chrisandClaude Opus 5.5
3b39910f13
Pushing a v* tag builds the normal and FOSS APKs, signed with the upload key, and attaches them to a Gitea release; a manual run on a branch uploads a test build to the repo's packages. Everything runs on the Gitea server: a builder image with the Android SDK, an act_runner registered only for this repo, and plain shell steps (no third-party actions). The build itself is apps/mobile/scripts/build-android.sh, the same script for hand builds. Setup steps are in docs/ANDROID-CI.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
103 lines
4.8 KiB
YAML
103 lines
4.8 KiB
YAML
# Builds the Android app on our own runner (deploy/gitea-runner) and publishes it.
|
|
#
|
|
# - Push a tag like v1.1.0: builds the normal and FOSS APKs, signed with the upload key,
|
|
# and attaches them to a Gitea release for that tag.
|
|
# - Actions > Android > Run workflow on a branch: a test build, uploaded to this repo's
|
|
# Packages (generic package "musicshare-android", version = branch + short commit).
|
|
#
|
|
# Uses only `run` steps (no third-party actions), inside the image from deploy/android-builder.
|
|
# Secrets (repo Settings > Actions > Secrets):
|
|
# UPLOAD_KEYSTORE_BASE64 the upload keystore, base64 -w0
|
|
# UPLOAD_STORE_PASSWORD, UPLOAD_KEY_ALIAS, UPLOAD_KEY_PASSWORD
|
|
# RELEASE_TOKEN an access token with write:repository and write:package
|
|
name: Android
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: musicshare-android
|
|
container:
|
|
image: musicshare-android-builder
|
|
# Keep Gradle and npm downloads between builds.
|
|
options: -v musicshare-gradle:/root/.gradle -v musicshare-npm:/root/.npm
|
|
timeout-minutes: 150
|
|
env:
|
|
SERVER: ${{ github.server_url }}
|
|
REPO: ${{ github.repository }}
|
|
REF_TYPE: ${{ github.ref_type }}
|
|
REF_NAME: ${{ github.ref_name }}
|
|
SHA: ${{ github.sha }}
|
|
GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx4g -Dorg.gradle.daemon=false
|
|
steps:
|
|
- name: Check out
|
|
env:
|
|
TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
git init -q src
|
|
cd src
|
|
git -c http.extraHeader="Authorization: token $TOKEN" fetch -q --depth 1 "$SERVER/$REPO.git" "$SHA"
|
|
git checkout -q FETCH_HEAD
|
|
|
|
- name: Check the version
|
|
working-directory: src
|
|
run: |
|
|
version=$(node -p "require('./apps/mobile/app.json').expo.version")
|
|
echo "app.json version: $version"
|
|
if [ "$REF_TYPE" = tag ] && [ "$REF_NAME" != "v$version" ]; then
|
|
echo "Tag $REF_NAME doesn't match app.json version $version; bump it (and android.versionCode) first." >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Install
|
|
working-directory: src
|
|
run: npm ci --workspace @musicshare/mobile --workspace @musicshare/shared --include-workspace-root --no-audit --no-fund
|
|
|
|
- name: Build
|
|
working-directory: src
|
|
env:
|
|
KEYSTORE: ${{ secrets.UPLOAD_KEYSTORE_BASE64 }}
|
|
ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_STORE_FILE: /tmp/upload.keystore
|
|
ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_STORE_PASSWORD: ${{ secrets.UPLOAD_STORE_PASSWORD }}
|
|
ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_ALIAS: ${{ secrets.UPLOAD_KEY_ALIAS }}
|
|
ORG_GRADLE_PROJECT_MUSICSHARE_UPLOAD_KEY_PASSWORD: ${{ secrets.UPLOAD_KEY_PASSWORD }}
|
|
REQUIRE_SIGNED: '1'
|
|
run: |
|
|
printf '%s' "$KEYSTORE" | base64 -d > /tmp/upload.keystore
|
|
trap 'rm -f /tmp/upload.keystore' EXIT
|
|
apps/mobile/scripts/build-android.sh "$PWD/out"
|
|
|
|
- name: Publish
|
|
working-directory: src/out
|
|
env:
|
|
TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
run: |
|
|
api="$SERVER/api/v1/repos/$REPO"
|
|
auth="Authorization: token $TOKEN"
|
|
if [ "$REF_TYPE" = tag ]; then
|
|
# Reuse the release if this tag was built before.
|
|
id=$(curl -fsS -H "$auth" "$api/releases/tags/$REF_NAME" 2>/dev/null | node -p 'JSON.parse(require("fs").readFileSync(0)).id' || true)
|
|
if [ -z "$id" ]; then
|
|
body=$(node -e 'console.log(JSON.stringify({ tag_name: process.argv[1], name: process.argv[1], body: "Android builds. musicshare-*-foss.apk has no closed-source code (no Google ML Kit)." }))' "$REF_NAME")
|
|
id=$(curl -fsS -X POST -H "$auth" -H 'Content-Type: application/json' -d "$body" "$api/releases" | node -p 'JSON.parse(require("fs").readFileSync(0)).id')
|
|
fi
|
|
for f in *.apk SHA256SUMS; do
|
|
old=$(curl -fsS -H "$auth" "$api/releases/$id/assets" | node -p 'JSON.parse(require("fs").readFileSync(0)).find(a => a.name === process.argv[1])?.id ?? ""' "$f")
|
|
[ -n "$old" ] && curl -fsS -X DELETE -H "$auth" "$api/releases/$id/assets/$old"
|
|
curl -fsS -X POST -H "$auth" -F "attachment=@$f" "$api/releases/$id/assets?name=$f" > /dev/null
|
|
echo "Attached $f"
|
|
done
|
|
echo "Release: $SERVER/$REPO/releases/tag/$REF_NAME"
|
|
else
|
|
owner=${REPO%%/*}
|
|
version="$(echo "$REF_NAME" | tr -c 'A-Za-z0-9._-\n' '-')-${SHA::8}"
|
|
for f in *.apk SHA256SUMS; do
|
|
curl -fsS -X PUT -H "$auth" --upload-file "$f" "$SERVER/api/packages/$owner/generic/musicshare-android/$version/$f"
|
|
echo "Uploaded $f"
|
|
done
|
|
echo "Package: $SERVER/$owner/-/packages/generic/musicshare-android/$version"
|
|
fi
|