Samuel Newman
325 lines
12 KiB
YAML
325 lines
12 KiB
YAML
---
|
|
name: Build and Submit Android
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
profile:
|
|
type: choice
|
|
description: Build profile to use
|
|
options:
|
|
- testflight-android
|
|
- production
|
|
submit:
|
|
type: boolean
|
|
description: Submit the build to Google Play (disable to only produce the APK artifact)
|
|
default: true
|
|
workflow_call:
|
|
inputs:
|
|
profile:
|
|
type: string
|
|
description: Build profile to use
|
|
required: true
|
|
submit:
|
|
type: boolean
|
|
description: Submit the build to Google Play (disable to only produce the APK artifact)
|
|
default: true
|
|
runner:
|
|
type: string
|
|
description: Runner for the build job (defaults to Linux-x64-32core)
|
|
required: false
|
|
default: ''
|
|
outputs:
|
|
package-version:
|
|
description: Version from package.json
|
|
value: ${{ jobs.build.outputs.package-version }}
|
|
version-code:
|
|
description: Android version code
|
|
value: ${{ jobs.build.outputs.version-code }}
|
|
secrets:
|
|
EXPO_TOKEN:
|
|
required: true
|
|
ENV_TOKEN:
|
|
required: true
|
|
SENTRY_DSN:
|
|
required: true
|
|
BITDRIFT_API_KEY:
|
|
required: true
|
|
EXPO_PUBLIC_GCP_PROJECT_ID:
|
|
required: true
|
|
GOOGLE_SERVICES_TOKEN:
|
|
required: true
|
|
SENTRY_AUTH_TOKEN:
|
|
required: true
|
|
SLACK_CLIENT_ALERT_WEBHOOK:
|
|
required: true
|
|
ANDROID_KEYSTORE_BASE64:
|
|
required: true
|
|
ANDROID_KEYSTORE_PASSWORD:
|
|
required: true
|
|
ANDROID_KEY_ALIAS:
|
|
required: true
|
|
ANDROID_KEY_PASSWORD:
|
|
required: true
|
|
|
|
# Deploys happen via EAS using EXPO_TOKEN; the GITHUB_TOKEN only checks out code
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
if: github.repository == 'bluesky-social/social-app'
|
|
name: Build Android
|
|
runs-on: ${{ inputs.runner || 'Linux-x64-32core' }}
|
|
concurrency:
|
|
group: android-build
|
|
cancel-in-progress: false
|
|
outputs:
|
|
package-version: ${{ steps.get-build-info.outputs.PACKAGE_VERSION }}
|
|
version-code: ${{ steps.get-build-info.outputs.BSKY_ANDROID_VERSION_CODE }}
|
|
steps:
|
|
- name: ⬇️ Checkout
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
fetch-depth: 5
|
|
|
|
- name: 🔧 Setup Expo project
|
|
uses: ./.github/actions/setup-expo-project
|
|
with:
|
|
expo-token: ${{ secrets.EXPO_TOKEN }}
|
|
|
|
- uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
|
|
with:
|
|
distribution: "temurin"
|
|
java-version: "17"
|
|
|
|
- name: 🔤 Compile translations
|
|
uses: ./.github/actions/compile-i18n
|
|
|
|
# EXPO_PUBLIC_ENV is handled in eas.json
|
|
- name: ✏️ Write environment variables
|
|
id: env
|
|
uses: ./.github/actions/write-env
|
|
with:
|
|
env-token: ${{ secrets.ENV_TOKEN }}
|
|
sentry-dsn: ${{ secrets.SENTRY_DSN }}
|
|
bitdrift-api-key: ${{ secrets.BITDRIFT_API_KEY }}
|
|
gcp-project-id: ${{ secrets.EXPO_PUBLIC_GCP_PROJECT_ID }}
|
|
google-services-token: ${{ secrets.GOOGLE_SERVICES_TOKEN }}
|
|
|
|
- name: 🏗️ EAS Build
|
|
env:
