Android code signing not working with Build Profiles

[smsunarto]

Bug description

When trying to use the automatic android app bundle signing for release to Google Play, Unity keeps returning the following error even though the password (and other android secrets) is already provided.

Error: UnityException: Can not sign the application
Unable to sign the application; please provide passwords!
System.Dynamic.UpdateDelegates:UpdateAndExecute2(CallSite, Type, Object)
UnityBuilderAction.Builder:BuildProject() (at Assets/Editor/UnityBuilderAction/Assets/Editor/UnityBuilderAction/Builder.cs:113)

I've also confirmed that the android secrets are also getting passed into the CLI

COMMAND LINE ARGUMENTS:
C:\UnityEditor\6000.1.5f1\Editor\Unity.exe
-quit
-batchmode
-nographics
-silent-crashes
-customBuildName
<redacted>
-projectPath
c:/github/workspace\.
-executeMethod
UnityBuilderAction.Builder.BuildProject
-buildTarget
Android
-customBuildTarget
Android
-customBuildPath
<redacted>
-customBuildProfile
<redacted>
-buildVersion
0.0.1006
-androidVersionCode
1006
-androidKeystorePass
***
-androidKeyaliasName
***
-androidKeyaliasPass
***
-androidTargetSdkVersion
-androidExportType
androidAppBundle
-androidSymbolType
none
-logfile

How to reproduce

  build-windows-runner:
    timeout-minutes: 30
    needs: check-commits
    if: needs.check-commits.outputs.has_new_commits == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - targetPlatform: StandaloneWindows64
            buildName: <redacted>
            buildProfile: <redacted>
            artifactName: <redacted>
          - targetPlatform: Android
            buildName: <redacted>
            buildProfile: <redacted>
            artifactName: <redacted>

    name: Build (${{ matrix.targetPlatform }})
    runs-on: unity-runner-windows
    env:
      UNITY_EMAIL: ${{ secrets.UNITY_EMAIL_2 }}
      UNITY_PASSWORD: ${{ secrets.UNITY_PASSWORD_2 }}
      UNITY_SERIAL: ${{ secrets.UNITY_SERIAL_2 }}

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          lfs: true

      - uses: actions/cache@v4
        with:
          path: Library
          key: Library-${{ matrix.targetPlatform }}
          restore-keys: |
            Library-${{ matrix.targetPlatform }}
            Library-

      - name: Build with Unity
        uses: game-ci/unity-builder@v4
        with:
          targetPlatform: ${{ matrix.targetPlatform }}
          buildName: ${{ matrix.buildName }}
          buildProfile: ${{ matrix.buildProfile }}
          buildsPath: build
          versioning: Semantic
          allowDirtyBuild: true
          # Android-specific parameters from original snippet
          androidKeystoreName: user
          androidExportType: androidAppBundle
          androidKeystoreBase64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          androidKeystorePass: ${{ secrets.ANDROID_KEYSTORE_PASS }}
          androidKeyaliasName: ${{ secrets.ANDROID_KEYALIAS_NAME }}
          androidKeyaliasPass: ${{ secrets.ANDROID_KEYALIAS_PASS }}

      - name: Setup Ruby
        if: success() && matrix.targetPlatform == 'Android'
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.2'

      - name: Release to Google Play (Android)
        if: success() && matrix.targetPlatform == 'Android'
        env:
          GOOGLE_PLAY_KEY_FILE: ${{ secrets.GOOGLE_PLAY_KEY_FILE }}
          GOOGLE_PLAY_KEY_FILE_PATH: ${{ github.workspace }}/fastlane/google-fastlane.json
          ANDROID_BUILD_FILE_PATH: build/Android/${{ matrix.artifactName }}.aab
          ANDROID_PACKAGE_NAME: <redacted>
        run: |
            echo "$GOOGLE_PLAY_KEY_FILE" > $GOOGLE_PLAY_KEY_FILE_PATH            
            bundle install
            bundle exec fastlane android internal

      - uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifactName }}
          path: build/${{ matrix.targetPlatform }}
          retention-days: 7

Expected behavior

Should be able to sign without issue

Additional details

Windows 2022 runner

[davidmfinol]

I think the problem may be that the password isn't used with the build profile.
Possibly related issue: #691

[alexeSGN]

In terms of a proper fix, if we apply the passwords as part of a separate parameters options apply during Build Profile, they should be stored to the same locations as before.

