android signing

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Author: UniqueDing

.github/workflows/build-multi-platform.yml

@@ -4,6 +4,7 @@ on:
   workflow_dispatch:
   push:
     branches: ["master"]
+    tags: ["v*"]
 
 jobs:
   build-desktop:
@@ -64,9 +65,11 @@ jobs:
           path: ${{ matrix.platform.artifact_path }}
           if-no-files-found: error
 
-  build-android:
-    name: Build android
+  build-android-release:
+    name: Build signed android apk
     runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    environment: release
 
     steps:
       - name: Checkout
@@ -87,17 +90,43 @@ jobs:
       - name: Get dependencies
         run: flutter pub get
 
-      - name: Build Android APK
+      - name: Restore Android keystore
+        run: |
+          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > android/release-keystore.jks
+
+      - name: Create key.properties
+        run: |
+          cat > android/key.properties <<EOF
+          storePassword=${{ secrets.ANDROID_STORE_PASSWORD }}
+          keyPassword=${{ secrets.ANDROID_KEY_PASSWORD }}
+          keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}
+          storeFile=release-keystore.jks
+          EOF
+
+      - name: Build signed Android APK
         run: flutter build apk --release
 
-      - name: Build Android App Bundle
-        run: flutter build appbundle --release
+      - name: Verify APK signature
+        run: |
+          BUILD_TOOLS_VERSION=$(ls "$ANDROID_HOME/build-tools" | sort -V | tail -n 1)
+          "$ANDROID_HOME/build-tools/$BUILD_TOOLS_VERSION/apksigner" verify --print-certs build/app/outputs/flutter-apk/app-release.apk
+
+      - name: Generate checksums
+        run: |
+          sha256sum build/app/outputs/flutter-apk/app-release.apk > build/app/outputs/flutter-apk/app-release.apk.sha256
+
+      - name: Export signing certificate details
+        run: |
+          BUILD_TOOLS_VERSION=$(ls "$ANDROID_HOME/build-tools" | sort -V | tail -n 1)
+          "$ANDROID_HOME/build-tools/$BUILD_TOOLS_VERSION/apksigner" verify --print-certs build/app/outputs/flutter-apk/app-release.apk \
+            > build/app/outputs/flutter-apk/app-release.cert.txt
 
       - name: Upload Android artifact
         uses: actions/upload-artifact@v4
         with:
-          name: ailurus-android
+          name: ailurus-android-signed
           path: |
-            build/app/outputs/flutter-apk/*.apk
-            build/app/outputs/bundle/release/*.aab
+            build/app/outputs/flutter-apk/app-release.apk
+            build/app/outputs/flutter-apk/app-release.apk.sha256
+            build/app/outputs/flutter-apk/app-release.cert.txt
           if-no-files-found: error

.gitignore

@@ -48,6 +48,8 @@ app.*.map.json
 /lib/generated/
 /android/.gradle/
 /android/local.properties
+/android/key.properties
+/android/release-keystore.jks
 /ios/Flutter/ephemeral/
 /macos/Flutter/ephemeral/
 /linux/flutter/ephemeral/

android/app/build.gradle.kts

@@ -1,10 +1,28 @@
+import java.io.FileInputStream
+import java.util.Properties
+
 plugins {
     id("com.android.application")
     id("kotlin-android")
     // The Flutter Gradle Plugin must be applied after the Android and Kotlin Gradle plugins.
     id("dev.flutter.flutter-gradle-plugin")
 }
 
+val keystoreProperties = Properties()
+val keystorePropertiesFile = rootProject.file("key.properties")
+val hasKeystoreProperties = keystorePropertiesFile.exists()
+val isReleaseBuildRequested = gradle.startParameter.taskNames.any {
+    it.contains("Release", ignoreCase = true)
+}
+
+if (hasKeystoreProperties) {
+    keystoreProperties.load(FileInputStream(keystorePropertiesFile))
+} else if (isReleaseBuildRequested) {
+    throw GradleException(
+        "Missing android/key.properties. Configure release signing before building release artifacts.",
+    )
+}
+
 android {
     namespace = "com.example.ailurus"
     compileSdk = flutter.compileSdkVersion
@@ -30,11 +48,22 @@ android {
         versionName = flutter.versionName
     }
 
+    signingConfigs {
+        if (hasKeystoreProperties) {
+            create("release") {
+                keyAlias = keystoreProperties["keyAlias"] as String
+                keyPassword = keystoreProperties["keyPassword"] as String
+                storeFile = file(keystoreProperties["storeFile"] as String)
+                storePassword = keystoreProperties["storePassword"] as String
+            }
+        }
+    }
+
     buildTypes {
         release {
-            // TODO: Add your own signing config for the release build.
-            // Signing with the debug keys for now, so `flutter run --release` works.
-            signingConfig = signingConfigs.getByName("debug")
+            if (hasKeystoreProperties) {
+                signingConfig = signingConfigs.getByName("release")
+            }
         }
     }
 }