wallet/.github/workflows/ci-build.yml at 5f0c1f61937d33796c134b2db4b6a840a87fb797 · oasisprotocol/wallet · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
# NOTE: This name appears in GitHub's Checks API and in workflow's status badge.
name: ci-build

# Trigger the workflow when:
on:
  # A push occurs to one of the matched branches.
  push:
    branches:
      - master
      - stable/*
  # Or when a pull request event occurs for a pull request against one of the
  # matched branches.
  pull_request:
    branches:
      - master
      - stable/*

# Explicitly disable secrets.GITHUB_TOKEN permissions.
permissions: {}

jobs:
  build:
    # NOTE: This name appears in GitHub's Checks API.
    name: build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          # Needed for correct git commit count
          fetch-depth: 0
      - name: Set up OpenJDK 21
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '21'
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24.x'
          cache: yarn
      - name: Install dependencies
        run: yarn install --frozen-lockfile
      - name: Set workflow variables
        # Id is needed to access output in a next step.
        id: vars
        run: |
          echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
          echo "VERSION_CODE_OVERRIDE=$(node ./internals/scripts/getVersionCode.js)" >> "$GITHUB_OUTPUT"
      - name: Build web ROSE Wallet
        run: yarn build
      - name: Build extension ROSE Wallet
        run: yarn build:ext
      - name: Sync Capacitor for Android
        if: github.event_name == 'push'
        run: yarn cap sync android
      - name: Accept SDK licenses
        if: github.event_name == 'push'
        run: yes | "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager" --licenses
      # Capacitor v8 targets SDK 36
      - name: Install SDK components
        if: github.event_name == 'push'
        run: |
          "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager" "platform-tools" "platforms;android-36" "build-tools;36.0.0"
      - name: Build Android App Bundle (AAB)
        if: github.event_name == 'push'
        run: ./gradlew bundleRelease -PversionCodeOverride=${{ steps.vars.outputs.VERSION_CODE_OVERRIDE }}
        working-directory: android
      - name: Build Android Package (APK)
        if: github.event_name == 'push'
        run: ./gradlew assembleRelease -PversionCodeOverride=${{ steps.vars.outputs.VERSION_CODE_OVERRIDE }}
        working-directory: android
      # Targeting version 30 and above we need to align the APK so that all uncompressed data starts on a 4-byte boundary
      - name: Zipalign APK
        if: github.event_name == 'push'
        run: |
          "$ANDROID_SDK_ROOT/build-tools/36.0.0/zipalign" -v 4 "android/app/build/outputs/apk/release/app-release-unsigned.apk" "android/app/build/outputs/apk/release/app-release-aligned.apk"
      - name: Decode and Save Keystore File
        if: github.event_name == 'push'
        run: |
          echo "${{ secrets.KEYSTORE_FILE }}" | base64 --decode > "android/release.jks"
      - name: Sign AAB and APK
        # Security: should not sign apks on unmerged pullrequest. Otherwise someone
        # could sign a malicious app and distribute it with our valid signature (though
        # outside playstore).
        if: github.event_name == 'push'
        run: |
          jarsigner -verbose -keystore "android/release.jks" -storepass "${{ secrets.KEYSTORE_PASSWORD }}" -keypass "${{ secrets.KEYSTORE_PASSWORD }}" -signedjar "android/app/build/outputs/bundle/release/app-release-signed.aab" "android/app/build/outputs/bundle/release/app-release.aab" "${{ secrets.KEY_ALIAS }}"
          "$ANDROID_SDK_ROOT/build-tools/36.0.0/apksigner" sign --ks "android/release.jks" --ks-pass "pass:${{ secrets.KEYSTORE_PASSWORD }}" --key-pass "pass:${{ secrets.KEYSTORE_PASSWORD }}" --ks-key-alias "${{ secrets.KEY_ALIAS }}" "android/app/build/outputs/apk/release/app-release-aligned.apk"
      - name: Upload Android AAB build artifacts
        if: github.event_name == 'push'
        uses: actions/upload-artifact@v4
        with:
          name: rose-wallet-android-${{ steps.vars.outputs.SHORT_SHA }}.aab
          path: android/app/build/outputs/bundle/release/app-release-signed.aab
      - name: Upload Android APK build artifacts
        if: github.event_name == 'push'
        uses: actions/upload-artifact@v4
        with:
          name: rose-wallet-android-${{ steps.vars.outputs.SHORT_SHA }}.apk
          path: android/app/build/outputs/apk/release/app-release-aligned.apk
      - name: Upload web ROSE Wallet build artifacts
        if: github.event_name == 'push'
        uses: actions/upload-artifact@v4
        with:
          name: rose-wallet-web-${{ steps.vars.outputs.SHORT_SHA }}
          path: build
      - name: Upload extension ROSE Wallet build artifacts
        if: github.event_name == 'push'
        uses: actions/upload-artifact@v4
        with:
          name: rose-wallet-ext-${{ steps.vars.outputs.SHORT_SHA }}
          path: build-ext