mirror of
https://github.com/austinried/subtracks.git
synced 2026-11-10 15:11:58 +01:00
austinried
af3741a549
Extract checkout, nix, signing and the Gradle run into a reusable build workflow used by CI, the next build and the release build job. The build job holds only the signing secrets; the publish job is the only one with a write token and the Play credential. The Play service account is now written to a 0600 file and passed via --json_key instead of on argv.
76 lines
2.5 KiB
YAML
76 lines
2.5 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
permissions:
|
|
contents: read
|
|
uses: ./.github/workflows/build.yml
|
|
with:
|
|
gradle-args: ":app:assembleRelease :app:bundleRelease --no-daemon"
|
|
sign: true
|
|
artifact-name: release
|
|
artifact-path: app/build/outputs
|
|
secrets:
|
|
KEYSTORE_BASE64: ${{ secrets.SUBTRACKS_KEYSTORE_BASE64 }}
|
|
KEYPROPERTIES_BASE64: ${{ secrets.SUBTRACKS_KEYPROPERTIES_BASE64 }}
|
|
KEYSTORE_PASSWORD: ${{ secrets.SUBTRACKS_UPLOAD_STORE_PASSWORD }}
|
|
KEY_PASSWORD: ${{ secrets.SUBTRACKS_UPLOAD_KEY_PASSWORD }}
|
|
|
|
publish:
|
|
needs: build
|
|
runs-on: ubuntu-26.04
|
|
timeout-minutes: 60
|
|
permissions:
|
|
contents: write
|
|
env:
|
|
NIX_CONFIG: experimental-features = nix-command flakes
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/download-artifact@v8
|
|
with:
|
|
name: release
|
|
path: dist
|
|
- uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
|
|
- uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
|
|
with:
|
|
primary-key: nix-v2-${{ hashFiles('flake.lock', '**/*.nix') }}
|
|
restore-prefixes-first-match: nix-v2-
|
|
gc-max-store-size-linux: 6G
|
|
- name: Upload to Google Play
|
|
env:
|
|
PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
|
|
run: |
|
|
umask 077
|
|
printf '%s' "$PLAY_SERVICE_ACCOUNT_JSON" > "$RUNNER_TEMP/play.json"
|
|
nix develop .#release --command fastlane supply \
|
|
--aab dist/bundle/release/app-release.aab \
|
|
--package_name com.subtracks \
|
|
--track "${{ vars.PLAY_TRACK || 'internal' }}" \
|
|
--release_status completed \
|
|
--json_key "$RUNNER_TEMP/play.json" \
|
|
--metadata_path metadata \
|
|
--mapping dist/mapping/release/mapping.txt
|
|
- name: Remove Play service account
|
|
if: always()
|
|
run: rm -f "$RUNNER_TEMP/play.json"
|
|
- name: Collect release APK
|
|
run: cp dist/apk/release/app-release.apk subtracks.apk
|
|
- name: Create GitHub release
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
gh release create "$GITHUB_REF_NAME" subtracks.apk \
|
|
--verify-tag \
|
|
--title "$GITHUB_REF_NAME" \
|
|
--notes-file "metadata/en-US/changelogs/${{ needs.build.outputs.version-code }}.txt"
|