a8a83a39d0
All checks were successful
Reviewed-on: https://codeberg.org/jlmakiola/calendula/pulls/126
656 lines
31 KiB
YAML
656 lines
31 KiB
YAML
name: Release — F-Droid repo + Gitea/Codeberg release + Play
|
|
|
|
# A release is cut by merging a release branch into main with a bumped
|
|
# versionName (see docs/RELEASING.md). This workflow reads that versionName and,
|
|
# if no matching tag exists yet, runs tests, builds + signs the APK, publishes
|
|
# it to the F-Droid repo, creates the vX.Y.Z tag + Gitea release, and mirrors
|
|
# that release to Codeberg with the signed APK + a SHA-256 checksum as a
|
|
# direct-download channel — the tag is an output of the pipeline, not its
|
|
# trigger. Ordinary merges (no version bump) fall through `detect` and do
|
|
# nothing.
|
|
#
|
|
# A trailing `play` job then uploads the App Bundle to Google Play. It is last
|
|
# and separate because Play is the only channel that can reject a good build for
|
|
# reasons the pipeline can't see, and that must not endanger a release which has
|
|
# already shipped to F-Droid and Codeberg. It skips cleanly until the
|
|
# PLAY_SERVICE_ACCOUNT_JSON secret exists.
|
|
#
|
|
# A manual workflow_dispatch (from a branch) runs the re-sign-only recovery
|
|
# path: it re-signs the existing F-Droid index with the repo key and re-uploads,
|
|
# without building an APK or creating a release. Used for key rotation / repo
|
|
# recovery.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: release
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
# Cheap gate: resolve the version from the committed build.gradle and decide
|
|
# whether this push actually cuts a new release (no tag for it yet). Keeps the
|
|
# heavy job from running on every merge to main.
|
|
detect:
|
|
# Gitea only. The workflow directory split already keeps this file invisible
|
|
# to Codeberg — Forgejo's lookup is first-match-wins, and .forgejo/workflows
|
|
# exists — but that only holds while .forgejo/ is non-empty. Move the last
|
|
# file out of it and Codeberg would fall back to .gitea/workflows and start
|
|
# running the release pipeline on the contributor-facing runner, with no
|
|
# secrets. repository_owner differs between the two forges regardless of
|
|
# URL, proxy or instance rename, so this closes it permanently.
|
|
if: github.repository_owner == 'makiolaj'
|
|
runs-on: docker
|
|
outputs:
|
|
is_release: ${{ steps.v.outputs.is_release }}
|
|
version: ${{ steps.v.outputs.version }}
|
|
version_code: ${{ steps.v.outputs.version_code }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
submodules: recursive
|
|
|
|
- name: Resolve version and whether it is a new release
|
|
id: v
|
|
env:
|
|
# Tags are read from Codeberg, which is canonical — deliberately NOT
|
|
# from the Gitea API this workflow runs on. The Codeberg -> Gitea sync
|
|
# is a push mirror, i.e. `git push --mirror`, which deletes refs the
|
|
# source does not have. A tag minted here on Gitea is therefore wiped
|
|
# by the next sync (Codeberg does not have it yet) and only reappears
|
|
# once the tag push at the end of this workflow propagates back.
|
|
# Asking Gitea inside that window would report "no tag" for a release
|
|
# that already shipped, and cut it a second time.
|
|
# Public repo, so this read needs no token.
|
|
TAG_API: https://codeberg.org/api/v1/repos/jlmakiola/calendula
|
|
run: |
|
|
set -e
|
|
VERSION=$(grep -oP 'versionName\s*=\s*"\K[^"]+' app/build.gradle.kts)
|
|
if [ -z "$VERSION" ]; then echo "No versionName in app/build.gradle.kts" >&2; exit 1; fi
|
|
MAJOR=$(echo "$VERSION" | cut -d. -f1); MINOR=$(echo "$VERSION" | cut -d. -f2); PATCH=$(echo "$VERSION" | cut -d. -f3)
|
|
MAJOR=${MAJOR:-0}; MINOR=${MINOR:-0}; PATCH=${PATCH:-0}
|
|
VERSION_CODE=$(( MAJOR * 10000 + MINOR * 100 + PATCH ))
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
echo "version_code=$VERSION_CODE" >> "$GITHUB_OUTPUT"
|
|
echo "Resolved version $VERSION (code $VERSION_CODE)"
|
|
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
|
|
echo "Manual dispatch — re-sign path, not a release."
