Split signing tasks between the app signing and upload keystores

.github/workflows/draft-release-flutter.yml

@@ -7,25 +7,44 @@ on:
         description: Asset slug name
         required: true
         type: string
-      android_key_alias:
+      android_app_signing_key_alias:
         description: >
-          Alias name of the signing key inside the Android keystore.
+          Alias name of the app signing key inside the Android keystore.
         required: false
         type: string
-        default: release
+        default: appsigning
+      android_upload_key_alias:
+        description: >
+          Alias name of the upload key inside the Android keystore.
+        required: false
+        type: string
+        default: upload
     secrets:
-      ANDROID_KEYSTORE_B64:
+      ANDROID_APP_SIGNING_KEYSTORE_B64:
+        description: >
+          Base64-encoded Android app signing keystore (PKCS12 or JKS) used by
+          Gradle to sign release APKs in CI.
+        required: true
+      ANDROID_APP_SIGNING_KEYSTORE_PASSWORD:
+        description: >
+          Password protecting the Android app signing keystore file.
+        required: true
+      ANDROID_APP_SIGNING_KEY_PASSWORD:
+        description: >
+          Password for the app signing key alias within the Android keystore.
+        required: true
+      ANDROID_UPLOAD_KEYSTORE_B64:
         description: >
-          Base64-encoded Android signing keystore (PKCS12 or JKS) used by Gradle
-          to sign release App Bundles and APKs in CI.
+          Base64-encoded Android upload keystore (PKCS12 or JKS) used by
+          Gradle to sign release App Bundles in CI.
         required: true
-      ANDROID_KEYSTORE_PASSWORD:
+      ANDROID_UPLOAD_KEYSTORE_PASSWORD:
         description: >
-          Password protecting the Android signing keystore file.
+          Password protecting the Android upload keystore file.
         required: true
-      ANDROID_KEY_PASSWORD:
+      ANDROID_UPLOAD_KEY_PASSWORD:
         description: >
-          Password for the signing key alias within the Android keystore.
+          Password for the upload key alias within the Android keystore.
         required: true
 
 permissions:
@@ -43,6 +62,8 @@ jobs:
     steps:
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
 
       - id: gh_release
         name: Create a new GitHub draft release
@@ -53,7 +74,10 @@ jobs:
           generate_release_notes: true
 
       - name: Annotate workflow run with draft release URL
-        run: 'echo "### :shipit: Opened draft release for: [${{ inputs.slug }} ${{ github.ref_name }}](${{ steps.gh_release.outputs.url }})" >> "$GITHUB_STEP_SUMMARY"'
+        env:
+          INPUTS_SLUG: ${{ inputs.slug }}
+          GH_RELEASE_URL: ${{ steps.gh_release.outputs.url }}
+        run: 'echo "### :shipit: Opened draft release for: [${INPUTS_SLUG} ${GITHUB_REF_NAME}](${GH_RELEASE_URL})" >> "$GITHUB_STEP_SUMMARY"'
 
   build_release_assets:
     name: build release assets
@@ -63,6 +87,8 @@ jobs:
     steps:
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
 
       - name: Add Toolbox Envy to PATH
         uses: EarthmanMuons/toolbox-envy/.github/actions/add-to-path@main
@@ -81,22 +107,38 @@ jobs:
       - name: Install dependencies
         run: flutter pub get --enforce-lockfile
 
-      - name: Configure Android app signing
+      - name: Configure Android signing (upload key)
         env:
-          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
-          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
-          ANDROID_KEY_ALIAS: ${{ inputs.android_key_alias }}
-          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+          ANDROID_SIGNING_ROLE: upload
+          ANDROID_SIGNING_FORCE_DECODE: 1
+          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_UPLOAD_KEYSTORE_B64 }}
+          ANDROID_KEYSTORE_FILENAME: upload-keystore.p12
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_UPLOAD_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ inputs.android_upload_key_alias }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_UPLOAD_KEY_PASSWORD }}
         run: android-signing-setup
 
       - name: Build release App Bundle
         run: flutter build appbundle
 
+      - name: Configure Android signing (app signing key)
+        env:
+          ANDROID_SIGNING_ROLE: appsigning
+          ANDROID_SIGNING_FORCE_DECODE: 1
+          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_APP_SIGNING_KEYSTORE_B64 }}
+          ANDROID_KEYSTORE_FILENAME: app-signing-keystore.p12
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_APP_SIGNING_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ inputs.android_app_signing_key_alias }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_APP_SIGNING_KEY_PASSWORD }}
+        run: android-signing-setup
+
       - name: Build release APK
         run: flutter build apk
 
       - name: Stage assets + checksums
-        run: stage-release-assets --slug "${{ inputs.slug }}"
+        env:
+          INPUTS_SLUG: ${{ inputs.slug }}
+        run: stage-release-assets --slug "${INPUTS_SLUG}"
 
       - name: Upload staged dist/ as workflow artifact
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
@@ -117,6 +159,8 @@ jobs:
     steps:
       - name: Checkout source code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
 
       - name: Download staged dist/ artifact
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
@@ -127,9 +171,10 @@ jobs:
       - name: Upload release assets
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DRAFT_RELEASE_UPLOAD_URL: ${{ needs.create_draft_release.outputs.upload_url }}
         run: |
           set -euo pipefail
-          echo "Uploading assets to: ${{ needs.create_draft_release.outputs.upload_url }}"
+          echo "Uploading assets to: ${DRAFT_RELEASE_UPLOAD_URL}"
           ls -la dist/
           gh release upload "$GITHUB_REF_NAME" dist/* --clobber
           echo ":arrow_up: Uploaded release assets" >>"$GITHUB_STEP_SUMMARY"

docs/flutter.md

@@ -105,13 +105,17 @@ and uploads them to the release.
 
 **Inputs**
 
-| Name              | Required | Default |
-| ----------------- | -------- | ------- |
-| slug              | true     | —       |
-| android_key_alias | false    | release |
+| Name                          | Required | Default    |
+| ----------------------------- | -------- | ---------- |
+| slug                          | true     | —          |
+| android_app_signing_key_alias | false    | appsigning |
+| android_upload_key_alias      | false    | upload     |
 
 **Secrets**
 
-- `ANDROID_KEYSTORE_B64`
-- `ANDROID_KEYSTORE_PASSWORD`
-- `ANDROID_KEY_PASSWORD`
+- `ANDROID_APP_SIGNING_KEYSTORE_B64`
+- `ANDROID_APP_SIGNING_KEYSTORE_PASSWORD`
+- `ANDROID_APP_SIGNING_KEY_PASSWORD`
+- `ANDROID_UPLOAD_KEYSTORE_B64`
+- `ANDROID_UPLOAD_KEYSTORE_PASSWORD`
+- `ANDROID_UPLOAD_KEY_PASSWORD`