-
Notifications
You must be signed in to change notification settings - Fork 22
feat/release android app in actions #119
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
b8f3823
04a26a1
d895bee
311a721
5d1374a
9d9f10d
4587df2
b862583
32ba697
dd6b760
2cc4432
aeb33e4
24e5016
41f5dcb
9b0afd6
01ad445
e2e0ea4
113cb10
c1c58c9
ce26a64
795d570
7e58700
5a349f8
deb1256
a8b2d53
6166cdd
e7a374f
d3e968a
a8383bd
b2825ce
40632cb
a2ae5aa
7ad40d4
7f707e1
93cf1a5
f7a2296
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -7,6 +7,11 @@ on: | |
| tags: | ||
| - "v*.*.*" | ||
| workflow_dispatch: | ||
| inputs: | ||
| google-playstore-version: | ||
| description: 'Optional: Override Google Play version code' | ||
| required: false | ||
| type: string | ||
|
|
||
| jobs: | ||
| collect-version: | ||
|
|
@@ -169,6 +174,7 @@ jobs: | |
| uses: swatinem/rust-cache@v2 | ||
| with: | ||
| workspaces: "./src-tauri -> target" | ||
| shared-key: "android-builds" | ||
|
|
||
| - name: Install dependencies | ||
| run: npm install | ||
|
|
@@ -207,6 +213,13 @@ jobs: | |
| mv ./src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release-signed.apk ./src-tauri/gen/android/app/build/outputs/apk/universal/release/ObsidianIRC-${{ needs.collect-version.outputs.current_version}}.apk | ||
| mv ./src-tauri/gen/android/app/build/outputs/bundle/universalRelease/app-universal-release-signed.aab ./src-tauri/gen/android/app/build/outputs/bundle/universalRelease/ObsidianIRC-${{ needs.collect-version.outputs.current_version}}.aab | ||
|
|
||
| - name: Upload signed AAB artifact for Google Play | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: signed-aab | ||
| path: ./src-tauri/gen/android/app/build/outputs/bundle/universalRelease/ObsidianIRC-${{ needs.collect-version.outputs.current_version }}.aab | ||
| retention-days: 1 | ||
|
|
||
| - name: Publish | ||
| uses: softprops/action-gh-release@v2 | ||
| with: | ||
|
|
@@ -221,6 +234,165 @@ jobs: | |
| ./src-tauri/gen/android/app/build/outputs/apk/universal/release/ObsidianIRC-${{ needs.collect-version.outputs.current_version}}.apk | ||
| ./src-tauri/gen/android/app/build/outputs/bundle/universalRelease/ObsidianIRC-${{ needs.collect-version.outputs.current_version}}.aab | ||
|
|
||
| publish-android-google-play-internal: | ||
| runs-on: ubuntu-latest | ||
| needs: [collect-version] | ||
| permissions: | ||
| contents: write | ||
| id-token: write | ||
| # Only run on pushes to main branch OR manual workflow dispatch | ||
| if: (github.ref_type == 'branch' && github.ref_name == 'main') || github.event_name == 'workflow_dispatch' | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Authenticate to Google Cloud | ||
| id: auth | ||
| uses: google-github-actions/auth@v2 | ||
| with: | ||
| workload_identity_provider: ${{ secrets.GOOGLE_WIF_PROVIDER }} | ||
| service_account: ${{ secrets.GOOGLE_WIF_SERVICE_ACCOUNT }} | ||
|
Comment on lines
+248
to
+253
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add The auth step correctly includes 🔎 Proposed fix - name: Authenticate to Google Cloud
id: auth
uses: google-github-actions/auth@v2
with:
+ create_credentials_file: true
workload_identity_provider: ${{ secrets.GOOGLE_WIF_PROVIDER }}
service_account: ${{ secrets.GOOGLE_WIF_SERVICE_ACCOUNT }}🤖 Prompt for AI Agents |
||
| token_format: 'access_token' | ||
| access_token_scopes: 'https://www.googleapis.com/auth/androidpublisher' | ||
|
|
||
| - name: Setup Java | ||
| uses: actions/setup-java@v4 | ||
| with: | ||
| distribution: "zulu" | ||
| java-version: "22" | ||
| cache: "gradle" | ||
|
|
||
| - name: Setup Android SDK | ||
| uses: android-actions/setup-android@v3 | ||
|
|
||
| - name: Install NDK | ||
| run: sdkmanager "ndk;27.0.11902837" | ||
|
|
||
| - name: Setup Node | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: lts/* | ||
| cache: "npm" | ||
|
|
||
| - name: Install Rust | ||