|
|
echo "is_release=false" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
# A tag for this version already existing means the release shipped on
|
|
# an earlier push; do nothing. Absent => this merge cuts the release.
|
|
#
|
|
# Anything other than a clean 200/404 is treated as fatal rather than
|
|
# as "no tag". A Codeberg outage or a network blip would otherwise
|
|
# read as absent and re-cut a release that has already shipped —
|
|
# republishing to F-Droid and Play. Failing here is recoverable; a
|
|
# duplicate release is not.
|
|
STATUS=$(curl -s -o /dev/null -w '%{http_code}' "$TAG_API/git/refs/tags/v$VERSION" || echo 000)
|
|
case "$STATUS" in
|
|
200)
|
|
echo "Tag v$VERSION already exists on Codeberg — nothing to release."
|
|
echo "is_release=false" >> "$GITHUB_OUTPUT"
|
|
;;
|
|
404)
|
|
echo "No tag for v$VERSION on Codeberg yet — cutting the release."
|
|
echo "is_release=true" >> "$GITHUB_OUTPUT"
|
|
;;
|
|
*)
|
|
echo "Codeberg tag lookup for v$VERSION returned HTTP $STATUS." >&2
|
|
echo "Refusing to guess: treating this as 'no tag' could re-cut a shipped release." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
# Releases: build + sign + publish, then mint the tag and Gitea release.
|
|
# Also runs on manual dispatch, where it skips the build and just re-signs and
|
|
# re-uploads the existing index (recovery path).
|
|
release:
|
|
needs: detect
|
|
if: needs.detect.outputs.is_release == 'true' || github.event_name == 'workflow_dispatch'
|
|
runs-on: docker
|
|
env:
|
|
ANDROID_HOME: /opt/android-sdk
|
|
ANDROID_SDK_ROOT: /opt/android-sdk
|
|
VERSION: ${{ needs.detect.outputs.version }}
|
|
VERSION_CODE: ${{ needs.detect.outputs.version_code }}
|
|
IS_RELEASE: ${{ needs.detect.outputs.is_release }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
submodules: recursive
|
|
|
|
- name: Setup Java
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
distribution: 'zulu'
|
|
java-version: '17'
|
|
|
|
- name: Setup Android SDK
|
|
uses: android-actions/setup-android@v3
|
|
with:
|
|
packages: ''
|
|
|
|
- name: Setup Android SDK cache
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: /opt/android-sdk
|
|
key: ${{ runner.os }}-android-sdk-37-36.0.0
|
|
|
|
- name: Install Android SDK packages
|
|
run: |
|
|
yes | sdkmanager --licenses >/dev/null || true
|
|
sdkmanager \
|
|
"platform-tools" \
|
|
"platforms;android-37.0" \
|
|
"build-tools;36.0.0"
|
|
|
|
- name: Setup Gradle cache
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.gradle/caches
|
|
~/.gradle/wrapper
|
|
key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'gradle/libs.versions.toml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gradle-
|
|
|
|
- name: Install jq
|
|
run: |
|
|
set -e
|
|
SUDO=""
|
|
if command -v sudo >/dev/null 2>&1; then SUDO="sudo"; fi
|
|
if command -v apt-get >/dev/null 2>&1; then
|
|
$SUDO apt-get update
|
|
$SUDO apt-get install -y jq
|
|
elif command -v apk >/dev/null 2>&1; then
|
|
$SUDO apk add --no-cache jq
|
|
fi
|
|
|
|
- name: Grant execute permission for gradlew
|
|
run: chmod +x ./gradlew
|
|
|
|
# The committed versionName is the source of truth. Pin versionCode to the
|
|
# value derived from it so the published APK's code is always
|
|
# MAJOR*10000 + MINOR*100 + PATCH even if the committed code was forgotten.
|
|
- name: Pin versionCode to versionName
|
|
if: env.IS_RELEASE == 'true'
|
|
run: |
|
|
set -e
|
|
sed -i "s/versionCode = .*/versionCode = $VERSION_CODE/" app/build.gradle.kts
|
|
grep -E 'versionName|versionCode' app/build.gradle.kts
|
|
|
|
# Test the exact commit being shipped (only on a real release).
|
|
- name: Unit tests
|
|
if: env.IS_RELEASE == 'true'
|
|
run: ./gradlew testDebugUnitTest
|
|
|
|
- name: Setup Android Keystore
|
|
if: env.IS_RELEASE == 'true'
|
|
env:
|
|
KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
|
|
KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
|
|
KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
|
|
run: |
|
|
mkdir -p app
|
|
echo "$KEYSTORE_BASE64" | base64 --decode > app/upload-keystore.jks
|
|
cat > key.properties <<EOF
|
|
storePassword=$KEY_PASSWORD
|
|
keyPassword=$KEY_PASSWORD
|
|
keyAlias=$KEY_ALIAS
|
|
storeFile=upload-keystore.jks
|
|
EOF
|
|
|
|
- name: Build release APK
|
|
if: env.IS_RELEASE == 'true'
|
|
run: ./gradlew assembleRelease
|
|
|
|
- name: Setup F-Droid Server Tools
|
|
run: |
|
|
SUDO=""
|
|
if command -v sudo >/dev/null 2>&1; then SUDO="sudo"; fi
|
|
$SUDO apt-get update
|
|
$SUDO apt-get install -y sshpass python3-pip
|
|
pip3 install --break-system-packages --upgrade fdroidserver
|
|
|
|
- name: Fetch existing F-Droid repo from Hetzner
|
|
env:
|
|
HOST: ${{ secrets.HETZNER_HOST }}
|
|
USER: ${{ secrets.HETZNER_USER }}
|
|
PASS: ${{ secrets.HETZNER_PASS }}
|
|
run: |
|
|
set -euo pipefail
|
|
SSH_OPTS="-o StrictHostKeyChecking=no -o ConnectTimeout=20"
|
|
mkdir -p fdroid
|
|
# Pull only the published repo/ (all apps' APKs), any per-app
|
|
# metadata, and the repo icon — enough to rebuild the index without
|
|
# dropping the other apps. The signing key is deliberately NOT pulled
|
|
# from the box; it comes from CI secrets in the next step so it never
|
|
# has to live in the web-served tree.
|
|
sshpass -p "$PASS" scp $SSH_OPTS -r "$USER@$HOST:dev/fdroid/repo" fdroid/ 2>/dev/null || true
|
|
sshpass -p "$PASS" scp $SSH_OPTS -r "$USER@$HOST:dev/fdroid/metadata" fdroid/ 2>/dev/null || true
|
|
sshpass -p "$PASS" scp $SSH_OPTS "$USER@$HOST:dev/fdroid/icon.png" fdroid/ 2>/dev/null || true
|
|
mkdir -p fdroid/repo fdroid/metadata
|
|
|
|
- name: Restore F-Droid signing key and config from secrets
|
|
env:
|
|
FDROID_KEYSTORE_BASE64: ${{ secrets.FDROID_KEYSTORE_BASE64 }}
|
|
FDROID_CONFIG_BASE64: ${{ secrets.FDROID_CONFIG_BASE64 }}
|
|
run: |
|
|
set -euo pipefail
|
|
# Fail loudly if the repo key is not configured. NEVER auto-generate
|
|
# one: a fresh key changes the repo fingerprint and breaks every
|
|
# user's pinned repo.
|
|
if [ -z "${FDROID_KEYSTORE_BASE64:-}" ] || [ -z "${FDROID_CONFIG_BASE64:-}" ]; then
|
|
echo "ERROR: FDROID_KEYSTORE_BASE64 / FDROID_CONFIG_BASE64 secrets are not set." >&2
|
|
echo "Refusing to continue — will not auto-generate a new repo key." >&2
|
|
exit 1
|
|
fi
|
|
echo "$FDROID_KEYSTORE_BASE64" | base64 --decode > fdroid/keystore.p12
|
|
echo "$FDROID_CONFIG_BASE64" | base64 --decode > fdroid/config.yml
|
|
test -s fdroid/keystore.p12
|
|
test -s fdroid/config.yml
|
|
mkdir -p fdroid/repo/icons
|
|
|
|
- name: Copy new APK to repo
|
|
if: env.IS_RELEASE == 'true'
|
|
run: |
|
|
set -e
|
|
mkdir -p fdroid/repo
|
|
cp app/build/outputs/apk/release/app-release.apk "fdroid/repo/calendula_v${VERSION}.apk"
