NotelyCapture/.github/workflows/release-signed.yml at main · stanvx/NotelyCapture · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
# GitHub Actions Workflow for Building Signed Release APKs

name: Build Signed Release APK

on:
  release:
    types: [published]
  workflow_dispatch: # Allows manual trigger

# Prevent concurrent builds
concurrency:
  group: build-signed-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build-signed:
    runs-on: ubuntu-latest
    timeout-minutes: 30

    # Minimal permissions following security best practices
    permissions:
      contents: write # Required to upload release assets
      id-token: write # Required for OIDC token generation

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up JDK 17
      uses: actions/setup-java@v4
      with:
        java-version: '17'
        distribution: 'temurin'
        cache: 'gradle'

    - name: Setup Gradle
      uses: gradle/actions/setup-gradle@v4.0.0
      with:
        gradle-home-cache-cleanup: true

    - name: Make gradlew executable
      run: chmod +x ./gradlew

    - name: Decode Keystore
      run: |
        echo "${KEYSTORE_BASE64}" | base64 --decode > ${{ github.workspace }}/release-keystore.jks
        ls -la ${{ github.workspace }}/release-keystore.jks
        echo "Keystore file created at: ${{ github.workspace }}/release-keystore.jks"
      env:
        KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}

    - name: Debug environment variables
      run: |
        echo "KEYSTORE_FILE: $KEYSTORE_FILE"
        echo "KEYSTORE_PASSWORD is set: $([[ -n "$KEYSTORE_PASSWORD" ]] && echo "yes" || echo "no")"
        echo "KEY_ALIAS: $KEY_ALIAS"
        echo "KEY_PASSWORD is set: $([[ -n "$KEY_PASSWORD" ]] && echo "yes" || echo "no")"
        echo "Working directory: $(pwd)"
        echo "Keystore exists: $(test -f "$KEYSTORE_FILE" && echo "yes" || echo "no")"
      env:
        KEYSTORE_FILE: ${{ github.workspace }}/release-keystore.jks
        KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
        KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
        KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}

    - name: Build signed release APK
      run: ./gradlew assembleRelease --info
      env:
        KEYSTORE_FILE: ${{ github.workspace }}/release-keystore.jks
        KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
        KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
        KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}

    - name: Upload signed release APK
      uses: actions/upload-artifact@v4
      with:
        name: signed-release-apk
        path: |
          **/build/outputs/apk/release/*.apk
        retention-days: 90

    - name: Find Release APK for GitHub Release
      if: github.event_name == 'release'
      id: find-release-apk
      run: |
        RELEASE_APK=$(find . -name "*release*.apk" -type f | head -1)
        echo "release_apk=$RELEASE_APK" >> $GITHUB_OUTPUT
        echo "Found Release APK: $RELEASE_APK"

    - name: Upload APK to GitHub Release
      if: github.event_name == 'release' && steps.find-release-apk.outputs.release_apk != ''
      uses: softprops/action-gh-release@v2.0.4
      with:
        files: ${{ steps.find-release-apk.outputs.release_apk }}
        fail_on_unmatched_files: false
        name: ${{ github.event.release.tag_name }}
        body: |
          Signed APK build for ${{ github.event.release.tag_name }}

          This APK was built and signed automatically using GitHub Actions.

          📱 **Installation**: Download the APK and install on your Android device
          🔐 **Security**: This APK is digitally signed for authenticity