mirror of
https://github.com/greenart7c3/Amber.git
synced 2026-10-30 06:47:33 +00:00
greenart7c3
0c0e1139c8
create-release.yml granted contents: write to the whole workflow and actions/checkout persisted that token in .git/config, so every Gradle plugin and dependency in assembleRelease (and the daemon it left running into the signing step) could read a repo-write token. The build and signing now run in a read-only job without persisted credentials or a daemon and hand the APK over as an artifact; a separate release job, which builds nothing, gets contents: write to publish it. Pre-release detection uses the same bash rule as desktop-release.yml instead of a third-party action, and every other checkout drops persisted credentials too.
88 lines
3.2 KiB
YAML
88 lines
3.2 KiB
YAML
name: Benchmark APK
|
|
|
|
# Builds the `benchmark` flavor APK on every push so the changes in each commit
|
|
# can be downloaded, installed, and reviewed. Built as a signed *release* APK
|
|
# (R8/minify enabled, not debuggable) so it has no debug overhead. The benchmark
|
|
# flavor uses a distinct applicationId suffix, so it installs side-by-side with a
|
|
# production build.
|
|
#
|
|
# It runs on every push to any branch, so it signs with a dedicated benchmark
|
|
# key (the BENCHMARK_* secrets), never the release key: unreviewed branch code
|
|
# must not get an APK signed with the production certificate.
|
|
|
|
on:
|
|
push:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
|
|
steps:
|
|
- name: Check benchmark signing secrets
|
|
env:
|
|
BENCHMARK_SIGNING_KEY: ${{ secrets.BENCHMARK_SIGNING_KEY }}
|
|
BENCHMARK_KEY_ALIAS: ${{ secrets.BENCHMARK_KEY_ALIAS }}
|
|
BENCHMARK_KEY_STORE_PASSWORD: ${{ secrets.BENCHMARK_KEY_STORE_PASSWORD }}
|
|
BENCHMARK_KEY_PASSWORD: ${{ secrets.BENCHMARK_KEY_PASSWORD }}
|
|
run: |
|
|
for name in BENCHMARK_SIGNING_KEY BENCHMARK_KEY_ALIAS BENCHMARK_KEY_STORE_PASSWORD BENCHMARK_KEY_PASSWORD; do
|
|
if [ -z "${!name}" ]; then
|
|
echo "::error::Missing the $name secret. The benchmark APK is signed with its own keystore, separate from the release key."
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
- name: Checkout source
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up JDK 21
|
|
uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
|
|
with:
|
|
distribution: 'temurin'
|
|
java-version: 21
|
|
|
|
- name: Cache Gradle
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
|
|
with:
|
|
path: |
|
|
~/.gradle/caches
|
|
~/.gradle/wrapper
|
|
key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gradle-
|
|
|
|
- name: Grant execute permission to Gradle wrapper
|
|
run: chmod +x ./gradlew
|
|
|
|
- name: Create keystore.properties
|
|
run: touch keystore.properties
|
|
|
|
- name: Build benchmark release APK
|
|
run: ./gradlew assembleBenchmarkRelease --no-daemon --stacktrace
|
|
|
|
- name: Sign benchmark APK
|
|
uses: r0adkll/sign-android-release@349ebdef58775b1e0d8099458af0816dc79b6407 # v1
|
|
with:
|
|
releaseDirectory: app/build/outputs/apk/benchmark/release
|
|
signingKeyBase64: ${{ secrets.BENCHMARK_SIGNING_KEY }}
|
|
alias: ${{ secrets.BENCHMARK_KEY_ALIAS }}
|
|
keyStorePassword: ${{ secrets.BENCHMARK_KEY_STORE_PASSWORD }}
|
|
keyPassword: ${{ secrets.BENCHMARK_KEY_PASSWORD }}
|
|
env:
|
|
BUILD_TOOLS_VERSION: "34.0.0"
|
|
|
|
- name: Upload benchmark APK
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
|
|
with:
|
|
name: amber-benchmark-${{ github.sha }}
|
|
path: app/build/outputs/apk/benchmark/release/app-benchmark-universal-release-unsigned-signed.apk
|
|
retention-days: 14
|
|
if-no-files-found: error
|