|
|
|
|
# Per-version "What's New": ensure this version's changelog exists in the
|
|
# fastlane tree. The committed hand-written summary (kept under Play's
|
|
# 500-char cap) is used as-is; only if it is missing does the script fall
|
|
# back to CHANGELOG.md, so the self-hosted repo never depends on the
|
|
# commit having happened. The transform below then carries it across.
|
|
- name: Ensure this version's changelog is in the fastlane tree
|
|
if: env.IS_RELEASE == 'true'
|
|
run: bash scripts/sync_changelog_to_fastlane.sh
|
|
|
|
- name: Build F-Droid metadata from fastlane (single source of truth)
|
|
run: |
|
|
mkdir -p fdroid/metadata
|
|
# App-level control file (Categories/License/links) for the self-hosted
|
|
# repo's `fdroid update`.
|
|
cp fdroid-metadata/de.jeanlucmakiola.calendula.yml fdroid/metadata/
|
|
# Localized text + graphics + per-version changelogs come from the SAME
|
|
# fastlane tree the official F-Droid repo harvests from source,
|
|
# transformed into the F-Droid repo "localized" layout. One source of
|
|
# truth, both channels.
|
|
bash scripts/fastlane_to_fdroid_localized.sh \
|
|
fastlane/metadata/android \
|
|
fdroid/metadata/de.jeanlucmakiola.calendula
|
|
|
|
- name: Generate F-Droid Index
|
|
run: |
|
|
cd fdroid
|
|
fdroid update -c
|
|
|
|
- name: Upload repo/ to Hetzner
|
|
env:
|
|
HOST: ${{ secrets.HETZNER_HOST }}
|
|
USER: ${{ secrets.HETZNER_USER }}
|
|
PASS: ${{ secrets.HETZNER_PASS }}
|
|
run: |
|
|
set -euo pipefail
|
|
SSH_OPTS="-o StrictHostKeyChecking=no -o ConnectTimeout=20"
|
|
sshpass -p "$PASS" sftp $SSH_OPTS "$USER@$HOST" <<'SFTP'
|
|
-mkdir dev
|
|
-mkdir dev/fdroid
|
|
SFTP
|
|
# Publish the signed repo/ plus metadata/ (descriptions, screenshots,
|
|
# per-version changelogs) so changelog history survives across
|
|
# releases. keystore.p12 and config.yml are NEVER uploaded.
|
|
sshpass -p "$PASS" scp $SSH_OPTS -r fdroid/repo fdroid/metadata "$USER@$HOST:dev/fdroid/"
|
|
|
|
# The APK is published and the index re-signed — now record the release.
|
|
# Creating it with target_commitish makes Gitea create the vX.Y.Z tag at
|
|
# this commit, so the tag only ever marks a fully-shipped release (and a
|
|
# failure before here leaves no tag, so re-running the workflow retries).
|
|
- name: Create tag + Gitea release
|
|
if: env.IS_RELEASE == 'true'
|
|
env:
|
|
TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
|
|
SHA: ${{ github.sha }}
|
|
run: |
|
|
set -e
|
|
TAG="v$VERSION"
|
|
# Notes = this version's CHANGELOG section.
|
|
awk -v ver="$VERSION" '
|
|
$0 ~ "^## \\[" ver "\\]" { flag = 1; next }
|
|
/^## \[/ { flag = 0 }
|
|
flag' CHANGELOG.md > release-notes.md
|
|
sed -i -e '/./,$!d' release-notes.md
|
|
if [ ! -s release-notes.md ]; then
|
|
echo "_No changelog entry for ${VERSION} — see CHANGELOG.md._" > release-notes.md
|
|
fi
|
|
python3 - "$TAG" "$SHA" <<'PY' > payload.json
|
|
import json, sys
|
|
print(json.dumps({
|
|
"tag_name": sys.argv[1],
|
|
"target_commitish": sys.argv[2],
|
|
"name": sys.argv[1],
|
|
"body": open("release-notes.md").read(),
|
|
"draft": False,
|
|
"prerelease": False,
|
|
}))
