Distribute v2 demo app builds to Firebase App Distribution (#1813)

* Distribute v2 demo app builds to Firebase App Distribution

Nothing was distributed from develop-v2, so the team had no way to test
v2 work. Add a workflow that builds the demo app on every push to
develop-v2 and uploads it to the stream-testers group in the shared
stream-android-32afb Firebase project.

The demo app google-services.json is left alone. It stays on
stream-video-9b586 so push and Crashlytics keep working. App Distribution
only needs the APK package name to match the registered app.

* Fix the APK artifact path in the app distribution workflow

The Upload APK step pointed at build/outputs/apk/demo-app/release, but
AGP writes to build/outputs/apk/<flavor>/<buildType>, so the directory
never existed. upload-artifact only warns when it finds no files, so the
step passed and every run uploaded an empty artifact.

* Harden the v2 distribution workflow

Address the security findings from the automated review:

- Drop the unused actions: write permission. The job only reads the repo
  and uploads an artifact.
- Read the gpg passphrase from stdin instead of passing it as a command
  line argument, where it is visible in the process list.
- Reference the secrets as shell variables rather than expanding them
  into the run script, which removes the template injection surface.
- Delete the decrypted keystore, keystore properties and env properties
  right after the build, so they are gone before the third-party Firebase
  action runs.
- Pin actions/upload-artifact to a commit SHA, matching how checkout and
  the Firebase action are already pinned.

* TEMPORARY: run the v2 distribution workflow from this PR branch

A push trigger reads the workflow file from the branch being pushed, and
workflow_dispatch is not available until the file reaches the default
branch. Adding this branch to the trigger is the only way to verify the
pipeline end to end before it lands on develop-v2.

Revert this commit before merging.

* Remove the temporary PR branch trigger

The pipeline was verified end to end from this branch in run 34132353521:
the keystore decrypted, the development release APK was assembled and
signed, the artifact uploaded, and the build was distributed to the
stream-testers group in stream-android-32afb.

The trigger has served its purpose, so the workflow now runs only on
develop-v2.

* Build only the distributed variant in the app distribution workflow

assembleRelease built the release variant of all three flavors, but the
job only uploads the development APK, so the e2etesting and production
builds were discarded. Assemble just the development release instead.

The Google Play pipeline is unaffected. internal-app-distribute.yml runs
publishBundle, and its playConfigs only registers productionRelease.

Author: andremion

.github/workflows/app-distribute-v2.yml

@@ -0,0 +1,55 @@
+name: App Distribute CI v2
+
+# Temporary workflow to publish the v2 demo app to Firebase App Distribution in the shared
+# stream-android-32afb project. When v2 is released and `develop-v2` becomes `develop`, remove
+# this workflow and update the main `app-distribute.yml` instead.
+
+on:
+  push:
+    branches:
+      - develop-v2
+  workflow_dispatch:
+
+jobs:
+  build_v2_demo_app:
+    permissions:
+      contents: read
+    name: Build and Distribute V2 Demo App
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: GetStream/android-ci-actions/actions/setup-java@cb46e4f44d105a68738bfd2a1cfd156bb768665b
+      - name: Prepare environment
+        env:
+          ENV_PROPERTIES: ${{ secrets.ENV_PROPERTIES }}
+          PASSPHRASE: ${{ secrets.PASSPHRASE }}
+          RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }}
+          RELEASE_KEYSTORE_PROPERTIES: ${{ secrets.RELEASE_KEYSTORE_PROPERTIES }}
+        run: |
+          echo "$RELEASE_KEYSTORE" > .sign/release.keystore.asc
+          gpg -d --batch --pinentry-mode loopback --passphrase-fd 0 \
+            .sign/release.keystore.asc > .sign/release.keystore <<< "$PASSPHRASE"
+          echo "$RELEASE_KEYSTORE_PROPERTIES" > .sign/keystore.properties.asc
+          gpg -d --batch --pinentry-mode loopback --passphrase-fd 0 \
+            .sign/keystore.properties.asc > .sign/keystore.properties <<< "$PASSPHRASE"
+          echo "$ENV_PROPERTIES" > .env.properties
+      - name: Assemble
+        run: bash ./gradlew :demo-app:assembleDevelopmentRelease --stacktrace
+      - name: Remove signing material
+        if: always()
+        run: |
+          rm -f .sign/release.keystore .sign/release.keystore.asc \
+                .sign/keystore.properties .sign/keystore.properties.asc \
+                .env.properties
+      - name: Upload APK
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: demo-app-development-release
+          path: demo-app/build/outputs/apk/development/release/
+      - name: Upload artifact to Firebase App Distribution
+        uses: wzieba/Firebase-Distribution-Github-Action@bd494989dd4bec0343f78adee87fe66e48279ad6
+        with:
+          appId: ${{ secrets.FIREBASE_V2_DEMO_APP_ID }}
+          serviceCredentialsFileContent: ${{ secrets.STREAM_ANDROID_FIREBASE_CREDENTIALS_APP_CONTENT }}
+          groups: stream-testers
+          file: demo-app/build/outputs/apk/development/release/demo-app-development-release.apk

.github/workflows/app-distribute.yml

@@ -29,12 +29,12 @@ jobs:
           gpg -d --passphrase "${{ env.PASSPHRASE }}" --batch .sign/keystore.properties.asc > .sign/keystore.properties
           echo "${{ env.ENV_PROPERTIES }}" > .env.properties
       - name: Assemble
-        run: bash ./gradlew :demo-app:assembleRelease --stacktrace
+        run: bash ./gradlew :demo-app:assembleDevelopmentRelease --stacktrace
       - name: Upload APK
         uses: actions/upload-artifact@v7
         with:
           name: demo-app-release
-          path: demo-app/build/outputs/apk/demo-app/release/
+          path: demo-app/build/outputs/apk/development/release/
       - name: Upload artifact to Firebase App Distribution
         uses: wzieba/Firebase-Distribution-Github-Action@bd494989dd4bec0343f78adee87fe66e48279ad6
         with: