fix(ios): regenerate Podfile.lock for React Native 0.86.2 #36
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: android-release | |
| # Signed Android APK + AAB for the CumulusVPN mobile app (clients/mobile). | |
| # Mirrors the ssp-key pattern: the release keystore is a base64 GitHub secret, | |
| # decoded at build time; alias + passwords come from secrets too. | |
| # | |
| # Trigger: push a tag like `mobile-v1.2.3`, or run manually. | |
| # | |
| # Required GitHub secrets (see docs/14-releases.md for how to generate them): | |
| # ANDROID_SIGNING_KEY base64 of your release.keystore | |
| # ANDROID_ALIAS key alias | |
| # ANDROID_KEY_PASSWORD key password | |
| # ANDROID_KEY_STORE_PASSWORD keystore password | |
| on: | |
| push: | |
| tags: ['mobile-v*'] | |
| workflow_dispatch: | |
| permissions: | |
| contents: write # to create the GitHub Release | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: clients/mobile | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-java@v5 | |
| with: | |
| distribution: zulu | |
| java-version: '17' | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 22 | |
| # The multi-hop tunnel .so (wgmobile.aar) is built from Go via gomobile. | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version: '1.25' | |
| - name: Enable Corepack | |
| run: corepack enable | |
| working-directory: ${{ github.workspace }} | |
| # Build the nested-tunnel AAR (gomobile bind → libgojni.so) that the app's | |
| # gradle build consumes. Gitignored artifact; must exist before assemble. | |
| - name: Build wgnest multi-hop AAR | |
| working-directory: ${{ github.workspace }} | |
| run: bash clients/native/wgnest/build-android.sh | |
| # The RN bundle imports @cumulusvpn/core (file:../core-ts) via its built | |
| # dist, so build the shared core before installing/bundling the app. | |
| - name: Build shared core | |
| working-directory: ${{ github.workspace }} | |
| run: | | |
| yarn install --immutable | |
| yarn workspace @cumulusvpn/core build | |
| - name: Install mobile deps | |
| run: yarn install --no-immutable | |
| - name: Decode release keystore | |
| uses: timheuer/base64-to-file@v2 | |
| with: | |
| fileName: release.keystore | |
| fileDir: ${{ github.workspace }}/clients/mobile/android/app/ | |
| encodedString: ${{ secrets.ANDROID_SIGNING_KEY }} | |
| - name: Build signed APK + AAB | |
| working-directory: clients/mobile/android | |
| env: | |
| SIGNING_KEY_ALIAS: ${{ secrets.ANDROID_ALIAS }} | |
| SIGNING_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }} | |
| SIGNING_STORE_PASSWORD: ${{ secrets.ANDROID_KEY_STORE_PASSWORD }} | |
| run: | | |
| # versionName from the tag (mobile-v1.2.3 → 1.2.3); versionCode from the | |
| # monotonic run number so every Play upload has a strictly-increasing code | |
| # even when the same tag is re-cut. Manual runs default the name to 0.0.0. | |
| ver="${GITHUB_REF_NAME#mobile-v}" | |
| [ "$ver" = "${GITHUB_REF_NAME}" ] && ver="0.0.0" | |
| code="${{ github.run_number }}" | |
| echo "versionName=$ver versionCode=$code" | |
| ./gradlew clean | |
| ./gradlew generateCodegenArtifactsFromSchema --rerun-tasks | |
| ./gradlew assembleRelease -PcvpnVersionName="$ver" -PcvpnVersionCode="$code" | |
| ./gradlew bundleRelease -PcvpnVersionName="$ver" -PcvpnVersionCode="$code" | |
| # Play REJECTS uploads whose 64-bit .so are not 16 KB-aligned (targetSdk >= 35, | |
| # enforced since 2025-11-01). gomobile emits 4 KB by default, so | |
| # build-android.sh passes -Wl,-z,max-page-size=16384. This gates the REAL .aab | |
| # so a regression fails here instead of at the Play Console — the runner's Go | |
| # and NDK versions differ from any dev machine, so the artifact must be checked | |
| # where it is actually produced. | |
| - name: Verify 16 KB page alignment (Play upload gate) | |
| working-directory: ${{ github.workspace }} | |
| run: | | |
| bash clients/native/wgnest/check-16k.sh \ | |
| clients/mobile/android/app/build/outputs/bundle/release/app-release.aab | |
| # Rename to clear, versioned filenames so every download is self-describing | |
| # (CumulusVPN-1.0.0.apk / CumulusVPN-1.0.0.aab) instead of "app-release.*". | |
| - name: Stage named artifacts | |
| working-directory: ${{ github.workspace }} # job default is clients/mobile; actions below resolve from the workspace root | |
| run: | | |
| ver="${GITHUB_REF_NAME#mobile-v}" | |
| [ "$ver" = "${GITHUB_REF_NAME}" ] && ver="dev" # manual/dispatch run (no tag) | |
| mkdir -p dist | |
| cp clients/mobile/android/app/build/outputs/apk/release/app-release.apk "dist/CumulusVPN-${ver}.apk" | |
| cp clients/mobile/android/app/build/outputs/bundle/release/app-release.aab "dist/CumulusVPN-${ver}.aab" | |
| ls -la dist | |
| # Two SEPARATE Actions artifacts, so each can be downloaded on its own. | |
| - name: Upload APK artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: CumulusVPN-APK | |
| path: dist/CumulusVPN-*.apk | |
| if-no-files-found: error | |
| - name: Upload AAB artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: CumulusVPN-AAB | |
| path: dist/CumulusVPN-*.aab | |
| if-no-files-found: error | |
| # On a tag, attach both as direct-download Release assets: | |
| # .apk = sideload straight onto a phone · .aab = upload to Play Console. | |
| - name: Publish GitHub Release | |
| if: startsWith(github.ref, 'refs/tags/') | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| files: | | |
| dist/CumulusVPN-*.apk | |
| dist/CumulusVPN-*.aab | |
| fail_on_unmatched_files: true |