mirror of
https://github.com/Droid-Deck/DroidDeck.git
synced 2026-10-15 03:37:09 -04:00
96 lines
3.2 KiB
YAML
96 lines
3.2 KiB
YAML
name: Sign APKs
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
environment:
|
|
type: string
|
|
required: true
|
|
variants:
|
|
description: JSON array of names from tools/release/variants.txt
|
|
type: string
|
|
required: true
|
|
run_id:
|
|
description: The Build APK run whose apk to sign; empty for the calling run's own
|
|
type: string
|
|
default: ''
|
|
label:
|
|
description: Goes in the file names (a version); empty for <branch>-<short sha>
|
|
type: string
|
|
default: ''
|
|
artifact:
|
|
type: string
|
|
default: droiddeck-signed
|
|
|
|
permissions:
|
|
contents: read
|
|
actions: read
|
|
|
|
jobs:
|
|
sign:
|
|
name: sign ${{ matrix.variant }}
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 15
|
|
environment: ${{ inputs.environment }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
variant: ${{ fromJSON(inputs.variants) }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: The apk (this run's build)
|
|
if: inputs.run_id == ''
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: droiddeck-apk
|
|
path: in
|
|
|
|
- name: The apk (a main build)
|
|
if: inputs.run_id != ''
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
RUN: ${{ inputs.run_id }}
|
|
run: gh run download "$RUN" -R "$GITHUB_REPOSITORY" -n droiddeck-apk -D in
|
|
|
|
- name: Sign
|
|
env:
|
|
RELEASE_KEYSTORE_B64: ${{ secrets.RELEASE_KEYSTORE_B64 }}
|
|
RELEASE_STORE_PASSWORD: ${{ secrets.RELEASE_STORE_PASSWORD }}
|
|
RELEASE_KEY_ALIAS: droiddeck
|
|
ENVIRONMENT: ${{ inputs.environment }}
|
|
VARIANT: ${{ matrix.variant }}
|
|
LABEL: ${{ inputs.label }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "$RELEASE_KEYSTORE_B64" ]; then
|
|
echo "::error::environment '$ENVIRONMENT' has no signing key: run tools/release/make-release-key.sh once"
|
|
exit 1
|
|
fi
|
|
export RELEASE_KEYSTORE="$RUNNER_TEMP/release.p12"
|
|
( umask 077; base64 -d <<<"$RELEASE_KEYSTORE_B64" > "$RELEASE_KEYSTORE" )
|
|
BUILD_TOOLS=$(ls -d "$ANDROID_HOME"/build-tools/* | sort -V | tail -n1)
|
|
export BUILD_TOOLS
|
|
[ -n "$LABEL" ] || LABEL="${GITHUB_REF_NAME//\//-}-${GITHUB_SHA::7}"
|
|
suffix=$(awk -v v="$VARIANT" '!/^#/ && $1 == v { print $3 }' tools/release/variants.txt)
|
|
[ "$suffix" = - ] && suffix=
|
|
apks=(in/*.apk)
|
|
[ ${#apks[@]} = 1 ] && [ -f "${apks[0]}" ] || { echo "::error::expected one apk in the build"; exit 1; }
|
|
mkdir -p out
|
|
out="out/DroidDeck-$LABEL$suffix.apk"
|
|
tools/release/sign-apk.sh "${apks[0]}" "$VARIANT" "$out"
|
|
( cd out && sha256sum -- *.apk > "SHA256SUMS-$VARIANT.txt" && cat "SHA256SUMS-$VARIANT.txt" )
|
|
echo "- \`$(basename "$out")\` - $(cut -c1-16 "out/SHA256SUMS-$VARIANT.txt")…" >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- name: Forget the key
|
|
if: always()
|
|
run: rm -f "$RUNNER_TEMP/release.p12"
|
|
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: ${{ inputs.artifact }}-${{ matrix.variant }}
|
|
path: out/*
|
|
if-no-files-found: error
|