Configure GitHub Actions to use repository secrets for signed release APK

Author: brittytino

.github/workflows/build.yml

@@ -36,14 +36,24 @@ jobs:
       - name: Build Release APK
         run: ./gradlew assembleRelease --stacktrace --no-daemon
         env:
+          KEYSTORE_FILE_BASE64: ${{ secrets.KEYSTORE_FILE }}
           KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
           KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
 
+      - name: Decode Keystore
+        if: env.KEYSTORE_FILE_BASE64 != ''
+        run: echo "${{ secrets.KEYSTORE_FILE }}" | base64 -d > release.keystore
+        
       - name: Rename and Prepare APK
         run: |
           mkdir -p release-artifacts
-          cp app/build/outputs/apk/release/app-release.apk release-artifacts/patchwork-v1.1.0.apk
-          
+          if [ -f "app/build/outputs/apk/release/app-release.apk" ]; then
+            cp app/build/outputs/apk/release/app-release.apk release-artifacts/patchwork-v1.1.0.apk
+          else
+            echo "Release APK not found"
+            exit 1
+          fi
       - name: Upload Release APK Artifact
         uses: actions/upload-artifact@v4
         with:

app/build.gradle.kts

@@ -34,11 +34,16 @@ android {
 
     signingConfigs {
         create("release") {
-            val keystoreFile = file("../patchwork-release.keystore")
+            val keystoreFile = if (System.getenv("KEYSTORE_FILE_BASE64") != null) {
+                file("../release.keystore")
+            } else {
+                file("../patchwork-release.keystore")
+            }
+            
             if (keystoreFile.exists()) {
                 storeFile = keystoreFile
                 storePassword = System.getenv("KEYSTORE_PASSWORD") ?: "patchwork2026"
-                keyAlias = "patchwork"
+                keyAlias = System.getenv("KEY_ALIAS") ?: "patchwork"
                 keyPassword = System.getenv("KEY_PASSWORD") ?: "patchwork2026"
             }
         }
@@ -51,9 +56,13 @@ android {
                 getDefaultProguardFile("proguard-android-optimize.txt"),
                 "proguard-rules.pro"
             )
-            // Apply release signing if keystore exists, otherwise fallback to debug signing
-            // so that the APK is still installable for testing/pre-release.
-            val keystoreFile = file("../patchwork-release.keystore")
+            // Use release signing if possible
+            val keystoreFile = if (System.getenv("KEYSTORE_FILE_BASE64") != null) {
+                file("../release.keystore")
+            } else {
+                file("../patchwork-release.keystore")
+            }
+            
             if (keystoreFile.exists()) {
                 signingConfig = signingConfigs.getByName("release")
             } else {