Build Android #50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Android | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| mode: | |
| type: choice | |
| options: [release, debug, beta] | |
| default: release | |
| format: | |
| type: choice | |
| options: [apk, aab] | |
| default: apk | |
| jobs: | |
| build: | |
| # Pinned to 24.04. 26.04 runner not yet provided by GitHub | |
| # (tracked in actions/runner-images#13855). Bump when available. | |
| runs-on: ubuntu-24.04 | |
| # Least privilege: this job only checks out and uploads an artifact. | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Short SHA for the artifact name so each build is traceable to a commit. | |
| # `github` context has no short-SHA field; compute it from the checkout. | |
| - name: Resolve short commit SHA | |
| id: meta | |
| run: echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT" | |
| - name: Free disk space | |
| # Pinned to a commit SHA (not the mutable v1.3.1 tag): this third-party | |
| # action runs on a runner that holds the beta signing secrets, so a | |
| # retagged/compromised release must not be able to execute here. | |
| uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 | |
| with: | |
| tool-cache: true | |
| android: true | |
| dotnet: true | |
| haskell: true | |
| large-packages: true | |
| swap-storage: false | |
| # Dedicated beta signing key, written before the build so the container | |
| # image (Containerfile.app copies the repo) picks it up. A beta that ships | |
| # to testers must be signed with the real beta key; build.gradle leaves it | |
| # unsigned (never the public debug keystore) when the key is absent, so we | |
| # require all four secrets here and fail loud rather than produce an | |
| # uninstallable/unsigned artifact. The secret presence check lives in the | |
| # run body on purpose: the `secrets` context is not available in a step | |
| # `if:` (only `inputs`/`env` etc. are), so gating on it there would not work. | |
| - name: Configure beta signing key | |
| if: ${{ inputs.mode == 'beta' }} | |
| env: | |
| BETA_KEYSTORE_BASE64: ${{ secrets.BETA_KEYSTORE_BASE64 }} | |
| BETA_KEY_ALIAS: ${{ secrets.BETA_KEY_ALIAS }} | |
| BETA_KEY_PASSWORD: ${{ secrets.BETA_KEY_PASSWORD }} | |
| BETA_STORE_PASSWORD: ${{ secrets.BETA_STORE_PASSWORD }} | |
| run: | | |
| if [ -z "$BETA_KEYSTORE_BASE64" ] || [ -z "$BETA_KEY_ALIAS" ] \ | |
| || [ -z "$BETA_KEY_PASSWORD" ] || [ -z "$BETA_STORE_PASSWORD" ]; then | |
| echo "::error::Beta signing secrets (BETA_KEYSTORE_BASE64/BETA_KEY_ALIAS/BETA_KEY_PASSWORD/BETA_STORE_PASSWORD) are not all set; refusing to build an unsigned beta." | |
| exit 1 | |
| fi | |
| echo "$BETA_KEYSTORE_BASE64" | base64 -d > android/app/beta-upload.keystore | |
| cat > android/key-beta.properties <<EOF | |
| storeFile=beta-upload.keystore | |
| storePassword=$BETA_STORE_PASSWORD | |
| keyAlias=$BETA_KEY_ALIAS | |
| keyPassword=$BETA_KEY_PASSWORD | |
| EOF | |
| - name: Build | |
| # makefile uses `podman` directly; ubuntu-24.04 ships podman 4.9.3 preinstalled. | |
| run: make android ${{ inputs.mode }} FORMAT=${{ inputs.format }} | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: BULL-${{ inputs.mode }}-${{ steps.meta.outputs.sha_short }}-${{ inputs.format }} | |
| path: BULL-${{ inputs.mode }}.${{ inputs.format }} | |
| retention-days: 30 |