|
|
PY
|
|
# Upsert (re-run safe): PATCH if a release for the tag already exists,
|
|
# else POST a new one (which also creates the tag at target_commitish).
|
|
curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" > existing.json
|
|
ID=$(jq -r '.id // empty' existing.json 2>/dev/null || true)
|
|
if [ -n "$ID" ]; then
|
|
CODE=$(curl -s -o response.json -w '%{http_code}' -X PATCH \
|
|
-H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
|
|
-d @payload.json "$API/releases/$ID")
|
|
OK=200
|
|
else
|
|
CODE=$(curl -s -o response.json -w '%{http_code}' -X POST \
|
|
-H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
|
|
-d @payload.json "$API/releases")
|
|
OK=201
|
|
fi
|
|
cat response.json
|
|
if [ "$CODE" != "$OK" ]; then
|
|
echo "Release upsert failed with HTTP $CODE (expected $OK)" >&2
|
|
exit 1
|
|
fi
|
|
echo "Created/updated release $TAG at $SHA"
|
|
|
|
# Archive the R8 mapping so user crash stacktraces stay deobfuscatable.
|
|
# Attached to the release (it's not an APK, so it fits the no-binaries
|
|
# rule). Best-effort: never fail a release over it.
|
|
- name: Attach R8 mapping to Gitea release
|
|
if: env.IS_RELEASE == 'true'
|
|
continue-on-error: true
|
|
env:
|
|
TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
|
|
run: |
|
|
set -e
|
|
MAP="app/build/outputs/mapping/release/mapping.txt"
|
|
if [ ! -f "$MAP" ]; then echo "No mapping.txt (R8 off?) — skipping."; exit 0; fi
|
|
TAG="v$VERSION"
|
|
ASSET="mapping-${VERSION}.txt.gz"
|
|
gzip -c "$MAP" > "/tmp/$ASSET"
|
|
ID=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" | jq -r '.id // empty')
|
|
if [ -z "$ID" ]; then echo "Could not resolve release id — skipping."; exit 0; fi
|
|
# Replace any prior asset of the same name (re-run safe).
|
|
OLD=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/$ID/assets" \
|
|
| jq -r --arg n "$ASSET" '.[] | select(.name==$n) | .id')
|
|
[ -n "$OLD" ] && curl -s -X DELETE -H "Authorization: token $TOKEN" "$API/releases/$ID/assets/$OLD" >/dev/null || true
|
|
curl -s -X POST -H "Authorization: token $TOKEN" \
|
|
-F "attachment=@/tmp/$ASSET" \
|
|
"$API/releases/$ID/assets?name=$ASSET" -o /dev/null -w "asset upload HTTP %{http_code}\n"
|
|
|
|
# Mirror the release to the Codeberg mirror as a direct-download channel
|
|
# for users who don't want F-Droid. Gitea already push-mirrors branches +
|
|
# tags to Codeberg, but releases aren't git objects so they don't sync —
|
|
# we create the release there over the API and attach the signed APK plus
|
|
# a SHA-256 checksum. The APK is identical to the F-Droid one (same app
|
|
# key), so this adds no trust surface. Best-effort: a Codeberg outage
|
|
# (it 504s under load) must never fail an already-published F-Droid
|
|
# release. Needs the CODEBERG_RELEASE_TOKEN secret; skips cleanly if unset.
|
|
- name: Publish release to Codeberg
|
|
if: env.IS_RELEASE == 'true'
|
|
continue-on-error: true
|
|
env:
|
|
TOKEN: ${{ secrets.CODEBERG_RELEASE_TOKEN }}
|
|
API: https://codeberg.org/api/v1/repos/jlmakiola/calendula
|
|
SHA: ${{ github.sha }}
|
|
run: |
|
|
set -e
|
|
if [ -z "${TOKEN:-}" ]; then
|
|
echo "CODEBERG_RELEASE_TOKEN not set — skipping Codeberg publish."
