mirror of
https://github.com/greenart7c3/Amber.git
synced 2026-10-30 06:47:33 +00:00
greenart7c3
0c0e1139c8
create-release.yml granted contents: write to the whole workflow and actions/checkout persisted that token in .git/config, so every Gradle plugin and dependency in assembleRelease (and the daemon it left running into the signing step) could read a repo-write token. The build and signing now run in a read-only job without persisted credentials or a daemon and hand the APK over as an artifact; a separate release job, which builds nothing, gets contents: write to publish it. Pre-release detection uses the same bash rule as desktop-release.yml instead of a third-party action, and every other checkout drops persisted credentials too.
100 lines
3.6 KiB
YAML
100 lines
3.6 KiB
YAML
name: Create Release Assets
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10
|
|
|
|
# The build (Gradle plugins, every dependency) and the signing key only get a
|
|
# read-only token, which is not left in .git/config either; only the release
|
|
# job, which builds nothing, may write to the repository.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up JDK 21
|
|
uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
|
|
with:
|
|
distribution: 'temurin'
|
|
java-version: 21
|
|
|
|
- name: Cache gradle
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
|
|
with:
|
|
path: ~/.gradle/caches
|
|
key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gradle-
|
|
|
|
- name: Prepare F-Droid build (no self-update)
|
|
run: |
|
|
sed -i '/android.permission.REQUEST_INSTALL_PACKAGES/d' app/src/main/AndroidManifest.xml
|
|
sed -i 's/buildConfigField("boolean", "IS_FDROID_BUILD", "false")/buildConfigField("boolean", "IS_FDROID_BUILD", "true")/' app/build.gradle.kts
|
|
|
|
# --no-daemon: no Gradle process outlives the build into the signing step.
|
|
- name: Build APK
|
|
run: ./gradlew assembleRelease --no-daemon --stacktrace
|
|
|
|
- name: Sign free APK
|
|
uses: r0adkll/sign-android-release@349ebdef58775b1e0d8099458af0816dc79b6407 # v1
|
|
with:
|
|
releaseDirectory: app/build/outputs/apk/free/release
|
|
signingKeyBase64: ${{ secrets.SIGNING_KEY }}
|
|
alias: ${{ secrets.KEY_ALIAS }}
|
|
keyStorePassword: ${{ secrets.KEY_STORE_PASSWORD }}
|
|
keyPassword: ${{ secrets.KEY_PASSWORD }}
|
|
env:
|
|
# override default build-tools version (29.0.3) -- optional
|
|
BUILD_TOOLS_VERSION: "34.0.0"
|
|
|
|
- name: Rename APK for release asset
|
|
env:
|
|
RELEASE_TAG: ${{ github.ref_name }}
|
|
run: cp -- app/build/outputs/apk/free/release/app-free-universal-release-unsigned-signed.apk "amber-fdroid-universal-$RELEASE_TAG.apk"
|
|
|
|
- name: Keep the APK for the release job
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
|
|
with:
|
|
name: amber-fdroid-apk
|
|
path: amber-fdroid-universal-${{ github.ref_name }}.apk
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
|
|
release:
|
|
needs: build
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
|
|
with:
|
|
name: amber-fdroid-apk
|
|
|
|
# Same rule as desktop-release.yml, which races this job to create the
|
|
# release: a "-pre" tag is a pre-release.
|
|
- name: Detect a pre-release tag
|
|
id: prerelease
|
|
env:
|
|
TAG: ${{ github.ref_name }}
|
|
run: |
|
|
if [[ "$TAG" == *-pre* ]]; then echo "value=true" >> "$GITHUB_OUTPUT"; else echo "value=false" >> "$GITHUB_OUTPUT"; fi
|
|
|
|
- name: Create Release and Upload Asset
|
|
uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
tag_name: ${{ github.ref }}
|
|
name: Release ${{ github.ref }}
|
|
draft: false
|
|
prerelease: ${{ steps.prerelease.outputs.value == 'true' }}
|
|
files: amber-fdroid-universal-${{ github.ref_name }}.apk
|