| uses: dtolnay/rust-toolchain@stable | ||
| with: | ||
| targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android | ||
|
|
||
| - name: Rust cache | ||
| uses: swatinem/rust-cache@v2 | ||
| with: | ||
| workspaces: "./src-tauri -> target" | ||
| shared-key: "android-builds" | ||
|
|
||
| - name: Install dependencies | ||
| run: npm install | ||
|
|
||
| - name: Create internal version code | ||
| id: playstore_version | ||
| run: | | ||
| # Check if version is manually overridden via workflow_dispatch | ||
| if [ -n "${{ inputs.google-playstore-version }}" ]; then | ||
| echo "✅ Using manually specified version code: ${{ inputs.google-playstore-version }}" | ||
| echo "version_code=${{ inputs.google-playstore-version }}" >> $GITHUB_OUTPUT | ||
| exit 0 | ||
| fi | ||
|
|
||
| FALLBACK_VERSION=$((1000000 + ${{ github.run_number }})) | ||
| echo "Fallback version code: $FALLBACK_VERSION (1,000,000 + run_number)" | ||
| echo "version_code=$FALLBACK_VERSION" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Initialize Android project | ||
| run: npm run tauri android init -- --ci | ||
| env: | ||
| NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/27.0.11902837 | ||
| ANDROID_NDK_ROOT: ${{ env.ANDROID_HOME }}/ndk/27.0.11902837 | ||
| ANDROID_NDK: ${{ env.ANDROID_HOME }}/ndk/27.0.11902837 | ||
|
|
||
| - name: Patch build.gradle.kts to use environment variables | ||
| run: | | ||
| BUILD_GRADLE="src-tauri/gen/android/app/build.gradle.kts" | ||
|
|
||
| # Backup original | ||
| cp "$BUILD_GRADLE" "${BUILD_GRADLE}.bak" | ||
|
|
||
| # Replace versionCode and versionName lines to use env vars with fallback | ||
| sed -i 's/versionCode = tauriProperties.*/versionCode = System.getenv("VERSION_CODE")?.toIntOrNull() ?: tauriProperties.getProperty("tauri.android.versionCode", "1").toInt()/' "$BUILD_GRADLE" | ||
| sed -i 's/versionName = tauriProperties.*/versionName = System.getenv("VERSION_NAME") ?: tauriProperties.getProperty("tauri.android.versionName", "1.0")/' "$BUILD_GRADLE" | ||
|
|
||
| echo "Patched build.gradle.kts to use environment variables" | ||
| grep -A 2 "versionCode =" "$BUILD_GRADLE" | ||
|
|
||
| - name: Build Android with custom version | ||
| run: npm run tauri android build | ||
| env: | ||
| NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/27.0.11902837 | ||
| ANDROID_NDK_ROOT: ${{ env.ANDROID_HOME }}/ndk/27.0.11902837 | ||
| ANDROID_NDK: ${{ env.ANDROID_HOME }}/ndk/27.0.11902837 | ||
| VERSION_CODE: ${{ steps.playstore_version.outputs.version_code }} | ||
| VERSION_NAME: internal-${{ github.run_number }} | ||
|
|
||
| - name: Extract android signing key | ||
| run: | | ||
| echo "${{ secrets.ANDROID_RELEASE_KEYSTORE }}" > src-tauri/gen/android/release.jks.base64 | ||
| base64 -d src-tauri/gen/android/release.jks.base64 > src-tauri/gen/android/release.decrypted.jks | ||
|
|
||
| - name: Sign AAB | ||
| run: | | ||
| ${{ env.ANDROID_HOME }}/build-tools/34.0.0/apksigner sign \ | ||
| --min-sdk-version 22 \ | ||
| --v1-signing-enabled true \ | ||
| --v2-signing-enabled true \ | ||
| --ks src-tauri/gen/android/release.decrypted.jks \ | ||
| --ks-key-alias ${{ secrets.ANDROID_RELEASE_KEY }} \ | ||
| --ks-pass pass:${{ secrets.ANDROID_RELEASE_PASSWORD }} \ | ||
| --out src-tauri/gen/android/app/build/outputs/bundle/universalRelease/app-universal-release-signed.aab \ | ||
| src-tauri/gen/android/app/build/outputs/bundle/universalRelease/app-universal-release.aab | ||
|
|
||
| - name: Upload to Google Play - Internal Track | ||
| uses: r0adkll/upload-google-play@v1 | ||
| with: | ||
| serviceAccountJson: ${{ steps.auth.outputs.credentials_file_path }} | ||
| packageName: com.obsidianirc.dev | ||
| releaseFiles: src-tauri/gen/android/app/build/outputs/bundle/universalRelease/app-universal-release-signed.aab | ||
| track: internal | ||
| status: completed | ||
| releaseName: Internal build ${{ github.run_number }} | ||