|
|
exit 0
|
|
fi
|
|
TAG="v$VERSION"
|
|
APK="app/build/outputs/apk/release/app-release.apk"
|
|
if [ ! -f "$APK" ]; then echo "No release APK found — skipping." >&2; exit 1; fi
|
|
ASSET_APK="calendula_v${VERSION}.apk"
|
|
ASSET_SUM="${ASSET_APK}.sha256"
|
|
cp "$APK" "/tmp/$ASSET_APK"
|
|
( cd /tmp && sha256sum "$ASSET_APK" > "$ASSET_SUM" )
|
|
|
|
# Release notes: reuse the section extracted for the Gitea release,
|
|
# fall back to the CHANGELOG entry if that step's file is gone.
|
|
if [ ! -s release-notes.md ]; then
|
|
awk -v ver="$VERSION" '
|
|
$0 ~ "^## \\[" ver "\\]" { flag = 1; next }
|
|
/^## \[/ { flag = 0 }
|
|
flag' CHANGELOG.md > release-notes.md
|
|
sed -i -e '/./,$!d' release-notes.md
|
|
fi
|
|
[ -s release-notes.md ] || echo "_See CHANGELOG.md for ${VERSION}._" > release-notes.md
|
|
# The pipeline creates the tag via the Gitea API, which the push mirror
|
|
# (sync_on_commit only fires on real git pushes) doesn't propagate
|
|
# promptly — so a release POST that carries a target_commitish can
|
|
# outrun the mirror and 500 on a commit/tag Codeberg hasn't received.
|
|
# Push the tag straight to Codeberg so it's guaranteed present, then
|
|
# attach the release to that existing tag with NO target_commitish
|
|
# (which is what triggered the 500).
|
|
git tag -f "$TAG" "$SHA"
|
|
git push -f "https://jlmakiola:${TOKEN}@codeberg.org/jlmakiola/calendula.git" \
|
|
"refs/tags/$TAG"
|
|
python3 - "$TAG" <<'PY' > cb-payload.json
|
|
import json, sys
|
|
print(json.dumps({
|
|
"tag_name": sys.argv[1],
|
|
"name": sys.argv[1],
|
|
"body": open("release-notes.md").read(),
|
|
"draft": False,
|
|
"prerelease": False,
|
|
}))
|
|
PY
|
|
# Create (or update) the release. Codeberg 500s on a POST/GET against a
|
|
# tag it has only just received — the release request outruns the
|
|
# indexing of the ref we pushed a moment ago — so a single attempt kept
|
|
# failing and skipping the mirror even though the very same call
|
|
# succeeds seconds later. Retry with backoff, and PATCH in place if a
|
|
# release already exists (re-run safe). A 5xx body still exits curl 0,
|
|
# so the loop, not `set -e`, controls the flow.
|
|
ID=""
|
|
for attempt in 1 2 3 4 5 6; do
|
|
EXIST=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" | jq -r '.id // empty' 2>/dev/null || true)
|
|
if [ -n "$EXIST" ]; then
|
|
curl -s -o /dev/null -w "release PATCH HTTP %{http_code}\n" -X PATCH \
|
|
-H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
|
|
-d @cb-payload.json "$API/releases/$EXIST"
|
|
ID="$EXIST"; break
|
|
fi
|
|
CODE=$(curl -s -o cb-response.json -w "%{http_code}" -X POST \
|
|
-H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
|
|
-d @cb-payload.json "$API/releases")
|
|
echo "release POST attempt $attempt HTTP $CODE"
|
|
ID=$(jq -r '.id // empty' cb-response.json 2>/dev/null || true)
|
|
[ -n "$ID" ] && break
|
|
sleep $((attempt * 10))
|
|
done
|
|
if [ -z "$ID" ]; then echo "Could not resolve Codeberg release id after retries." >&2; exit 1; fi
|
|
|
|
# Attach APK + checksum, replacing any prior asset of the same name.
|
|
for A in "$ASSET_APK" "$ASSET_SUM"; do
|
|
OLD=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/$ID/assets" \
|
|
| jq -r --arg n "$A" '.[] | select(.name==$n) | .id')
|
|
[ -n "$OLD" ] && curl -s -X DELETE -H "Authorization: token $TOKEN" "$API/releases/$ID/assets/$OLD" >/dev/null || true
|
|
curl -s -X POST -H "Authorization: token $TOKEN" \
|
|
-F "attachment=@/tmp/$A" \
|
|
"$API/releases/$ID/assets?name=$A" -o /dev/null -w "asset $A HTTP %{http_code}\n"
|
|
done
|
|
echo "Published $TAG to Codeberg."
