vineyardbovines
405 lines
16 KiB
YAML
405 lines
16 KiB
YAML
---
|
|
name: Build and Submit Android
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
profile:
|
|
type: choice
|
|
description: Build profile to use
|
|
options:
|
|
- testflight-android
|
|
- production
|
|
submit:
|
|
type: boolean
|
|
description: Submit the build to Google Play (disable to only produce the APK artifact)
|
|
default: true
|
|
sourceRef:
|
|
type: string
|
|
description: Source ref to build; use a full commit SHA for immutable builds
|
|
required: false
|
|
default: ''
|
|
workflow_call:
|
|
inputs:
|
|
profile:
|
|
type: string
|
|
description: Build profile to use
|
|
required: true
|
|
submit:
|
|
type: boolean
|
|
description: Submit the build to Google Play (disable to only produce the APK artifact)
|
|
default: true
|
|
runner:
|
|
type: string
|
|
description: Runner for the build job (defaults to Linux-x64-32core)
|
|
required: false
|
|
default: ''
|
|
sourceRef:
|
|
type: string
|
|
description: Source ref to build; use a full commit SHA for immutable builds
|
|
required: false
|
|
default: ''
|
|
outputs:
|
|
package-version:
|
|
description: Version from package.json
|
|
value: ${{ jobs.build.outputs.package-version }}
|
|
version-code:
|
|
description: Android version code
|
|
value: ${{ jobs.build.outputs.version-code }}
|
|
source-sha:
|
|
description: Exact commit used for the build
|
|
value: ${{ jobs.build.outputs.source-sha }}
|
|
artifact-name:
|
|
description: Workflow artifact containing the AAB and provenance
|
|
value: ${{ jobs.build.outputs.artifact-name }}
|
|
secrets:
|
|
EXPO_TOKEN:
|
|
required: true
|
|
ENV_TOKEN:
|
|
required: true
|
|
SENTRY_DSN:
|
|
required: true
|
|
BITDRIFT_API_KEY:
|
|
required: true
|
|
EXPO_PUBLIC_GCP_PROJECT_ID:
|
|
required: true
|
|
GOOGLE_SERVICES_TOKEN:
|
|
required: true
|
|
SENTRY_AUTH_TOKEN:
|
|
required: true
|
|
SLACK_CLIENT_ALERT_WEBHOOK:
|
|
required: true
|
|
ANDROID_KEYSTORE_BASE64:
|
|
required: true
|
|
ANDROID_KEYSTORE_PASSWORD:
|
|
required: true
|
|
ANDROID_KEY_ALIAS:
|
|
required: true
|
|
ANDROID_KEY_PASSWORD:
|
|
required: true
|
|
|
|
# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
if: github.repository == 'bluesky-social/social-app'
|
|
name: Build Android
|
|
runs-on: ${{ inputs.runner || 'Linux-x64-32core' }}
|
|
concurrency:
|
|
group: android-build
|
|
cancel-in-progress: false
|
|
outputs:
|
|
package-version: ${{ steps.package.outputs.version }}
|
|
version-code: ${{ steps.aab-version.outputs.version-code }}
|
|
source-sha: ${{ steps.source.outputs.sha }}
|
|
artifact-name: android-aab-${{ github.run_id }}
|
|
steps:
|
|
- name: ⬇️ Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ inputs.sourceRef || github.sha }}
|
|
fetch-depth: 5
|
|
|
|
- name: Resolve build source
|
|
id: source
|
|
run: |
|
|
echo "Building source: $(git rev-parse HEAD)"
|
|
echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: 🔧 Setup Expo project
|
|
uses: ./.github/actions/setup-expo-project
|
|
with:
|
|
expo-token: ${{ secrets.EXPO_TOKEN }}
|
|
|
|
- uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
|
|
with:
|
|
distribution: "temurin"
|
|
java-version: "17"
|
|
|
|
- name: 🔧 Setup bundletool
|
|
