CI: check the signing secrets before building

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-15 11:15:14 -04:00
parent 3e92081424
commit 3c29f7327a
1 changed files with 15 additions and 0 deletions
@@ -68,6 +68,21 @@ jobs:
        run: |
          printf '%s' "$KEYSTORE" | base64 -d > /tmp/upload.keystore
          trap 'rm -f /tmp/upload.keystore' EXIT
+          # Check the signing secrets up front (without printing them) rather than 15 minutes in.
+          missing=
+          [ -n "$KEYSTORE" ] || missing="$missing UPLOAD_KEYSTORE_BASE64"
+          [ -n "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_STORE_PASSWORD" ] || missing="$missing UPLOAD_STORE_PASSWORD"
+          [ -n "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_ALIAS" ] || missing="$missing UPLOAD_KEY_ALIAS"
+          [ -n "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_PASSWORD" ] || missing="$missing UPLOAD_KEY_PASSWORD"
+          if [ -n "$missing" ]; then
+            echo "These secrets are empty or missing (repo Settings > Actions > Secrets, not Variables):$missing" >&2
+            exit 1
+          fi
+          if ! keytool -list -keystore /tmp/upload.keystore -storepass "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_STORE_PASSWORD" \
+              -alias "$ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_ALIAS" >/dev/null; then
+            echo "The keystore didn't open: check UPLOAD_KEYSTORE_BASE64, UPLOAD_STORE_PASSWORD and UPLOAD_KEY_ALIAS." >&2
+            exit 1
+          fi
          apps/mobile/scripts/build-android.sh "$PWD/out"

      - name: Publish