|
|
|
|
# Play takes an App Bundle, not the APK, so it is a second artifact from
|
|
# the same source and the same signing config — not a repackage of the
|
|
# APK. The release key signs it, but Play only ever treats that key as the
|
|
# *upload* key: Play App Signing re-signs with Google's own key before
|
|
# delivery. A Play install and an F-Droid install therefore carry
|
|
# different signatures and cannot update each other. That divergence is a
|
|
# deliberate, documented choice (docs/RELEASING.md), not an accident.
|
|
#
|
|
# Built LAST and `continue-on-error`, both deliberately: everything above
|
|
# has already shipped by this point, and nothing Play-related may put that
|
|
# at risk. Sitting mid-job without continue-on-error, this block took the
|
|
# whole 2.17.0 release down with it — no F-Droid publish, no tag, no
|
|
# Codeberg mirror — over an artifact upload. A failure here now costs the
|
|
# Play upload and nothing else.
|
|
#
|
|
# Nothing here touches the F-Droid path: the AAB is never copied into the
|
|
# repo, never attached to a release, and its build cannot change the APK
|
|
# published above.
|
|
#
|
|
# AGP embeds the R8 mapping in the bundle's BUNDLE-METADATA, so Play gets
|
|
# deobfuscated stacktraces without a separate mapping upload.
|
|
- name: Build release AAB
|
|
if: env.IS_RELEASE == 'true'
|
|
continue-on-error: true
|
|
run: ./gradlew bundleRelease
|
|
|
|
# NOT actions/upload-artifact@v4: it runs @actions/artifact v2, which
|
|
# refuses to start whenever GITHUB_SERVER_URL is not github.com — it reads
|
|
# any other forge as an unsupported GHES instance and fails before it ever
|
|
# talks to the server (go-gitea/gitea#36024). Gitea 1.25 serves the v4
|
|
# artifact API fine; only the client-side check is wrong. This fork is that
|
|
# client with the check removed. Pinned to a commit, not the v4 branch: a
|
|
# third-party action in the signing pipeline must not change under us.
|
|
- name: Hand the AAB to the Play job
|
|
if: env.IS_RELEASE == 'true'
|
|
continue-on-error: true
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7 # v4
|
|
with:
|
|
name: release-aab-${{ needs.detect.outputs.version }}
|
|
path: app/build/outputs/bundle/release/app-release.aab
|
|
if-no-files-found: error
|
|
retention-days: 14
|
|
|
|
# Google Play channel.
|
|
#
|
|
# A separate job, on purpose, running only AFTER the F-Droid publish and both
|
|
# forge releases have completed. Play is the one channel that can reject a
|
|
# perfectly good build for reasons outside the pipeline (listing rules, policy
|
|
# review, API outage, a track that needs manual promotion). Isolating it means
|
|
# such a rejection surfaces as one red job next to a release that already
|
|
# shipped everywhere else, instead of failing the workflow that publishes it.
|
|
#
|
|
# Not a `container:` job even though a fastlane image exists: act_runner does
|
|
# not provide node inside custom job containers, so JavaScript actions
|
|
# (checkout, download-artifact) can't run there. The Renovate job gets away
|
|
# with a container because its only step is a shell command. Ruby is installed
|
|
# the same way sshpass, jq and fdroidserver are in the job above.
|
|
play:
|
|
needs: [detect, release]
|
|
# workflow_dispatch is the F-Droid re-sign recovery path — it must never
|
|
# touch Play, so gate on a real release only.
|
|
if: needs.detect.outputs.is_release == 'true'
|
|
runs-on: docker
|
|
env:
|
|
VERSION: ${{ needs.detect.outputs.version }}
|
|
VERSION_CODE: ${{ needs.detect.outputs.version_code }}
|
|
# Where the bundle lands. `internal` by default so a release reaches
|
|
# testers rather than the public, and promotion to production stays a
|
|
# deliberate human action in the Play Console — the same posture as
|
|
# holding UI releases for on-device review. Override with the PLAY_TRACK
|
|
# repo variable once the flow is trusted.
|
|
PLAY_TRACK: ${{ vars.PLAY_TRACK || 'internal' }}
|
|
PLAY_RELEASE_STATUS: ${{ vars.PLAY_RELEASE_STATUS || 'completed' }}
|
|
# Set PLAY_DRY_RUN=true to validate the edit against the API and discard
|
|
# it instead of committing — used to rehearse the first upload.
|
|
PLAY_DRY_RUN: ${{ vars.PLAY_DRY_RUN || 'false' }}
|
|
BUNDLE_PATH: vendor/bundle
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
# Skip cleanly (not fatally) when Play isn't configured yet, so the rest
|
|
# of the release pipeline keeps working during setup — same contract as
|
|
# the Codeberg mirror step.
|
|
- name: Write the Play service-account key
|
|
id: key
|
|
env:
|
|
PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${PLAY_SERVICE_ACCOUNT_JSON:-}" ]; then
|
|
echo "PLAY_SERVICE_ACCOUNT_JSON not set — skipping the Play upload."
