Skip to content

feat/release android app in actions#119

Merged
matheusfillipe merged 36 commits into
mainfrom
feat/release-android-app-in-actions
Jan 4, 2026
Merged

feat/release android app in actions#119
matheusfillipe merged 36 commits into
mainfrom
feat/release-android-app-in-actions

Conversation

@matheusfillipe
Copy link
Copy Markdown
Contributor

@matheusfillipe matheusfillipe commented Dec 31, 2025

Summary by CodeRabbit

  • New Features

    • CI now builds and signs Android App Bundles and publishes to Google Play internal (branch) and production (tag) tracks, enabling branch-based internal releases and reproducible production releases.
    • Signed AAB artifacts are uploaded and reused across publish jobs for consistent delivery.
  • Chores

    • Version bumped to 0.2.2

✏️ Tip: You can customize this high-level summary in your review settings.

@coderabbitai ignore

…o feat/make-native-app-default-irc-application-handler
…o feat/make-native-app-default-irc-application-handler
…o feat/make-native-app-default-irc-application-handler
and fix the same modal dialog in 30 places, this is how these AI made
things start to get out of control @valware, WET as hell (also my
attempt to refactor the modals failed. Let me know if you ever see this.)
more repetitive fixes because we are n00bs
…o feat/make-native-app-default-irc-application-handler
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Dec 31, 2025

Note

Reviews paused

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
📝 Walkthrough

Walkthrough

Comments out automatic triggers and a collect-version guard in the publish workflow; adds Rust cache key and signed AAB artifact upload; introduces two GitHub Actions jobs to publish Android to Google Play (internal for branches, production for tags); bumps package.json version to 0.2.2.

Changes

Cohort / File(s) Summary
CI/CD Workflow Automation
\.github/workflows/publish.yaml
Commented out push/tag triggers and workflow_dispatch; removed collect-version if gating; added Rust cache shared-key android-builds; added artifact upload step signed-aab (retention-days: 1); added publish-android-google-play-internal job (auth, Java/SDK/NDK/Node/Rust, build, sign, upload to internal track); added publish-android-google-play-production job (downloads signed-aab, publishes to production track for tags); exposed both jobs as public entities.
Version Update
package.json
Bumped version from 0.2.1 to 0.2.2.

Sequence Diagram(s)

sequenceDiagram
    autonumber
    participant Trigger as Trigger (branch / tag)
    participant GHA as GitHub Actions
    participant GCloud as Google Cloud Auth
    participant Builder as Builder (Java/SDK/NDK/Node/Rust/Gradle)
    participant Signer as Keystore Signer
    participant Artifacts as GHA Artifact Store
    participant Play as Google Play API

    Trigger->>GHA: Start publish workflow
    GHA->>GCloud: Authenticate (service account)
    GCloud-->>GHA: Credentials

    alt Internal (branch)
        GHA->>Builder: Setup env & build AAB
        Builder-->>GHA: Unsigned AAB
        GHA->>Signer: Sign AAB
        Signer-->>GHA: Signed AAB
        GHA->>Play: Upload to internal track
        Play-->>GHA: Upload result
        GHA->>Artifacts: Upload `signed-aab` (retention=1d)
        Artifacts-->>GHA: Stored
    else Production (tag)
        GHA->>Artifacts: Download `signed-aab`
        Artifacts-->>GHA: Signed AAB
        GHA->>Play: Upload to production track
        Play-->>GHA: Upload result
    end
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

  • manually publish #71 — touches .github/workflows/publish.yaml triggers and collect-version gating, modifying related workflow logic.

Poem

🐇 I hopped through CI with a nimble cheer,
I cached the builds and kept the AAB near,
Branch carrots go to internal play,
Tags launch bundles out into the day,
Bumped the version — a tiny hop, sincere.

Pre-merge checks

✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely summarizes the main change: enabling Android app releases through GitHub Actions workflow automation.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions
Copy link
Copy Markdown

Pages Preview
Preview URL: https://feat-release-android-app-in.obsidianirc.pages.dev

Automated deployment preview for the PR in the Cloudflare Pages.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

♻️ Duplicate comments (7)
.github/workflows/publish.yaml (7)

5-9: Remove debug comments before merging.

This issue was already flagged in a previous review and remains unresolved. The workflow triggers are still commented out.


13-13: Uncomment the job condition.

This issue was already flagged in a previous review and remains unresolved.


210-215: File path mismatch: AAB artifact upload will fail.

This issue was already flagged in a previous review and remains unresolved. The rename step on line 208 moves the file before this upload attempts to read it from the original path.


241-245: Add missing authentication configuration for credentials file generation.

This issue was already flagged in a previous review and remains unresolved. The auth step needs both id: auth and create_credentials_file: true.


330-338: Use serviceAccountJson input instead of serviceAccountEmail for proper WIF authentication.

This issue was already flagged in a previous review and remains unresolved. The r0adkll/upload-google-play action requires the credentials file path from the auth step.


350-354: Add missing authentication configuration for credentials file generation.

This issue was already flagged in a previous review and remains unresolved. Same as the internal job, this auth step needs both id: auth and create_credentials_file: true.


362-370: Use serviceAccountJson input instead of serviceAccountEmail for proper WIF authentication.

This issue was already flagged in a previous review and remains unresolved. Same as the internal job, this upload action requires the credentials file path from the auth step.

📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c2571ab and 8d5bf8c.

📒 Files selected for processing (1)
  • .github/workflows/publish.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
  • GitHub Check: publish-tauri (windows-latest)
  • GitHub Check: publish-tauri (ubuntu-22.04)
  • GitHub Check: publish-tauri (macos-latest, --target aarch64-apple-darwin)
  • GitHub Check: publish-tauri (macos-latest, --target x86_64-apple-darwin)
  • GitHub Check: publish-ios
  • GitHub Check: publish-android-google-play-internal
  • GitHub Check: publish-android
  • GitHub Check: publish-linux-arm

Comment thread .github/workflows/publish.yaml Outdated
@matheusfillipe matheusfillipe force-pushed the feat/release-android-app-in-actions branch from 8d5bf8c to c504f6e Compare January 3, 2026 17:10
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

♻️ Duplicate comments (5)
.github/workflows/publish.yaml (5)

366-374: Artifact path dependency on upstream fix.

This step uses ./app-universal-release-signed.aab, which assumes the artifact uploaded on line 215 uses the original filename. However, line 215 currently has a path mismatch issue (file is renamed before upload). Once that's fixed, ensure this path matches the uploaded artifact name.


5-9: Remove debug comments before merging.

The workflow triggers remain commented out, causing the workflow to run on every push regardless of branch or tag.


13-13: Uncomment the job condition.

The condition restricting when collect-version runs remains commented out.


211-216: File path mismatch: AAB artifact upload will fail.

The AAB file is renamed on line 209 before this upload step runs, so the original path no longer exists.


289-307: The manual tauri.properties file will be overwritten during the build step.

Tauri's Android build process auto-generates tauri.properties and overwrites any existing file, making this step ineffective.

📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 8d5bf8c and c504f6e.

📒 Files selected for processing (1)
  • .github/workflows/publish.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
  • GitHub Check: publish-tauri (macos-latest, --target x86_64-apple-darwin)
  • GitHub Check: publish-ios
  • GitHub Check: publish-linux-arm
  • GitHub Check: publish-tauri (windows-latest)
  • GitHub Check: publish-tauri (ubuntu-22.04)
  • GitHub Check: publish-tauri (macos-latest, --target aarch64-apple-darwin)
  • GitHub Check: publish-android-google-play-internal
  • GitHub Check: publish-android
🔇 Additional comments (2)
.github/workflows/publish.yaml (2)

172-172: Good addition of shared cache key.

The shared cache key enables efficient cache reuse between the publish-android and publish-android-google-play-internal jobs, reducing build times.


333-341: Upload configuration is correct, pending auth fix.

The upload step correctly uses serviceAccountJson with the credentials file path. It will work once the auth step (lines 242-247) is fixed to include create_credentials_file: true.

Comment on lines +242 to +247
- name: Authenticate to Google Cloud
id: auth
uses: google-github-actions/auth@v2
with:
workload_identity_provider: ${{ secrets.GOOGLE_WIF_PROVIDER }}
service_account: ${{ secrets.GOOGLE_WIF_SERVICE_ACCOUNT }}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Add create_credentials_file: true to generate credentials file.