        // Set it as active
        BuildProfile.SetActiveBuildProfile(buildProfile);
        
        // If set, apply android Keystore passwords, these are not stored in BuildProfiles
        AndroidSettings.ApplyPasswords(options);

 public static void ApplyPasswords(Dictionary<string, string> options) {
#if UNITY_2019_1_OR_NEWER
      if (options.TryGetValue("androidKeystoreName"...

[smsunarto]

I think the problem may be that the password isn't used with the build profile. Possibly related issue: #691

Confirming that this is indeed the issue.

[Roluda]

For anyone having issues with android settings / version code not being applied when using build profiles, this temporary fix can help until the issue is resolved. It's a preprocessor script that mirrors the game ci behaviour and applies the android arguments to the player settings.
You can simply put it into your Scripts/Editor Directory

#if UNITY_ANDROID

using System;
using System.Collections.Generic;
using System.IO;
using System.Reflection;
using UnityEditor;
using UnityEditor.Build;
using UnityEditor.Build.Reporting;
using UnityEngine;

public class AndroidGameCIBuildProfileFix : IPreprocessBuildWithReport, IPostprocessBuildWithReport
{
    public int callbackOrder => -1000; // run very early

    private static readonly string TempKeystorePath = Path.GetFullPath(Path.Combine("Temp", "ci_android_keystore.jks"));

    public void OnPreprocessBuild(BuildReport report)
    {
        if (report == null)
            return;

        var opts = ParseUnityCommandLineArgs();

        // ensure bundleVersionCode is applied when using Build Profiles
        if (opts.TryGetValue("androidVersionCode", out var verCode) && int.TryParse(verCode, out var code))
        {
            PlayerSettings.Android.bundleVersionCode = code;
        }

        try
        {
            ApplyAndroidSigningFromArgs(opts);
            ApplyAndroidExportFromArgs(opts);
            ApplyAndroidTargetSdkFromArgs(opts);
            ApplyAndroidSymbolsFromArgs(opts);
        }
        catch (Exception ex)
        {
            Debug.LogError($"[CI Preprocessor] Failed to apply Android settings from args: {ex}");
            throw;
        }
    }

    public void OnPostprocessBuild(BuildReport report)
    {
        // Clean temp keystore if we created one
        try
        {
            if (File.Exists(TempKeystorePath))
                File.Delete(TempKeystorePath);
        }
        catch (Exception ex)
        {
            Debug.LogWarning($"[CI Preprocessor] Could not delete temporary keystore: {ex.Message}");
        }
    }



    private static Dictionary<string, string> ParseUnityCommandLineArgs()
    {
        var dict = new Dictionary<string, string>();
        var args = Environment.GetCommandLineArgs();

        for (int i = 0; i < args.Length; i++)
        {
            var a = args[i];
            if (!a.StartsWith("-"))
                continue;

            var key = a.TrimStart('-');
            var hasValue = (i + 1) < args.Length && !args[i + 1].StartsWith("-");
            var value = hasValue ? args[i + 1] : "";

            // Mirror game-ci behavior: last flag wins if duplicates
            dict[key] = value;
        }
        return dict;
    }

    private static void ApplyAndroidSigningFromArgs(Dictionary<string, string> arguments)
    {
        // game-ci flags
        arguments.TryGetValue("androidKeystoreName", out var keystoreName);
        arguments.TryGetValue("androidKeystorePass", out var keystorePass);
        arguments.TryGetValue("androidKeyaliasName", out var keyaliasName);
        arguments.TryGetValue("androidKeyaliasPass", out var keyaliasPass);

        // Not used by game-ci's AndroidSettings, but often supplied to the action:
        // allow decoding ourselves so users can set only -androidKeystoreBase64
        arguments.TryGetValue("androidKeystoreBase64", out var keystoreB64);

        string finalKeystorePath = keystoreName;

        if (!string.IsNullOrEmpty(keystoreB64))
        {
            Directory.CreateDirectory(Path.GetDirectoryName(TempKeystorePath)!);

