mirror of
https://github.com/greenart7c3/Amber.git
synced 2026-10-30 06:47:33 +00:00
greenart7c3
0c0e1139c8
create-release.yml granted contents: write to the whole workflow and actions/checkout persisted that token in .git/config, so every Gradle plugin and dependency in assembleRelease (and the daemon it left running into the signing step) could read a repo-write token. The build and signing now run in a read-only job without persisted credentials or a daemon and hand the APK over as an artifact; a separate release job, which builds nothing, gets contents: write to publish it. Pre-release detection uses the same bash rule as desktop-release.yml instead of a third-party action, and every other checkout drops persisted credentials too.
53 lines
1.4 KiB
YAML
53 lines
1.4 KiB
YAML
name: Build All APKs
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout source
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up JDK 21
|
|
uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
|
|
with:
|
|
distribution: 'temurin'
|
|
java-version: 21
|
|
|
|
- name: Cache Gradle
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
|
|
with:
|
|
path: |
|
|
~/.gradle/caches
|
|
~/.gradle/wrapper
|
|
key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gradle-
|
|
|
|
- name: Grant execute permission to Gradle wrapper
|
|
run: chmod +x ./gradlew
|
|
|
|
- name: Clean project
|
|
run: ./gradlew clean
|
|
|
|
- name: Build AAB and APKs
|
|
run: |
|
|
./gradlew bundleFreeRelease bundleOfflineRelease assembleFreeRelease assembleOfflineRelease --stacktrace
|
|
|
|
- name: Upload all APKs as artifacts
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
|
|
with:
|
|
name: All-APKs-${{ github.ref_name }}
|
|
path: app/build/outputs/apk/**/release/*.apk
|
|
retention-days: 14
|