The auth step correctly includes id: auth, but is missing create_credentials_file: true. Without this, steps.auth.outputs.credentials_file_path (used on line 336) will be empty, causing the Google Play upload to fail.

🔎 Proposed fix
      - name: Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@v2
        with:
+         create_credentials_file: true
          workload_identity_provider: ${{ secrets.GOOGLE_WIF_PROVIDER }}
          service_account: ${{ secrets.GOOGLE_WIF_SERVICE_ACCOUNT }}
🤖 Prompt for AI Agents
In .github/workflows/publish.yaml around lines 242 to 247, the Google Cloud auth
step uses google-github-actions/auth@v2 but omits create_credentials_file: true,
so steps.auth.outputs.credentials_file_path will be empty; add
create_credentials_file: true under the with: block for that step so the action
writes a credentials file and makes credentials_file_path available for later
steps.

Comment on lines +353 to +358
- name: Authenticate to Google Cloud
id: auth
uses: google-github-actions/auth@v2
with:
workload_identity_provider: ${{ secrets.GOOGLE_WIF_PROVIDER }}
service_account: ${{ secrets.GOOGLE_WIF_SERVICE_ACCOUNT }}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Add create_credentials_file: true to generate credentials file.

Same issue as the internal job: the auth step is missing create_credentials_file: true, which will cause the upload on line 369 to fail.

🔎 Proposed fix
      - name: Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@v2
        with:
+         create_credentials_file: true
          workload_identity_provider: ${{ secrets.GOOGLE_WIF_PROVIDER }}
          service_account: ${{ secrets.GOOGLE_WIF_SERVICE_ACCOUNT }}
🤖 Prompt for AI Agents
In .github/workflows/publish.yaml around lines 353 to 358, the Google auth step
using google-github-actions/auth@v2 is missing the create_credentials_file: true
flag so the subsequent upload (line 369) will fail; add create_credentials_file:
true under the with: block for that step so the action writes a credentials file
(usable via GOOGLE_APPLICATION_CREDENTIALS) before running the upload.

@matheusfillipe matheusfillipe force-pushed the feat/release-android-app-in-actions branch from c504f6e to 384c159 Compare January 3, 2026 20:14
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

♻️ Duplicate comments (5)
.github/workflows/publish.yaml (5)

5-9: Remove debug comments before merging.

The workflow triggers remain commented out, causing the workflow to run on every push regardless of branch or tag. This issue was flagged in a previous review and remains unresolved.

🔎 Proposed fix
-  #   branches:
-  #     - main
-  #   tags:
-  #     - "v*.*.*"
-  # workflow_dispatch:
+    branches:
+      - main
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:

13-13: Uncomment the job condition.

The condition restricting when collect-version runs remains commented out. This issue was flagged in a previous review and remains unresolved.

🔎 Proposed fix
-    # if: github.ref_name == 'main' || github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'
+    if: github.ref_name == 'main' || github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'

211-216: File path mismatch: AAB artifact upload will fail.

The "Rename APK and AAB file" step (lines 207-209) renames app-universal-release-signed.aab to ObsidianIRC-*.aab before this upload step runs. The file at the original path no longer exists. This issue was flagged in a previous review and remains unresolved.

🔎 Proposed fix: Upload the renamed file path
      - name: Upload signed AAB artifact for Google Play
        uses: actions/upload-artifact@v4
        with:
          name: signed-aab
-          path: ./src-tauri/gen/android/app/build/outputs/bundle/universalRelease/app-universal-release-signed.aab
+          path: ./src-tauri/gen/android/app/build/outputs/bundle/universalRelease/ObsidianIRC-${{ needs.collect-version.outputs.current_version}}.aab
          retention-days: 1

Alternatively, move this upload step before the rename step (lines 206-209).


242-247: Add create_credentials_file: true to generate credentials file.

The auth step correctly includes id: auth, but is missing create_credentials_file: true. Without this, steps.auth.outputs.credentials_file_path (used on line 378) will be empty, causing the Google Play upload to fail. This issue was flagged in a previous review and remains unresolved.

🔎 Proposed fix
      - name: Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@v2
        with:
+         create_credentials_file: true
          workload_identity_provider: ${{ secrets.GOOGLE_WIF_PROVIDER }}
          service_account: ${{ secrets.GOOGLE_WIF_SERVICE_ACCOUNT }}

395-400: Add create_credentials_file: true to generate credentials file.

