|
git -C build/org.comunes.tane checkout -q "${BUILD_REF}"
|
|
fdroid build --verbose --no-tarball "org.comunes.tane:${vc}"
|
|
f="unsigned/org.comunes.tane_${vc}.apk"
|
|
if [ ! -f "$f" ]; then
|
|
echo "expected $f, not found" >&2
|
|
tail -n 80 logs/*.log 2>/dev/null || true
|
|
exit 1
|
|
fi
|
|
apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
|
|
if [ -z "$apksigner" ]; then
|
|
yes | sdkmanager "build-tools;34.0.0" >/dev/null 2>&1 || true
|
|
apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
|
|
fi
|
|
echo "$TANE_KEYSTORE_BASE64" | base64 -d > /tmp/ks.jks
|
|
out="/tmp/app-${ABI}-release.apk"
|
|
"$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
|
|
--ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
|
|
--out "$out" "$f"
|
|
"$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
|
|
rm -f /tmp/ks.jks
|
|
# Upload target: the pushed tag, or (on a manual dispatch) the ref_tag
|
|
# input. A plain dispatch with no ref_tag just builds+signs, no upload.
|
|
api="http://forgejo:3000/api/v1/repos/${GITHUB_REPOSITORY}"
|
|
UPLOAD_TAG=""
|
|
if [ "${GITHUB_REF_TYPE:-}" = tag ]; then
|
|
UPLOAD_TAG="${GITHUB_REF_NAME}"
|
|
elif [ -n "${REF_TAG:-}" ]; then
|
|
UPLOAD_TAG="${REF_TAG}"
|
|
fi
|
|
if [ -n "$UPLOAD_TAG" ]; then
|
|
curl -sf -X POST "$api/releases" \
|
|
-H "Authorization: token ${TOKEN}" -H 'Content-Type: application/json' \
|
|
-d "{\"tag_name\":\"${UPLOAD_TAG}\",\"name\":\"${UPLOAD_TAG}\"}" >/dev/null || true
|
|
rid=$(curl -sf -H "Authorization: token ${TOKEN}" "$api/releases/tags/${UPLOAD_TAG}" \
|
|
| python3 -c 'import sys,json;print(json.load(sys.stdin)["id"])')
|
|
# Idempotent re-upload: delete any existing asset of this name first
|
|
# (the assets POST rejects a duplicate name).
|
|
curl -sf -H "Authorization: token ${TOKEN}" "$api/releases/${rid}/assets" \
|
|
| python3 -c "import sys,json;[print(a['id']) for a in json.load(sys.stdin) if a['name']=='app-${ABI}-release.apk']" 2>/dev/null \
|
|
| while read -r aid; do [ -n "$aid" ] && curl -sf -X DELETE -H "Authorization: token ${TOKEN}" "$api/releases/${rid}/assets/${aid}" >/dev/null || true; done
|
|
curl -sf -X POST "$api/releases/${rid}/assets?name=app-${ABI}-release.apk" \
|
|
-H "Authorization: token ${TOKEN}" \
|
|
-F "attachment=@${out};type=application/vnd.android.package-archive"
|
|
echo "uploaded app-${ABI}-release.apk to ${UPLOAD_TAG} (from ${f##*/})"
|
|
else
|
|
echo "built+signed app-${ABI}-release.apk (dispatch: no ref_tag, upload skipped)"
|
|
fi
|
|
|
|
fdroid_reference_x86_64:
|
|
needs: fdroid_reference_arm64_v8a
|
|
runs-on: docker
|
|
container:
|
|
image: registry.gitlab.com/fdroid/fdroidserver:buildserver-trixie
|
|
steps:
|
|
- name: Build the x86_64 reference APK with fdroid, sign, and attach it
|
|
env:
|
|
TOKEN: ${{ github.token }}
|
|
TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
|
|
TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
|
|
TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
|
|
TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
|
|
REF_TAG: ${{ github.event.inputs.ref_tag }}
|
|
ABI: x86_64
|
|
OFFSET: 3
|
|
run: |
|
|
set -eu
|
|
sh /opt/buildserver/setup-env-vars /opt/android-sdk
|
|
. /etc/profile.d/bsenv.sh
|
|
fds=/opt/fdroidserver-src
|
|
mkdir -p "$fds"
|
|
curl -sL https://gitlab.com/fdroid/fdroidserver/-/archive/master/fdroidserver-master.tar.gz \
|
|
| tar -xz -C "$fds" --strip-components=1
|
|
export PATH="$fds:$PATH"
|
|
export PYTHONPATH="$fds:$fds/examples"
|
|
git config --global --add safe.directory '*'
|
|
git config --global url."http://x-access-token:${TOKEN}@forgejo:3000/".insteadOf "https://git.comunes.org/"
|
|
# Which app commit/tag to build: on a tag push, the pushed commit; on a
|
|
# manual dispatch with ref_tag set, that tag (to rebuild+re-upload an
|
|
# existing release's references without cutting a new tag / Play deploy).
|
|
BUILD_REF="${REF_TAG:-$GITHUB_SHA}"
|
|
work=/tmp/tane-src
|
|
mkdir -p "$work" && cd "$work"
|
|
git init -q .
|
|
git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
|
|
git fetch -q --depth 1 origin "$BUILD_REF"
|
|
git checkout -q FETCH_HEAD
|
|
base=$(sed -n -E 's/^version:.*\+([0-9]+)$/\1/p' apps/app_seeds/pubspec.yaml)
|
|
[ -n "$base" ]
|
|
vc=$((base * 10 + OFFSET))
|
|
# Match F-Droid's buildserver path (~/build/<appid>) so the native .so
|
|
# embed identical build paths — required for the byte-for-byte repro check.
|
|
fdd=/home/vagrant
|
|
mkdir -p "$fdd/metadata" "$fdd/srclibs"
|
|
cp "$work/fdroid-ci/config.yml" "$fdd/config.yml"
|
|
cp "$work"/fdroid-ci/srclibs/*.yml "$fdd/srclibs/"
|
|
cp "$work/docs/fdroid/org.comunes.tane.yml" "$fdd/metadata/org.comunes.tane.yml"
|
|
cd "$fdd"
|
|
sed -i "s#^\( *commit: \).*#\1${BUILD_REF}#" metadata/org.comunes.tane.yml
|
|
sed -i '/^ *binary: /d' metadata/org.comunes.tane.yml
|
|
mkdir -p build
|
|
git clone -q https://git.comunes.org/comunes/tane.git build/org.comunes.tane
|
|
git -C build/org.comunes.tane checkout -q "${BUILD_REF}"
|
|
fdroid build --verbose --no-tarball "org.comunes.tane:${vc}"
|
|
f="unsigned/org.comunes.tane_${vc}.apk"
|
|
if [ ! -f "$f" ]; then
|
|
echo "expected $f, not found" >&2
|
|
tail -n 80 logs/*.log 2>/dev/null || true
|
|
exit 1
|
|
fi
|
|
apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
|
|
if [ -z "$apksigner" ]; then
|
|
yes | sdkmanager "build-tools;34.0.0" >/dev/null 2>&1 || true
|
|
apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
|
|
fi
|
|
echo "$TANE_KEYSTORE_BASE64" | base64 -d > /tmp/ks.jks
|
|
out="/tmp/app-${ABI}-release.apk"
|
|
"$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
|
|
--ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
|
|
--out "$out" "$f"
|
|
"$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
|
|
rm -f /tmp/ks.jks
|
|
# Upload target: the pushed tag, or (on a manual dispatch) the ref_tag
|
|
# input. A plain dispatch with no ref_tag just builds+signs, no upload.
|
|
api="http://forgejo:3000/api/v1/repos/${GITHUB_REPOSITORY}"
|
|
UPLOAD_TAG=""
|
|
if [ "${GITHUB_REF_TYPE:-}" = tag ]; then
|
|
UPLOAD_TAG="${GITHUB_REF_NAME}"
|
|
elif [ -n "${REF_TAG:-}" ]; then
|
|
UPLOAD_TAG="${REF_TAG}"
|
|
fi
|
|
if [ -n "$UPLOAD_TAG" ]; then
|
|
curl -sf -X POST "$api/releases" \
|
|
-H "Authorization: token ${TOKEN}" -H 'Content-Type: application/json' \
|
|
-d "{\"tag_name\":\"${UPLOAD_TAG}\",\"name\":\"${UPLOAD_TAG}\"}" >/dev/null || true
|
|
rid=$(curl -sf -H "Authorization: token ${TOKEN}" "$api/releases/tags/${UPLOAD_TAG}" \
|
|
| python3 -c 'import sys,json;print(json.load(sys.stdin)["id"])')
|
|
# Idempotent re-upload: delete any existing asset of this name first
|
|
# (the assets POST rejects a duplicate name).
|
|
curl -sf -H "Authorization: token ${TOKEN}" "$api/releases/${rid}/assets" \
|
|
| python3 -c "import sys,json;[print(a['id']) for a in json.load(sys.stdin) if a['name']=='app-${ABI}-release.apk']" 2>/dev/null \
|
|
| while read -r aid; do [ -n "$aid" ] && curl -sf -X DELETE -H "Authorization: token ${TOKEN}" "$api/releases/${rid}/assets/${aid}" >/dev/null || true; done
|
|
curl -sf -X POST "$api/releases/${rid}/assets?name=app-${ABI}-release.apk" \
|
|
-H "Authorization: token ${TOKEN}" \
|
|
-F "attachment=@${out};type=application/vnd.android.package-archive"
|
|
echo "uploaded app-${ABI}-release.apk to ${UPLOAD_TAG} (from ${f##*/})"
|
|
else
|
|
echo "built+signed app-${ABI}-release.apk (dispatch: no ref_tag, upload skipped)"
|
|
fi
|