uses: amyu/setup-bundletool@cc2e1857284660bd625e43f2c8a45626f034302f # v1.1
|
|
with:
|
|
version: "1.18.3"
|
|
|
|
- name: 🔤 Compile translations
|
|
uses: ./.github/actions/compile-i18n
|
|
|
|
# EXPO_PUBLIC_ENV is handled in eas.json
|
|
- name: ✏️ Write environment variables
|
|
id: env
|
|
uses: ./.github/actions/write-env
|
|
with:
|
|
env-token: ${{ secrets.ENV_TOKEN }}
|
|
sentry-dsn: ${{ secrets.SENTRY_DSN }}
|
|
bitdrift-api-key: ${{ secrets.BITDRIFT_API_KEY }}
|
|
gcp-project-id: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
|
|
google-services-token: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
|
|
|
|
- name: 🏗️ EAS Build
|
|
uses: ./.github/actions/eas-local-build
|
|
with:
|
|
platform: android
|
|
profile: ${{ inputs.profile || 'testflight-android' }}
|
|
output: build.aab
|
|
bump-build-number: "true"
|
|
sentry-auth-token: ${{ secrets.SENTRY_AUTH_TOKEN }}
|
|
sentry-release: ${{ steps.env.outputs.release-version }}
|
|
sentry-dist: ${{ steps.env.outputs.bundle-identifier }}
|
|
|
|
- name: 📚 Get package version
|
|
id: package
|
|
run: echo "version=$(jq -r .version package.json)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: 🔢 Read version code from AAB
|
|
id: aab-version
|
|
run: |
|
|
version_code=$(bundletool dump manifest --bundle=build.aab --xpath=/manifest/@android:versionCode)
|
|
[[ "$version_code" =~ ^[1-9][0-9]*$ ]] || {
|
|
echo "::error::Could not read a positive Android version code from build.aab"
|
|
exit 1
|
|
}
|
|
echo "AAB version code: $version_code"
|
|
echo "version-code=$version_code" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Record artifact provenance
|
|
env:
|
|
SOURCE_SHA: ${{ steps.source.outputs.sha }}
|
|
PACKAGE_VERSION: ${{ steps.package.outputs.version }}
|
|
VERSION_CODE: ${{ steps.aab-version.outputs.version-code }}
|
|
run: |
|
|
checksum=$(sha256sum build.aab | awk '{print $1}')
|
|
jq -n \
|
|
--arg sourceSha "$SOURCE_SHA" \
|
|
--arg packageVersion "$PACKAGE_VERSION" \
|
|
--arg versionCode "$VERSION_CODE" \
|
|
--arg artifactFilename "build.aab" \
|
|
--arg artifactSha256 "$checksum" \
|
|
'{sourceSha: $sourceSha, packageVersion: $packageVersion, versionCode: $versionCode, artifactFilename: $artifactFilename, artifactSha256: $artifactSha256, submissionState: "notStarted"}' \
|
|
> android-build-metadata.json
|
|
cat android-build-metadata.json
|
|
|
|
# Keep the exact build and its provenance available for inspection and failed-job retries.
|
|
- name: 🚀 Upload AAB artifact
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: android-aab-${{ github.run_id }}
|
|
retention-days: 14
|
|
if-no-files-found: error
|
|
path: |
|
|
build.aab
|
|
android-build-metadata.json
|
|
|
|
- name: 📝 Write build summary
|
|
env:
|
|
VERSION_CODE: ${{ steps.aab-version.outputs.version-code }}
|
|
SOURCE_SHA: ${{ steps.source.outputs.sha }}
|
|
run: |
|
|
artifact_sha256=$(jq -r .artifactSha256 android-build-metadata.json)
|
|
{
|
|
echo "### Android build number"
|
|
echo
|
|
echo "- Version code: \`$VERSION_CODE\`"
|
|
echo "- Source SHA: \`$SOURCE_SHA\`"
|
|
echo "- AAB SHA-256: \`$artifact_sha256\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
submit:
|
|
name: Submit to Google Play
|
|
runs-on: ubuntu-latest
|
|
needs: [build]