Same issue as the internal job: the auth step is missing create_credentials_file: true, which will cause the upload on line 411 to fail. This issue was flagged in a previous review and remains unresolved.

🔎 Proposed fix
      - name: Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@v2
        with:
+         create_credentials_file: true
          workload_identity_provider: ${{ secrets.GOOGLE_WIF_PROVIDER }}
          service_account: ${{ secrets.GOOGLE_WIF_SERVICE_ACCOUNT }}
🧹 Nitpick comments (1)
.github/workflows/publish.yaml (1)

235-237: Consider removing unnecessary contents: write permission.

Both Google Play publishing jobs request contents: write permission, but they only authenticate to Google Cloud and upload to Google Play—they don't modify the repository. The id-token: write permission is sufficient for Workload Identity Federation.

🔎 Optional refinement
     permissions:
-      contents: write
       id-token: write

Note: Keep contents: write if future changes require repository access.

Also applies to: 388-390

📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c504f6e and 384c159.

📒 Files selected for processing (1)
  • .github/workflows/publish.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
  • GitHub Check: publish-tauri (macos-latest, --target x86_64-apple-darwin)
  • GitHub Check: publish-tauri (macos-latest, --target aarch64-apple-darwin)
  • GitHub Check: publish-tauri (windows-latest)
  • GitHub Check: publish-tauri (ubuntu-22.04)
  • GitHub Check: publish-linux-arm
  • GitHub Check: publish-ios
  • GitHub Check: publish-android-google-play-internal
  • GitHub Check: publish-android
🔇 Additional comments (6)
.github/workflows/publish.yaml (6)

172-172: LGTM: Rust cache optimization.

Adding a shared cache key for Android builds is a good optimization that will reduce build times across the publish-android and Google Play publishing jobs.


375-383: LGTM: Authentication method fixed.

The r0adkll/upload-google-play@v1 action now correctly uses serviceAccountJson with the credentials file path from the auth step. This addresses the authentication issue flagged in the previous review.


408-416: Authentication method is correct, but depends on fixing artifact upload.

The production job correctly uses serviceAccountJson with the credentials file path. However, this job depends on the publish-android job's artifact upload (lines 211-216), which has a path mismatch issue. The production job will fail to download the artifact until that issue is resolved.

Ensure the artifact upload path in lines 211-216 is fixed first.


238-238: LGTM: Job conditions are mutually exclusive.

The internal job runs on branches (github.ref_type == 'branch') and the production job runs on tags (github.ref_type == 'tag'). This ensures only one Google Play publishing path executes per workflow run.

Also applies to: 391-391


282-322: Verify Google Play API credentials and error handling.

The version code fetching logic queries the Google Play API to find the highest existing version code and increment it. This approach is sound, but ensure:

  1. The service account has the necessary permissions for the Android Publisher API.
  2. Error handling is added if the API calls fail (e.g., network issues, permission errors, or if no releases exist yet).
  3. The fallback when jq -r '.releases[0].versionCodes[0] // 0' returns 0 is intentional for first releases.

Consider adding error checking:

#!/bin/bash
# Verify that the service account has androidpublisher scope
gcloud auth print-access-token --quiet || echo "Auth failed"

338-356: The approach is sound and should work correctly.

The build.gradle.kts file confirms that gradlew will read the manually-written tauri.properties file at configuration time (it checks if the file exists and loads properties from tauri.android.versionCode and tauri.android.versionName). Since bundleUniversalRelease is a standard Gradle task without regeneration logic, the version overrides will be applied correctly.

However, the suggested alternative approach won't work: tauri.conf.json has no bundle.android configuration section, so modifying it with jq and running npm run tauri android build would regenerate the entire Android project rather than provide a targeted rebuild. The current post-build property file override is actually more efficient than the suggested alternative.

@matheusfillipe matheusfillipe force-pushed the feat/release-android-app-in-actions branch 2 times, most recently from d401363 to 5048b19 Compare January 3, 2026 22:53
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

♻️ Duplicate comments (5)
.github/workflows/publish.yaml (5)

5-9: Remove debug comments before merging.

This issue was previously flagged and remains unresolved. The workflow triggers are still commented out.


13-13: Uncomment the job condition.