|
|
PROFILE: ${{ inputs.profile || 'testflight-android' }}
|
|
run: >
|
|
SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
|
|
SENTRY_RELEASE=${{ steps.env.outputs.release-version }}
|
|
SENTRY_DIST=${{ steps.env.outputs.bundle-identifier }}
|
|
pnpm use-build-number-with-bump
|
|
pnpm eas build -p android
|
|
--profile $PROFILE
|
|
--local --output build.aab --non-interactive
|
|
|
|
- name: 📚 Get version from package.json
|
|
id: get-build-info
|
|
run: bash scripts/setGitHubOutput.sh
|
|
|
|
# Hands the built bundle off to the submit / universalApk jobs. Retention is
|
|
# deliberately short (1 day) since it's only an intra-run handoff artifact.
|
|
- name: 🚀 Upload AAB artifact
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: android-aab-${{ github.run_id }}
|
|
retention-days: 1
|
|
if-no-files-found: error
|
|
path: build.aab
|
|
|
|
submit:
|
|
name: Submit to Google Play
|
|
runs-on: ubuntu-latest
|
|
needs: [build]
|
|
# Submit unless explicitly disabled; on events where inputs is empty this still submits.
|
|
if: ${{ inputs.submit != false }}
|
|
steps:
|
|
# eas submit reads app config from the repo, so we need a checkout.
|
|
- name: ⬇️ Checkout
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
fetch-depth: 5
|
|
|
|
- name: 🔧 Setup Expo project
|
|
uses: ./.github/actions/setup-expo-project
|
|
with:
|
|
expo-token: ${{ secrets.EXPO_TOKEN }}
|
|
|
|
- name: ⬇️ Download AAB artifact
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: android-aab-${{ github.run_id }}
|
|
|
|
- name: 🚀 Submit to Google Play
|
|
env:
|
|
PROFILE: ${{ inputs.profile || 'testflight-android' }}
|
|
run: pnpm eas submit -p android --profile $PROFILE --non-interactive --path build.aab
|
|
|
|
- name: 🔔 Notify Slack of Play Store Submission
|
|
if: ${{ inputs.profile == 'production' }}
|
|
uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
|
|
with:
|
|
webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
|
|
webhook-type: incoming-webhook
|
|
payload-templated: true
|
|
payload: |
|
|
{"text": "Android ${{ inputs.profile || 'testflight-android' }} build submitted to Google Play!\n```Version Number: ${{ needs.build.outputs.package-version }}\nBuild Number: ${{ needs.build.outputs.version-code }}```"}
|
|
|
|
# Record the commit only after a successful submit, so a failed submit doesn't
|
|
# advance the "most recent testflight" marker.
|
|
- name: ⬇️ Restore Cache
|
|
id: get-base-commit
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
if: ${{ inputs.profile == 'testflight-android' }}
|
|
with:
|
|
path: most-recent-testflight-commit.txt
|
|
key: most-recent-testflight-commit
|
|
|
|
- name: ✏️ Write commit hash to cache
|
|
if: ${{ inputs.profile == 'testflight-android' }}
|
|
env:
|
|
GITHUB_SHA: ${{ github.sha }}
|
|
run: echo $GITHUB_SHA > most-recent-testflight-commit.txt
|
|
|
|
# Runs in parallel with submit: the QA APK shouldn't be blocked by a Play submission failure.
|
|
universalApk:
|
|
name: Build universal APK
|
|
runs-on: ubuntu-latest
|
|
needs: [build]
|
|
outputs:
|
|
apk-artifact-name: build-${{ steps.timestamp.outputs.time }}.apk
|
|
steps:
|
|
- name: ⬇️ Download AAB artifact
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: android-aab-${{ github.run_id }}
