Build the Android app on our own Gitea runner

Pushing a v* tag builds the normal and FOSS APKs, signed with the upload key, and attaches them to a Gitea release; a manual run on a branch uploads a test build to the repo's packages. Everything runs on the Gitea server: a builder image with the Android SDK, an act_runner registered only for this repo, and plain shell steps (no third-party actions). The build itself is apps/mobile/scripts/build-android.sh, the same script for hand builds. Setup steps are in docs/ANDROID-CI.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-14 21:28:52 -04:00
parent 68ec5a8d99
commit 3b39910f13
7 changed files with 316 additions and 0 deletions
@@ -0,0 +1,102 @@
+# Builds the Android app on our own runner (deploy/gitea-runner) and publishes it.
+#
+#   - Push a tag like v1.1.0: builds the normal and FOSS APKs, signed with the upload key,
+#     and attaches them to a Gitea release for that tag.
+#   - Actions > Android > Run workflow on a branch: a test build, uploaded to this repo's
+#     Packages (generic package "musicshare-android", version = branch + short commit).
+#
+# Uses only `run` steps (no third-party actions), inside the image from deploy/android-builder.
+# Secrets (repo Settings > Actions > Secrets):
+#   UPLOAD_KEYSTORE_BASE64  the upload keystore, base64 -w0
+#   UPLOAD_STORE_PASSWORD, UPLOAD_KEY_ALIAS, UPLOAD_KEY_PASSWORD
+#   RELEASE_TOKEN           an access token with write:repository and write:package
+name: Android
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: musicshare-android
+    container:
+      image: musicshare-android-builder
+      # Keep Gradle and npm downloads between builds.
+      options: -v musicshare-gradle:/root/.gradle -v musicshare-npm:/root/.npm
+    timeout-minutes: 150
+    env:
+      SERVER: ${{ github.server_url }}
+      REPO: ${{ github.repository }}
+      REF_TYPE: ${{ github.ref_type }}
+      REF_NAME: ${{ github.ref_name }}
+      SHA: ${{ github.sha }}
+      GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx4g -Dorg.gradle.daemon=false
+    steps:
+      - name: Check out
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git init -q src
+          cd src
+          git -c http.extraHeader="Authorization: token $TOKEN" fetch -q --depth 1 "$SERVER/$REPO.git" "$SHA"
+          git checkout -q FETCH_HEAD
+
+      - name: Check the version
+        working-directory: src
+        run: |
+          version=$(node -p "require('./apps/mobile/app.json').expo.version")
+          echo "app.json version: $version"
+          if [ "$REF_TYPE" = tag ] && [ "$REF_NAME" != "v$version" ]; then
+            echo "Tag $REF_NAME doesn't match app.json version $version; bump it (and android.versionCode) first." >&2
+            exit 1
+          fi
+
+      - name: Install
+        working-directory: src
+        run: npm ci --workspace @musicshare/mobile --workspace @musicshare/shared --include-workspace-root --no-audit --no-fund
+
+      - name: Build
+        working-directory: src
+        env:
+          KEYSTORE: ${{ secrets.UPLOAD_KEYSTORE_BASE64 }}
+          ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_STORE_FILE: /tmp/upload.keystore
+          ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_STORE_PASSWORD: ${{ secrets.UPLOAD_STORE_PASSWORD }}
+          ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_ALIAS: ${{ secrets.UPLOAD_KEY_ALIAS }}
+          ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_PASSWORD: ${{ secrets.UPLOAD_KEY_PASSWORD }}
+          REQUIRE_SIGNED: '1'
+        run: |
+          printf '%s' "$KEYSTORE" | base64 -d > /tmp/upload.keystore
+          trap 'rm -f /tmp/upload.keystore' EXIT
+          apps/mobile/scripts/build-android.sh "$PWD/out"
+
+      - name: Publish
+        working-directory: src/out
+        env:
+          TOKEN: ${{ secrets.RELEASE_TOKEN }}
+        run: |
+          api="$SERVER/api/v1/repos/$REPO"
+          auth="Authorization: token $TOKEN"
+          if [ "$REF_TYPE" = tag ]; then
+            # Reuse the release if this tag was built before.
+            id=$(curl -fsS -H "$auth" "$api/releases/tags/$REF_NAME" 2>/dev/null | node -p 'JSON.parse(require("fs").readFileSync(0)).id' || true)
+            if [ -z "$id" ]; then
+              body=$(node -e 'console.log(JSON.stringify({ tag_name: process.argv[1], name: process.argv[1], body: "Android builds. musicshare-*-foss.apk has no closed-source code (no Google ML Kit)." }))' "$REF_NAME")
+              id=$(curl -fsS -X POST -H "$auth" -H 'Content-Type: application/json' -d "$body" "$api/releases" | node -p 'JSON.parse(require("fs").readFileSync(0)).id')
+            fi
+            for f in *.apk SHA256SUMS; do
+              old=$(curl -fsS -H "$auth" "$api/releases/$id/assets" | node -p 'JSON.parse(require("fs").readFileSync(0)).find(a => a.name === process.argv[1])?.id ?? ""' "$f")
+              [ -n "$old" ] && curl -fsS -X DELETE -H "$auth" "$api/releases/$id/assets/$old"
+              curl -fsS -X POST -H "$auth" -F "attachment=@$f" "$api/releases/$id/assets?name=$f" > /dev/null
+              echo "Attached $f"
+            done
+            echo "Release: $SERVER/$REPO/releases/tag/$REF_NAME"
+          else
+            owner=${REPO%%/*}
+            version="$(echo "$REF_NAME" | tr -c 'A-Za-z0-9._-\n' '-')-${SHA::8}"
+            for f in *.apk SHA256SUMS; do
+              curl -fsS -X PUT -H "$auth" --upload-file "$f" "$SERVER/api/packages/$owner/generic/musicshare-android/$version/$f"
+              echo "Uploaded $f"
+            done
+            echo "Package: $SERVER/$owner/-/packages/generic/musicshare-android/$version"
+          fi