This issue was previously flagged and remains unresolved. The condition is still commented out.


242-247: Add create_credentials_file: true to generate credentials file.

This issue was previously flagged and remains unresolved. Without this flag, steps.auth.outputs.credentials_file_path will be empty, causing the Google Play upload to fail.


403-408: Add create_credentials_file: true to generate credentials file.

This issue was previously flagged and remains unresolved. Without this flag, the Google Play upload will fail.


211-216: File path mismatch: artifact upload will fail.

The AAB file is renamed on line 209 from app-universal-release-signed.aab to ObsidianIRC-${{ needs.collect-version.outputs.current_version}}.aab, but line 215 still references the old filename. After the mv command, the original file no longer exists at that path.

🔎 Proposed fix
      - name: Upload signed AAB artifact for Google Play
        uses: actions/upload-artifact@v4
        with:
          name: signed-aab
-          path: ./src-tauri/gen/android/app/build/outputs/bundle/universalRelease/app-universal-release-signed.aab
+          path: ./src-tauri/gen/android/app/build/outputs/bundle/universalRelease/ObsidianIRC-${{ needs.collect-version.outputs.current_version}}.aab
          retention-days: 1

Alternatively, move this upload step before the rename step on lines 206-209.

🧹 Nitpick comments (2)
.github/workflows/publish.yaml (2)

282-334: Consider adding error handling and validation for API responses.

The version code fetching logic makes multiple API calls with minimal error handling. If the Google Play API returns unexpected formats or errors, the script falls back to a hardcoded version 3000, which could cause version conflicts.

Consider adding:

  • Validation of API responses before parsing with jq
  • Explicit error messages when API calls fail
  • A more robust fallback strategy (e.g., read from a committed version file)

343-355: Validate that the sed commands successfully modified the file.

The sed commands assume specific patterns in the auto-generated build.gradle.kts. If Tauri changes its code generation, the substitutions will silently fail, resulting in incorrect version codes.

Consider adding verification after the sed commands:

if ! grep -q 'System.getenv("VERSION_CODE")' "$BUILD_GRADLE"; then
  echo "Error: Failed to patch versionCode in build.gradle.kts"
  exit 1
fi
📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d401363 and 5048b19.

📒 Files selected for processing (1)
  • .github/workflows/publish.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
  • GitHub Check: publish-tauri (windows-latest)
  • GitHub Check: publish-tauri (macos-latest, --target aarch64-apple-darwin)
  • GitHub Check: publish-tauri (macos-latest, --target x86_64-apple-darwin)
  • GitHub Check: publish-tauri (ubuntu-22.04)
  • GitHub Check: publish-android
  • GitHub Check: publish-android-google-play-internal
  • GitHub Check: publish-linux-arm
  • GitHub Check: publish-ios
🔇 Additional comments (5)
.github/workflows/publish.yaml (5)

172-172: LGTM!

The shared cache key enables cache reuse between the publish-android and publish-android-google-play-internal jobs, improving build performance.


249-280: LGTM!

The setup steps properly configure the build environment for Android, and the Rust cache shared key correctly matches the main Android publish job.


366-391: LGTM!

The signing and upload logic is correctly structured. Ensure the auth step is fixed (add create_credentials_file: true) for the upload to succeed.


393-399: LGTM!

The job correctly runs only on tags and depends on publish-android to ensure the signed AAB artifact is available.


410-424: Verify artifact filename consistency with the upload step.

This step assumes the artifact contains a file named app-universal-release-signed.aab (line 421), but the artifact upload step (line 215) has a path mismatch due to the rename operation. Once line 215 is fixed, ensure the filename here matches what was uploaded.

If the fix uploads the renamed file (ObsidianIRC-*.aab), update this accordingly:

      - name: Upload to Google Play - Production Track
        uses: r0adkll/upload-google-play@v1
        with:
          serviceAccountJson: ${{ steps.auth.outputs.credentials_file_path }}
          packageName: com.obsidianirc.dev
-          releaseFiles: ./app-universal-release-signed.aab
+          releaseFiles: ./ObsidianIRC-${{ needs.collect-version.outputs.current_version }}.aab
          track: production
          status: completed
          releaseName: ObsidianIRC v${{ needs.collect-version.outputs.current_version }}

Comment thread .github/workflows/publish.yaml Outdated
permissions:
contents: write
id-token: write
if: github.ref_type == 'branch'
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Condition allows internal releases from any branch.