|
|
# Submit unless explicitly disabled; on events where inputs is empty this still submits.
|
|
if: ${{ inputs.submit != false }}
|
|
steps:
|
|
# eas submit reads app config from the repo, so we need a checkout.
|
|
- name: ⬇️ Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ needs.build.outputs.source-sha }}
|
|
fetch-depth: 5
|
|
|
|
- name: 🔧 Setup Expo project
|
|
uses: ./.github/actions/setup-expo-project
|
|
with:
|
|
expo-token: ${{ secrets.EXPO_TOKEN }}
|
|
|
|
- name: ⬇️ Download AAB artifact
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: android-aab-${{ github.run_id }}
|
|
|
|
- name: 🚀 Submit to Google Play
|
|
env:
|
|
PROFILE: ${{ inputs.profile || 'testflight-android' }}
|
|
run: pnpm eas submit -p android --profile $PROFILE --non-interactive --path build.aab
|
|
|
|
- name: Record submission receipt
|
|
env:
|
|
SOURCE_SHA: ${{ needs.build.outputs.source-sha }}
|
|
PACKAGE_VERSION: ${{ needs.build.outputs.package-version }}
|
|
VERSION_CODE: ${{ needs.build.outputs.version-code }}
|
|
run: |
|
|
artifact_sha256=$(jq -r .artifactSha256 android-build-metadata.json)
|
|
jq -n \
|
|
--arg sourceSha "$SOURCE_SHA" \
|
|
--arg packageVersion "$PACKAGE_VERSION" \
|
|
--arg versionCode "$VERSION_CODE" \
|
|
--arg artifactSha256 "$artifact_sha256" \
|
|
'{sourceSha: $sourceSha, packageVersion: $packageVersion, versionCode: $versionCode, artifactSha256: $artifactSha256, submissionState: "submitted"}' \
|
|
> android-submission.json
|
|
|
|
- name: Upload submission receipt
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: android-submission-${{ github.run_id }}
|
|
path: android-submission.json
|
|
retention-days: 14
|
|
if-no-files-found: error
|
|
|
|
- name: 🔔 Notify Slack of Play Store Submission
|
|
if: ${{ inputs.profile == 'production' }}
|
|
uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
|
|
with:
|
|
webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
|
|
webhook-type: incoming-webhook
|
|
payload-templated: true
|
|
payload: |
|
|
{"text": "Android ${{ inputs.profile || 'testflight-android' }} build submitted to Google Play!\n```Version Number: ${{ needs.build.outputs.package-version }}\nBuild Number: ${{ needs.build.outputs.version-code }}```"}
|
|
|
|
# Runs in parallel with submit: the QA APK shouldn't be blocked by a Play submission failure.
|
|
universalApk:
|
|
name: Build universal APK
|
|
runs-on: ubuntu-latest
|
|
needs: [build]
|
|
outputs:
|
|
apk-artifact-name: build-${{ steps.timestamp.outputs.time }}.apk
|
|
steps:
|
|
- name: ⬇️ Download AAB artifact
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: android-aab-${{ github.run_id }}