|
Comment on lines
+351
to
+359
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🌐 Web query:
💡 Result: Yes — use GitHub OIDC / Workload Identity Federation (WIF) via google-github-actions/auth to create a short‑lived credential file and pass its path (or contents) into r0adkll/upload-google-play. Minimal example (YAML):
Notes
Sources 🌐 Web query:
💡 Result: Yes — r0adkll/upload-google-play supports using Workload Identity Federation (WIF). Process (concise):
Sources:
References: 🌐 Web query:
💡 Result: Short summary — authentication methods supported by r0adkll/upload-google-play:
Additional required steps: enable the Android Publisher API, create the GCP service account, and invite that service account in Play Console with app permissions. [1] Sources: r0adkll/upload-google-play README. [1] google-github-actions/auth README (Workload Identity / service account key details). [2] Use The Pass the credentials file path from the with:
serviceAccountJson: ${{ steps.auth.outputs.credentials_file_path }}
packageName: com.obsidianirc.dev
releaseFiles: src-tauri/gen/android/app/build/outputs/bundle/universalRelease/app-universal-release-signed.aab
track: internal
status: completed
releaseName: Internal build ${{ github.run_number }}Ensure the auth step has 🤖 Prompt for AI Agents |
||
|
|
||
| publish-android-google-play-production: | ||
| runs-on: ubuntu-latest | ||
| needs: [collect-version, publish-android] | ||
| permissions: | ||
| contents: write | ||
| id-token: write | ||
| if: github.ref_type == 'tag' | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Authenticate to Google Cloud | ||
| id: auth | ||
| uses: google-github-actions/auth@v2 | ||
| with: | ||
| workload_identity_provider: ${{ secrets.GOOGLE_WIF_PROVIDER }} | ||
| service_account: ${{ secrets.GOOGLE_WIF_SERVICE_ACCOUNT }} | ||
|
Comment on lines
+371
to
+376
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add Same issue as the internal job: the auth step is missing 🔎 Proposed fix - name: Authenticate to Google Cloud
id: auth
uses: google-github-actions/auth@v2
with:
+ create_credentials_file: true
workload_identity_provider: ${{ secrets.GOOGLE_WIF_PROVIDER }}
service_account: ${{ secrets.GOOGLE_WIF_SERVICE_ACCOUNT }}🤖 Prompt for AI Agents |
||
| token_format: 'access_token' | ||
| access_token_scopes: 'https://www.googleapis.com/auth/androidpublisher' | ||
|
|
||
| - name: Download signed AAB artifact | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: signed-aab | ||
| path: ./ | ||
|
|
||
| - name: Upload to Google Play - Production Track | ||
| uses: r0adkll/upload-google-play@v1 | ||
| with: | ||
| serviceAccountJson: ${{ steps.auth.outputs.credentials_file_path }} | ||
| packageName: com.obsidianirc.dev | ||
| releaseFiles: ./ObsidianIRC-${{ needs.collect-version.outputs.current_version }}.aab | ||
| track: production | ||
| status: completed | ||
| releaseName: ObsidianIRC v${{ needs.collect-version.outputs.current_version }} | ||
|
|
||
| publish-ios: | ||
| runs-on: macos-latest | ||
| needs: collect-version | ||
|
|
||
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: ObsidianIRC/ObsidianIRC
Length of output: 1456
Fix artifact upload path after rename operation.
The AAB file is renamed to
ObsidianIRC-{version}.aabin the rename step (lines 206-209), but the upload step (line 215) attempts to upload the original filenameapp-universal-release-signed.aab, which no longer exists after the rename. This causes the artifact upload to fail.Update the upload path to reference the renamed file:
./src-tauri/gen/android/app/build/outputs/bundle/universalRelease/ObsidianIRC-${{ needs.collect-version.outputs.current_version}}.aabAlternatively, if the production job expects the artifact named
app-universal-release-signed.aab, exclude the AAB from the rename operation or adjust the production job to reference the renamed artifact.🤖 Prompt for AI Agents