The condition github.ref_type == 'branch' will trigger internal Google Play releases for all branches, including feature branches. This could cause resource waste and publish unintended builds to the internal track.

Consider restricting to the main branch:

-    if: github.ref_type == 'branch'
+    if: github.ref_name == 'main' && github.ref_type == 'branch'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if: github.ref_type == 'branch'
if: github.ref_name == 'main' && github.ref_type == 'branch'
🤖 Prompt for AI Agents
.github/workflows/publish.yaml around line 238: the job condition currently uses
github.ref_type == 'branch' which allows internal releases from any branch;
change the conditional to restrict to the main branch (for example replace with
github.ref == 'refs/heads/main' or use a repository variable like github.ref ==
format('refs/heads/{0}', env.MAIN_BRANCH)) so the internal Google Play release
only runs for the designated main branch.

@matheusfillipe matheusfillipe force-pushed the feat/release-android-app-in-actions branch from 5048b19 to b2825ce Compare January 3, 2026 23:35
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

♻️ Duplicate comments (5)
.github/workflows/publish.yaml (5)

5-9: Workflow triggers remain commented out.

This issue was previously flagged. The workflow will run on every push instead of only on main branch, tags, or manual dispatch.


13-13: Job condition remains commented out.

This issue was previously flagged. The collect-version job will run unconditionally on every push.


238-238: Job condition still allows internal releases from any branch.

This issue was previously flagged. Consider restricting to main branch to avoid publishing from feature branches.


242-247: Missing create_credentials_file: true in auth step.

This issue was previously flagged. Without it, steps.auth.outputs.credentials_file_path will be empty, causing the Google Play upload (line 398) to fail.


415-420: Missing create_credentials_file: true in auth step.

This issue was previously flagged. Same fix needed as the internal job's auth step.

🧹 Nitpick comments (1)
.github/workflows/publish.yaml (1)

282-346: Potential race condition in version code calculation.

If two concurrent internal builds query the API simultaneously, both may read the same MAX_VERSION and both will set NEW_VERSION = MAX_VERSION + 1, causing a version code conflict when the second upload is attempted.

Consider:

  1. Using a mutex/lock mechanism (GitHub Actions concurrency group with cancel-in-progress: false)
  2. Adding retry logic in the upload step to handle version conflicts

Also, the fallback strategy (3000 + run_number) could eventually conflict with actual version codes if they reach that range. Consider using a higher base (e.g., 1000000) or a timestamp-based approach.

🔎 Add concurrency control at job level
  publish-android-google-play-internal:
    runs-on: ubuntu-latest
    needs: [collect-version]
+   concurrency:
+     group: android-internal-release
+     cancel-in-progress: false
    permissions:
      contents: write
      id-token: write
📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 5048b19 and b2825ce.

📒 Files selected for processing (1)
  • .github/workflows/publish.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
  • GitHub Check: publish-tauri (ubuntu-22.04)
  • GitHub Check: publish-tauri (windows-latest)
  • GitHub Check: publish-tauri (macos-latest, --target aarch64-apple-darwin)
  • GitHub Check: publish-tauri (macos-latest, --target x86_64-apple-darwin)
  • GitHub Check: publish-linux-arm
  • GitHub Check: publish-android
  • GitHub Check: publish-android-google-play-internal
  • GitHub Check: publish-ios
🔇 Additional comments (3)
.github/workflows/publish.yaml (3)

168-172: Good cache optimization.

Adding shared-key: "android-builds" enables cache sharing between Android build jobs, reducing redundant compilation.


348-376: Good approach to override version dynamically.

This pattern—initializing the Android project, patching build.gradle.kts to read from environment variables, then building with custom VERSION_CODE/VERSION_NAME—correctly solves the issue where Tauri overwrites tauri.properties. The sed patterns maintain fallback to original values if env vars are unset.


422-436: Production release depends on correct artifact upload.

The releaseFiles path on line 433 expects ./app-universal-release-signed.aab, which matches what actions/download-artifact extracts from the signed-aab artifact. This path consistency depends on the publish-android job uploading the file with the original name (before rename), which conflicts with the current step ordering in that job.

