Makussu/subtracks
1
0
Fork 0
mirror of https://github.com/austinried/subtracks.git synced 2026-11-10 15:11:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

ci: share the build as a composite action

Browse Source 
Replace the reusable workflow with .github/actions/build plus a nested
nix setup action, invoked as a step. CI and the next build stay a single
job (no extra runner or Nix restore); the release keeps its build/publish
split for credential isolation.
This commit is contained in:
austinried
2026-10-08 18:52:44 +00:00
parent af3741a549
commit 8fb930c2ce
6 changed files with 53 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-next.yml
+13 -5
View File
@@ -9,10 +9,18 @@ permissions:
jobs:
build:
runs-on: ubuntu-26.04
timeout-minutes: 60
permissions:
contents: read
uses: ./.github/workflows/build.yml
with:
gradle-args: ":app:assembleDebug :app:assembleNext --no-daemon"
artifact-name: subtracks-next
artifact-path: app/build/outputs/apk
steps:
- uses: actions/checkout@v7
with:
persist-credentials: false
- uses: ./.github/actions/build
with:
gradle-args: ":app:assembleDebug :app:assembleNext --no-daemon"
- uses: actions/upload-artifact@v7
with:
name: subtracks-next
path: app/build/outputs/apk
.github/workflows/build.yml
-95
View File
@@ -1,95 +0,0 @@
name: Build
on:
workflow_call:
inputs:
gradle-args:
description: Gradle tasks and flags to run
required: true
type: string
sign:
description: Decode and use the store keystore
required: false
type: boolean
default: false
artifact-name:
description: If set, upload the build outputs as an artifact with this name
required: false
type: string
default: ""
artifact-path:
description: Path uploaded when artifact-name is set
required: false
type: string
default: ""
secrets:
KEYSTORE_BASE64:
required: false
KEYPROPERTIES_BASE64:
required: false
KEYSTORE_PASSWORD:
required: false
KEY_PASSWORD:
required: false
outputs:
version-code:
description: versionCode read from app/build.gradle.kts
value: ${{ jobs.build.outputs.version-code }}
permissions:
contents: read
env:
NIX_CONFIG: experimental-features = nix-command flakes
jobs:
build:
runs-on: ubuntu-26.04
timeout-minutes: 60
outputs:
version-code: ${{ steps.version.outputs.code }}
steps:
- uses: actions/checkout@v7
with:
persist-credentials: false
- uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
- uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
with:
primary-key: nix-v2-${{ hashFiles('flake.lock', '**/*.nix') }}
restore-prefixes-first-match: nix-v2-
gc-max-store-size-linux: 6G
- uses: actions/cache@v6
with:
path: ~/.gradle/caches
key: gradle-${{ hashFiles('**/*.gradle*', '**/gradle.properties', 'gradle/libs.versions.toml', 'gradle/wrapper/gradle-wrapper.properties') }}
restore-keys: gradle-
- name: Decode signing material
if: inputs.sign
id: signing
env:
KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
KEYPROPERTIES_BASE64: ${{ secrets.KEYPROPERTIES_BASE64 }}
run: |
echo "$KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.keystore"
alias=$(printf '%s' "$KEYPROPERTIES_BASE64" | base64 -d | sed -n 's/^keyAlias=//p' | tr -d '\r')
test -n "$alias" || { echo "no keyAlias in KEYPROPERTIES_BASE64" >&2; exit 1; }
echo "alias=$alias" >> "$GITHUB_OUTPUT"
- name: Build
env:
RELEASE_KEYSTORE: ${{ inputs.sign && format('{0}/release.keystore', runner.temp) || '' }}
RELEASE_KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
RELEASE_KEY_ALIAS: ${{ steps.signing.outputs.alias }}
RELEASE_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
run: nix develop --command gradle ${{ inputs.gradle-args }}
- name: Remove signing keystore
if: always()
run: rm -f "$RUNNER_TEMP/release.keystore"
- name: Read version code
id: version
run: echo "code=$(grep -oP 'versionCode = \K\d+' app/build.gradle.kts)" >> "$GITHUB_OUTPUT"
- name: Upload build outputs
if: inputs.artifact-name != ''
uses: actions/upload-artifact@v7
with:
name: ${{ inputs.artifact-name }}
path: ${{ inputs.artifact-path }}
.github/workflows/ci.yml
+3 -19
View File
@@ -10,36 +10,20 @@ concurrency:
cancel-in-progress: true
jobs:
build:
permissions:
contents: read
uses: ./.github/workflows/build.yml
with:
gradle-args: ":app:ktlintCheck :app:lintDebug :app:testDebugUnitTest --no-configuration-cache --console=plain --no-daemon"
integration:
ci:
runs-on: ubuntu-26.04
timeout-minutes: 90
permissions:
contents: read
env:
GRADLE_OPTS: -Dorg.gradle.daemon=false
NIX_CONFIG: experimental-features = nix-command flakes
steps:
- uses: actions/checkout@v7
with:
persist-credentials: false
- uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
- uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
- uses: ./.github/actions/build
with:
primary-key: nix-v2-${{ hashFiles('flake.lock', '**/*.nix') }}
restore-prefixes-first-match: nix-v2-
gc-max-store-size-linux: 6G
- uses: actions/cache@v6
with:
path: ~/.gradle/caches
key: gradle-${{ hashFiles('**/*.gradle*', '**/gradle.properties', 'gradle/libs.versions.toml', 'gradle/wrapper/gradle-wrapper.properties') }}
restore-keys: gradle-
gradle-args: ":app:ktlintCheck :app:lintDebug :app:testDebugUnitTest --no-configuration-cache --console=plain --no-daemon"
- uses: actions/cache@v6
with:
path: .integration/music
.github/workflows/release.yml
+22 -19
View File
@@ -10,19 +10,29 @@ permissions:
jobs:
build:
runs-on: ubuntu-26.04
timeout-minutes: 60
permissions:
contents: read
uses: ./.github/workflows/build.yml
with:
gradle-args: ":app:assembleRelease :app:bundleRelease --no-daemon"
sign: true
artifact-name: release
artifact-path: app/build/outputs
secrets:
KEYSTORE_BASE64: ${{ secrets.SUBTRACKS_KEYSTORE_BASE64 }}
KEYPROPERTIES_BASE64: ${{ secrets.SUBTRACKS_KEYPROPERTIES_BASE64 }}
KEYSTORE_PASSWORD: ${{ secrets.SUBTRACKS_UPLOAD_STORE_PASSWORD }}
KEY_PASSWORD: ${{ secrets.SUBTRACKS_UPLOAD_KEY_PASSWORD }}
outputs:
version-code: ${{ steps.build.outputs.version-code }}
steps:
- uses: actions/checkout@v7
with:
persist-credentials: false
- id: build
uses: ./.github/actions/build
with:
gradle-args: ":app:assembleRelease :app:bundleRelease --no-daemon"
sign: "true"
keystore-base64: ${{ secrets.SUBTRACKS_KEYSTORE_BASE64 }}
keyproperties-base64: ${{ secrets.SUBTRACKS_KEYPROPERTIES_BASE64 }}
keystore-password: ${{ secrets.SUBTRACKS_UPLOAD_STORE_PASSWORD }}
key-password: ${{ secrets.SUBTRACKS_UPLOAD_KEY_PASSWORD }}
- uses: actions/upload-artifact@v7
with:
name: release
path: app/build/outputs
publish:
needs: build
@@ -30,8 +40,6 @@ jobs:
timeout-minutes: 60
permissions:
contents: write
env:
NIX_CONFIG: experimental-features = nix-command flakes
steps:
- uses: actions/checkout@v7
with:
@@ -40,12 +48,7 @@ jobs:
with:
name: release
path: dist
- uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
- uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
with:
primary-key: nix-v2-${{ hashFiles('flake.lock', '**/*.nix') }}
restore-prefixes-first-match: nix-v2-
gc-max-store-size-linux: 6G
- uses: ./.github/actions/nix
- name: Upload to Google Play
env:
PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}