|
|
echo "configured=false" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
printf '%s' "$PLAY_SERVICE_ACCOUNT_JSON" > play-service-account.json
|
|
# Fail here, with a clear message, rather than inside fastlane: a
|
|
# mangled multi-line secret is the likeliest setup mistake.
|
|
python3 -c "import json,sys; d=json.load(open('play-service-account.json')); sys.exit(0 if d.get('type')=='service_account' else 1)" \
|
|
|| { echo "PLAY_SERVICE_ACCOUNT_JSON is not a valid service-account JSON." >&2; exit 1; }
|
|
echo "configured=true" >> "$GITHUB_OUTPUT"
|
|
|
|
# Same GHES-detection problem as the upload side, same fix — see the
|
|
# handoff step in the release job.
|
|
- name: Download the AAB
|
|
if: steps.key.outputs.configured == 'true'
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7 # v4
|
|
with:
|
|
name: release-aab-${{ needs.detect.outputs.version }}
|
|
path: dist
|
|
|
|
- name: Install Ruby
|
|
if: steps.key.outputs.configured == 'true'
|
|
run: |
|
|
set -euo pipefail
|
|
SUDO=""
|
|
if command -v sudo >/dev/null 2>&1; then SUDO="sudo"; fi
|
|
$SUDO apt-get update
|
|
# ruby-dev + build-essential: several of fastlane's dependencies build
|
|
# native extensions.
|
|
$SUDO apt-get install -y ruby-full ruby-dev build-essential
|
|
ruby -v
|
|
|
|
# Only the first release pays the full gem build; afterwards this restores.
|
|
- name: Cache bundled gems
|
|
if: steps.key.outputs.configured == 'true'
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: vendor/bundle
|
|
key: ${{ runner.os }}-gems-${{ hashFiles('Gemfile') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gems-
|
|
|
|
- name: Install fastlane
|
|
if: steps.key.outputs.configured == 'true'
|
|
run: |
|
|
set -euo pipefail
|
|
gem install bundler --no-document
|
|
bundle config set --local path vendor/bundle
|
|
bundle install --jobs 4
|
|
bundle exec fastlane --version
|
|
|
|
- name: Upload to Play
|
|
if: steps.key.outputs.configured == 'true'
|
|
env:
|
|
SUPPLY_JSON_KEY: play-service-account.json
|
|
# supply is chatty on a TTY-less runner otherwise.
|
|
FASTLANE_SKIP_UPDATE_CHECK: '1'
|
|
FASTLANE_HIDE_CHANGELOG: '1'
|
|
run: |
|
|
set -euo pipefail
|
|
AAB="$GITHUB_WORKSPACE/dist/app-release.aab"
|
|
# Absolute, because a lane body runs from fastlane/, not the
|
|
# workspace root — a relative path resolves against the wrong
|
|
# directory there and 2.17.1 died on exactly that.
|
|
test -f "$AAB" || { echo "No AAB at $AAB — the artifact handoff failed." >&2; ls -la dist || true; exit 1; }
|
|
bundle exec fastlane deploy \
|
|
aab:"$AAB" \
|
|
track:"$PLAY_TRACK" \
|
|
release_status:"$PLAY_RELEASE_STATUS" \
|
|
dry_run:"$PLAY_DRY_RUN"
|
|
echo "Uploaded $VERSION (code $VERSION_CODE) to the '$PLAY_TRACK' track."
|
|
|
|
# The workspace is reused between runs on a self-hosted runner, so the
|
|
# credential must not outlive the job.
|
|
- name: Shred the service-account key
|
|
if: always()
|
|
run: shred -u play-service-account.json 2>/dev/null || rm -f play-service-account.json
|