Ensure the artifact upload in publish-android (lines 211-216) uploads the file with the expected name, or update this path accordingly.

Comment on lines +211 to +216
- name: Upload signed AAB artifact for Google Play
uses: actions/upload-artifact@v4
with:
name: signed-aab
path: ./src-tauri/gen/android/app/build/outputs/bundle/universalRelease/app-universal-release-signed.aab
retention-days: 1
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check artifact upload path, rename step, and production download expectations
echo "=== Rename step (lines 206-209 area) ==="
sed -n '205,210p' .github/workflows/publish.yaml

echo ""
echo "=== Artifact upload step (lines 211-216) ==="
sed -n '211,216p' .github/workflows/publish.yaml

echo ""
echo "=== Production job artifact download and usage (around line 433) ==="
sed -n '430,440p' .github/workflows/publish.yaml

Repository: ObsidianIRC/ObsidianIRC

Length of output: 1456


Fix artifact upload path after rename operation.

The AAB file is renamed to ObsidianIRC-{version}.aab in the rename step (lines 206-209), but the upload step (line 215) attempts to upload the original filename app-universal-release-signed.aab, which no longer exists after the rename. This causes the artifact upload to fail.

Update the upload path to reference the renamed file: ./src-tauri/gen/android/app/build/outputs/bundle/universalRelease/ObsidianIRC-${{ needs.collect-version.outputs.current_version}}.aab

Alternatively, if the production job expects the artifact named app-universal-release-signed.aab, exclude the AAB from the rename operation or adjust the production job to reference the renamed artifact.

🤖 Prompt for AI Agents
.github/workflows/publish.yaml lines 211-216: the upload step is still pointing
to the old filename app-universal-release-signed.aab which was renamed earlier
to ObsidianIRC-{version}.aab, so update the upload path to
./src-tauri/gen/android/app/build/outputs/bundle/universalRelease/ObsidianIRC-${{
needs.collect-version.outputs.current_version}}.aab (or alternatively reverse
the rename or adjust downstream jobs to expect the original filename) so the
artifact upload references the actual file produced.

@matheusfillipe
Copy link
Copy Markdown
Contributor Author

@coderabbitai pause

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Jan 3, 2026

✅ Actions performed

Reviews paused.

@matheusfillipe matheusfillipe force-pushed the feat/release-android-app-in-actions branch from 956e6c6 to 40632cb Compare January 4, 2026 01:12
@matheusfillipe matheusfillipe force-pushed the feat/release-android-app-in-actions branch 2 times, most recently from b0b9504 to fa8ff93 Compare January 4, 2026 13:14
@matheusfillipe matheusfillipe force-pushed the feat/release-android-app-in-actions branch from fa8ff93 to 93cf1a5 Compare January 4, 2026 13:30
@matheusfillipe
Copy link
Copy Markdown
Contributor Author

@ValwareIRC just some additions to the gh action to automatically deploy to playstore. Talk to me later to know more. Ill merge now to keep testing and improving.

@matheusfillipe matheusfillipe merged commit b2ce580 into main Jan 4, 2026
4 checks passed
@matheusfillipe matheusfillipe deleted the feat/release-android-app-in-actions branch January 4, 2026 13:43
zocram4cc pushed a commit to zocram4cc/ObsidianIRC that referenced this pull request Feb 17, 2026
* Add socket interface and its TCP implementation

* WIP

* WIP

* lint fixes

* functional

* fix lints

* fix build?

* use rustls for android

* fix url parsing manually because android webview is weird

* reduce logging

* fix url parser

* fix IOS build

* open irc uris in obsidian

* Mark "IRC" by default when opening irc urls

* improve iphone fitting

and fix the same modal dialog in 30 places, this is how these AI made
things start to get out of control @valware, WET as hell (also my
attempt to refactor the modals failed. Let me know if you ever see this.)

* handle irc uris in iphone

* avoid capitalizing stuff

more repetitive fixes because we are n00bs

* buffer until \r\n

* fix infinite rerender

* update lockfile

* 0.2.2

* add job to release android apk in playstore

* fix(workflows): Formatting

* test publish

* test production track

* 0.2.3

* prepare for production

* avoid version conflicts

* testing and simplifying internal release

* everything looks good so far
@coderabbitai coderabbitai Bot mentioned this pull request Mar 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant