LibreFit/.github/workflows/release.yml at main · LibreFitOrg/LibreFit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
name: Release
on:
  workflow_dispatch:
  push:
    tags:
      - 'v*' # Triggers only pushing a tag like v1.0.0

jobs:
  build-and-release:
    runs-on: ubuntu-latest
    permissions:
      contents: write # Required to upload files to Releases

    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: 'gradle'

      - name: Build unsigned release APK
        env:
          SOURCE_DATE_EPOCH: 1700000000
        # --no-daemon ensures a fresh, reproducible environment in CI
        run: ./gradlew clean assembleRelease --no-daemon

      - name: Sign APK
        env:
          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASS }}
          KEY_ALIAS: 'librefit_release'
          KEY_PASSWORD: ${{ secrets.KEYSTORE_PASS }}
        run: |
          # Decode keystore from Base64
          echo "$KEYSTORE_BASE64" | base64 --decode > release.jks

          # Rename unsigned apk
          mv "app/build/outputs/apk/release/LibreFit-release-unsigned.apk" "app/build/outputs/apk/release/LibreFit-unsigned.apk"

          UNSIGNED_APK="app/build/outputs/apk/release/LibreFit-unsigned.apk"
          ALIGNED_APK="app/build/outputs/apk/release/LibreFit-aligned.apk"
          SIGNED_APK="app/build/outputs/apk/release/LibreFit.apk"
          BUILD_TOOLS_DIR="$ANDROID_HOME/build-tools/36.0.0"

          # Align to 16KB (Capital P is required for build tools 36)
          $BUILD_TOOLS_DIR/zipalign -f -P 16 -v 4 "$UNSIGNED_APK" "$ALIGNED_APK"

          # Sign with preservation: --alignment-preserved prevents apksigner from changing the padding bytes
          # Use "env:" to pass passwords securely without exposing them in CI logs
          $BUILD_TOOLS_DIR/apksigner sign \
            --ks release.jks \
            --ks-key-alias "$KEY_ALIAS" \
            --ks-pass "env:KEYSTORE_PASSWORD" \
            --key-pass "env:KEY_PASSWORD" \
            --alignment-preserved \
            --out "$SIGNED_APK" \
            "$ALIGNED_APK"

          # Clean up the keystore
          rm release.jks

      # This is just for testing the manual run
      - name: Upload artifacts if not releasing
        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
        uses: actions/upload-artifact@v7
        with:
          path: app/build/outputs/apk/release/LibreFit.apk
          archive: false

      # It extracts notes from CHANGELOG.md by default
      - name: Extract release notes
        id: extract_notes
        uses: ffurrer2/extract-release-notes@v2

      - name: Create release
        uses: softprops/action-gh-release@v2
        if: startsWith(github.ref, 'refs/tags/')
        with:
          files: app/build/outputs/apk/release/LibreFit.apk
          body: ${{ steps.extract_notes.outputs.release_notes }}
          append_body: true # List new contributors