Skip to content

fix(android): sign APK explicitly with apksigner after Gradle build #151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
izzywdev merged 1 commit into from
Jul 3, 2026
Merged

fix(android): sign APK explicitly with apksigner after Gradle build #151

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 17 additions & 12 deletions .github/workflows/build-android-apk.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,26 +108,31 @@ jobs:
KEYSTORE_STORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_STORE_PASSWORD }}
KEYSTORE_KEY_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_KEY_PASSWORD }}
run: |
# bubblewrap build always prompts interactively for keystore passwords (exit 130,
# no TTY in CI). Write key.properties directly and invoke Gradle instead.
# Use an absolute storeFile path — Gradle resolves relative paths from android/app/,
# not android/, so a relative path would miss the keystore.
printf 'storePassword=%s\nkeyPassword=%s\nkeyAlias=fuzefront\nstoreFile=%s/keystore/fuzefront-release.keystore\n' \
"${KEYSTORE_STORE_PASSWORD:-fuzefront2024}" \
"${KEYSTORE_KEY_PASSWORD:-fuzefront2024}" \
"$(pwd)" \
> key.properties
# Gradle signing via key.properties doesn't apply (bubblewrap template quirk).
# Build the unsigned APK then sign it explicitly with apksigner.
./gradlew assembleRelease

UNSIGNED="app/build/outputs/apk/release/app-release-unsigned.apk"
SIGNED="app/build/outputs/apk/release/app-release.apk"
BUILD_TOOLS=$(ls "$ANDROID_HOME/build-tools/" | sort -V | tail -1)
APKSIGNER="$ANDROID_HOME/build-tools/$BUILD_TOOLS/apksigner"

"$APKSIGNER" sign \
--ks ./keystore/fuzefront-release.keystore \
--ks-pass "pass:${KEYSTORE_STORE_PASSWORD:-fuzefront2024}" \
--key-pass "pass:${KEYSTORE_KEY_PASSWORD:-fuzefront2024}" \
--ks-key-alias fuzefront \
--out "$SIGNED" \
"$UNSIGNED"

"$APKSIGNER" verify --verbose "$SIGNED"

- name: Locate signed APK
id: apk
working-directory: android
run: |
# Prefer the signed APK; fall back to any APK. Strip leading "./" so
# upload-artifact doesn't reject the path as a relative "." component.
APK=$(find . -path "*/release/app-release.apk" | head -1)
[ -z "$APK" ] && APK=$(find . -name "*.apk" | grep -v unsigned | head -1)
[ -z "$APK" ] && APK=$(find . -name "*.apk" | head -1)
APK="${APK#./}"
echo "path=android/$APK" >> "$GITHUB_OUTPUT"
echo "Found: $APK"
Expand Down
Loading