|
|
|
|
# bundletool needs a JRE. ubuntu-latest ships a default JDK, but pin it explicitly
|
|
# like the build job so the toolchain is deterministic.
|
|
- uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
|
|
with:
|
|
distribution: "temurin"
|
|
java-version: "17"
|
|
|
|
- name: 🔧 Setup bundletool
|
|
uses: amyu/setup-bundletool@cc2e1857284660bd625e43f2c8a45626f034302f # v1.1
|
|
with:
|
|
version: "1.18.3"
|
|
|
|
- name: 🔑 Decode keystore
|
|
env:
|
|
ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
|
|
run: echo "$ANDROID_KEYSTORE_BASE64" | base64 --decode > keystore.jks
|
|
|
|
- name: 📦 Build signed universal APK
|
|
env:
|
|
ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
|
|
ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
|
|
ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
|
|
run: |
|
|
bundletool build-apks \
|
|
--bundle=build.aab \
|
|
--output=universal.apks \
|
|
--mode=universal \
|
|
--ks=keystore.jks \
|
|
--ks-pass=pass:"$ANDROID_KEYSTORE_PASSWORD" \
|
|
--ks-key-alias="$ANDROID_KEY_ALIAS" \
|
|
--key-pass=pass:"$ANDROID_KEY_PASSWORD"
|
|
|
|
- name: 📋 Rename to .zip for extraction
|
|
run: mv universal.apks universal.zip
|
|
|
|
- name: 📦 Extract universal APK
|
|
run: unzip -p universal.zip universal.apk > build.apk
|
|
|
|
- name: ⏰ Get a timestamp
|
|
id: timestamp
|
|
run: echo "time=$(date -u +'%m-%d-%H-%M-%S')" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: 🚀 Upload APK Artifact
|
|
id: upload-artifact
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
retention-days: 30
|
|
compression-level: 6
|
|
name: build-${{ steps.timestamp.outputs.time }}.apk
|
|
path: build.apk
|
|
|
|
- name: 🔔 Notify Slack of APK Artifact
|
|
uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
|
|
with:
|
|
webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
|
|
webhook-type: incoming-webhook
|
|
payload-templated: true
|
|
payload: |
|
|
{"text": "Android ${{ inputs.profile || 'testflight-android' }} APK is ready for testing!\n```Artifact: ${{ steps.upload-artifact.outputs.artifact-url }}\nVersion Number: ${{ needs.build.outputs.package-version }}\nBuild Number: ${{ needs.build.outputs.version-code }}```"}
|
|
|
|
# Releases are cut from tags named after the version (e.g. "1.124.0"), so when a production
|
|
# build is dispatched against such a tag we attach the APK to the matching release. This runs
|
|
# as a separate job so that `contents: write` is isolated here and the build job stays read-only.
|
|
attachToRelease:
|
|
name: Attach APK to GitHub Release
|
|
runs-on: ubuntu-latest
|
|
needs: [build, universalApk]
|
|
if: ${{ inputs.profile == 'production' && github.ref_type == 'tag' && github.repository == 'bluesky-social/social-app' }}
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
# We only attach to a release that already exists — never create one.
|
|
- name: 🔎 Check for matching GitHub Release
|
|
id: release-check
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
TAG: ${{ github.ref_name }}
|
|
run: |
|
|
status=$(curl -sS -o /dev/null -w '%{http_code}' \
|
|
-H "Authorization: Bearer $GH_TOKEN" \
|
|
-H "Accept: application/vnd.github+json" \
|
|
"${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}")
|
|
if [ "$status" = "200" ]; then
|
|
echo "Found GitHub Release for tag $TAG"
|
|
echo "exists=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "No GitHub Release found for tag $TAG (HTTP $status); skipping APK attachment."
|
|
echo "exists=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: ⬇️ Download APK artifact
|
|
if: ${{ steps.release-check.outputs.exists == 'true' }}
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: ${{ needs.universalApk.outputs.apk-artifact-name }}
|
|
|
|
- name: 🏷️ Rename APK for release
|
|
if: ${{ steps.release-check.outputs.exists == 'true' }}
|
|
run: cp build.apk "Bluesky-${{ needs.build.outputs.package-version }}.apk"
|
|
|
|
- name: 📎 Attach APK to GitHub Release
|
|
id: attach
|
|
if: ${{ steps.release-check.outputs.exists == 'true' }}
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GH_REPO: ${{ github.repository }}
|
|
TAG: ${{ github.ref_name }}
|
|
APK: Bluesky-${{ needs.build.outputs.package-version }}.apk
|
|
run: |
|
|
gh release upload "$TAG" "$APK" --clobber
|
|
url=$(gh release view "$TAG" --json url --jq .url)
|
|
echo "url=$url" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: 🔔 Notify Slack of Release Attachment
|
|
if: ${{ steps.release-check.outputs.exists == 'true' }}
|
|
uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
|
|
with:
|
|
webhook: ${{ secrets.SLACK_CLIENT_ALERT_WEBHOOK }}
|
|
webhook-type: incoming-webhook
|
|
payload-templated: true
|
|
payload: |
|
|
{"text": "Android APK attached to GitHub Release ${{ github.ref_name }}!\n```Asset: Bluesky-${{ needs.build.outputs.package-version }}.apk\nRelease: ${{ steps.attach.outputs.url }}```"}
|