|
|
|
|
# bundletool needs a JRE. ubuntu-latest ships a default JDK, but pin it explicitly
|
|
# like the build job so the toolchain is deterministic.
|
|
- uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
|
|
with:
|
|
distribution: "temurin"
|
|
java-version: "17"
|
|
|
|
- name: 🔧 Setup bundletool
|
|
uses: amyu/setup-bundletool@cc2e1857284660bd625e43f2c8a45626f034302f # v1.1
|
|
with:
|
|
version: "1.18.3"
|
|
|
|
- name: 🔑 Decode keystore
|
|
env:
|
|
ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
|
|
run: echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > keystore.jks
|
|
|
|
- name: 📦 Build signed universal APK
|
|
env:
|
|
ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
|
|
ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
|
|
ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
|
|
run: |
|
|
bundletool build-apks \
|
|
--bundle=build.aab \
|
|
--output=universal.apks \
|
|
--mode=universal \
|
|
--ks=keystore.jks \
|
|
--ks-pass=pass:"$ANDROID_KEYSTORE_PASSWORD" \
|
|
--ks-key-alias="$ANDROID_KEY_ALIAS" \
|
|
--key-pass=pass:"$ANDROID_KEY_PASSWORD"
|
|
|
|
- name: 📋 Rename to .zip for extraction
|
|
run: mv universal.apks universal.zip
|
|
|
|
- name: 📦 Extract universal APK
|
|
run: unzip -p universal.zip universal.apk > build.apk
|
|
|
|
- name: ⏰ Get a timestamp
|
|
id: timestamp
|
|
run: echo "time=$(date -u +'%m-%d-%H-%M-%S')" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: 🚀 Upload APK Artifact
|
|
id: upload-artifact
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
retention-days: 30
|
|
compression-level: 6
|
|
name: build-${{ steps.timestamp.outputs.time }}.apk
|
|
path: build.apk
|
|
|
|
- name: 🔔 Notify Slack of APK Artifact
|
|
uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
|
|
with:
|
|
webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
|
|
webhook-type: incoming-webhook
|
|
payload-templated: true
|
|
payload: |
|
|
{"text": "Android ${{ inputs.profile || 'testflight-android' }} APK is ready for testing!\n```Artifact: ${{ steps.upload-artifact.outputs.artifact-url }}\nVersion Number: ${{ needs.build.outputs.package-version }}\nBuild Number: ${{ needs.build.outputs.version-code }}```"}
|
|
|
|
# Releases are cut from tags named after the version (e.g. "1.124.0"), so when a production
|
|
# build is dispatched against such a tag we attach the APK to the matching release. This runs
|
|
# as a separate job so that `contents: write` is isolated here and the build job stays read-only.
|
|
attachToRelease:
|
|
name: Attach APK to GitHub Release
|
|
runs-on: ubuntu-latest
|
|
needs: [build, universalApk]
|
|
if: ${{ inputs.profile == 'production' && github.ref_type == 'tag' && github.repository == 'bluesky-social/social-app' }}
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
# We only attach to a release that already exists — never create one.
|
|
- name: 🔎 Check for matching GitHub Release
|
|
id: release-check
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
TAG: ${{ github.ref_name }}
|
|
run: |
|
|
status=$(curl -sS -o /dev/null -w '%{http_code}' \
|
|
-H "Authorization: Bearer $GH_TOKEN" \
|
|
-H "Accept: application/vnd.github+json" \
|
|
"${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}")
|
|
if [ "$status" = "200" ]; then
|
|
echo "Found GitHub Release for tag $TAG"
|
|
echo "exists=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "No GitHub Release found for tag $TAG (HTTP $status); skipping APK attachment."
|
|
echo "exists=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: ⬇️ Download APK artifact
|
|
if: ${{ steps.release-check.outputs.exists == 'true' }}
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: ${{ needs.universalApk.outputs.apk-artifact-name }}
|
|
|
|
- name: 🏷️ Rename APK for release
|
|
if: ${{ steps.release-check.outputs.exists == 'true' }}
|
|
run: cp build.apk "Bluesky-${{ needs.build.outputs.package-version }}.apk"
|
|
|
|
- name: 📎 Attach APK to GitHub Release
|
|
id: attach
|
|
if: ${{ steps.release-check.outputs.exists == 'true' }}
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GH_REPO: ${{ github.repository }}
|
|
TAG: ${{ github.ref_name }}
|
|
APK: Bluesky-${{ needs.build.outputs.package-version }}.apk
|
|
run: |
|
|
gh release upload "$TAG" "$APK" --clobber
|
|
url=$(gh release view "$TAG" --json url --jq .url)
|
|
echo "url=$url" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: 🔔 Notify Slack of Release Attachment
|
|
if: ${{ steps.release-check.outputs.exists == 'true' }}
|
|
uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
|
|
with:
|
|
webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
|
|
webhook-type: incoming-webhook
|
|
payload-templated: true
|
|
payload: |
|
|
{"text": "Android APK attached to GitHub Release ${{ github.ref_name }}!\n```Asset: Bluesky-${{ needs.build.outputs.package-version }}.apk\nRelease: ${{ steps.attach.outputs.url }}```"}
|