            // Tolerate accidental newlines/spaces
            var cleaned = keystoreB64.Trim().Replace("\r", "").Replace("\n", "");
            var bytes = Convert.FromBase64String(cleaned);
            File.WriteAllBytes(TempKeystorePath, bytes);
            finalKeystorePath = TempKeystorePath;

            Debug.Log("[CI Preprocessor] Decoded androidKeystoreBase64 to Temp/.");
        }

        // If we have either a path or base64 (decoded), apply signing
        if (!string.IsNullOrEmpty(finalKeystorePath) || !string.IsNullOrEmpty(keystorePass) || !string.IsNullOrEmpty(keyaliasName) || !string.IsNullOrEmpty(keyaliasPass))
        {
            if (!string.IsNullOrEmpty(finalKeystorePath))
            {
                PlayerSettings.Android.useCustomKeystore = true;
                PlayerSettings.Android.keystoreName = finalKeystorePath;
            }
            if (!string.IsNullOrEmpty(keystorePass))
                PlayerSettings.Android.keystorePass = keystorePass;

            if (!string.IsNullOrEmpty(keyaliasName))
                PlayerSettings.Android.keyaliasName = keyaliasName;

            if (!string.IsNullOrEmpty(keyaliasPass))
                PlayerSettings.Android.keyaliasPass = keyaliasPass;

            Debug.Log("[CI Preprocessor] Applied Android signing from command-line args.");
        }
        else
        {
            Debug.Log("[CI Preprocessor] No Android signing args found; leaving PlayerSettings as-is.");
        }
    }

    private static void ApplyAndroidExportFromArgs(Dictionary<string, string> arguments)
    {
        if (!arguments.TryGetValue("androidExportType", out var exportType) || string.IsNullOrEmpty(exportType))
            return;

        // Mirrors game-ci's AndroidSettings.Apply
        switch (exportType)
        {
            case "androidStudioProject":
                EditorUserBuildSettings.exportAsGoogleAndroidProject = true;
                SetBuildAppBundle(false);
                break;
            case "androidAppBundle":
                EditorUserBuildSettings.exportAsGoogleAndroidProject = false;
                SetBuildAppBundle(true);
                break;
            case "androidPackage":
                EditorUserBuildSettings.exportAsGoogleAndroidProject = false;
                SetBuildAppBundle(false);
                break;
        }
    }

    private static void SetBuildAppBundle(bool value)
    {
        EditorUserBuildSettings.buildAppBundle = value;
    }

    private static void ApplyAndroidTargetSdkFromArgs(Dictionary<string, string> arguments)
    {
        if (!arguments.TryGetValue("androidTargetSdkVersion", out var v) || string.IsNullOrEmpty(v))
            return;

        try
        {
            var parsed = (AndroidSdkVersions)Enum.Parse(typeof(AndroidSdkVersions), v);
            PlayerSettings.Android.targetSdkVersion = parsed;
        }
        catch
        {
            Debug.LogWarning($"[CI Preprocessor] Could not parse androidTargetSdkVersion \"{v}\"; leaving default.");
        }
    }

    private static void ApplyAndroidSymbolsFromArgs(Dictionary<string, string> arguments)
    {
        if (!arguments.TryGetValue("androidSymbolType", out var v) || string.IsNullOrEmpty(v))
            return;

        // UserBuildSettings.DebugSymbols.level via reflection (matches game-ci)
        SetDebugSymbols(v);

    }

    private static void SetDebugSymbols(string enumName)
    {
        var dbgType = Type.GetType("UnityEditor.Android.UserBuildSettings+DebugSymbols, UnityEditor.Android.Extensions");
        if (dbgType == null)
            return;

        var levelProp = dbgType.GetProperty("level", BindingFlags.Static | BindingFlags.Public);
        if (levelProp == null)
            return;

        var enumType = Type.GetType("Unity.Android.Types.DebugSymbolLevel, Unity.Android.Types");
        if (enumType == null)
            return;

        if (!Enum.TryParse(enumType, enumName, false, out var val))
            return;
        levelProp.SetValue(null, val);
    }
}
#endif