7ad0c84789
docker-publish.yml:
- Rewrote as matrix build + manifest merge.
- amd64 on ubuntu-latest, arm64 on ubuntu-24.04-arm (free for public
repos). No QEMU — argon2 and every other native dep compile on
their target CPU, no more SIGILL / exit 132.
- Per-arch GHA cache scopes so builds don't thrash each other.
- Final step merges both digests under one tag (vX.Y.Z + latest),
publishing a real multi-arch manifest. `docker pull` from either
arch gets the right variant automatically.
auto-version.yml, version-bump.yml:
- Checkout now uses `secrets.RELEASE_PAT || secrets.GITHUB_TOKEN`.
With RELEASE_PAT set, the tag push this workflow does DOES
trigger downstream (android-release, docker-publish). Without
it, falls back to GITHUB_TOKEN (no downstream trigger, what we
have today).
All workflows (auto-version, version-bump, android-release,
docker-publish):
- Added FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true' so actions
still on Node 20 runtime (checkout/cache/setup-*) opt in to
Node 24 early. GitHub makes Node 24 default 2026-06-02 and
removes Node 20 2026-09-16.
To finish the chain (one-time user step): create a fine-grained
PAT with "Contents: Read and write" on this repo and add as
RELEASE_PAT secret. After that `feat:` / `fix:` commits auto-tag
AND auto-build with zero manual intervention.
119 lines
3.7 KiB
YAML
119 lines
3.7 KiB
YAML
name: Build & release Android APK
|
|
|
|
# Fires whenever a semver tag is pushed (e.g. v6.1.1). Use
|
|
# scripts/release.sh <version> --push from your laptop to mint the
|
|
# tag; this workflow does everything downstream.
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v[0-9]+.[0-9]+.[0-9]+'
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: 'Manual tag to build (e.g. v6.1.1)'
|
|
required: true
|
|
|
|
env:
|
|
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
|
|
|
|
permissions:
|
|
contents: write # needed to create GitHub releases from the runner
|
|
|
|
jobs:
|
|
build:
|
|
name: Build signed APK
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Resolve tag
|
|
id: tag
|
|
run: |
|
|
TAG="${GITHUB_REF_NAME}"
|
|
if [[ -z "$TAG" || "$TAG" == "main" ]]; then
|
|
TAG="${{ github.event.inputs.version }}"
|
|
fi
|
|
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
|
|
echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Set up JDK 17
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
distribution: temurin
|
|
java-version: '17'
|
|
|
|
- name: Set up Node 20
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
cache: npm
|
|
cache-dependency-path: mobile/package-lock.json
|
|
|
|
- name: Set up Android SDK
|
|
uses: android-actions/setup-android@v3
|
|
|
|
- name: Cache Gradle packages
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.gradle/caches
|
|
~/.gradle/wrapper
|
|
key: gradle-${{ runner.os }}-${{ hashFiles('mobile/android/**/*.gradle*', 'mobile/android/gradle/wrapper/gradle-wrapper.properties') }}
|
|
restore-keys: gradle-${{ runner.os }}-
|
|
|
|
- name: Install Capacitor + sync
|
|
working-directory: mobile
|
|
run: |
|
|
npm install --no-audit --no-fund
|
|
npx cap sync android
|
|
|
|
- name: Restore keystore from secret
|
|
env:
|
|
KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
|
|
run: |
|
|
echo "$KEYSTORE_B64" | base64 -d > $RUNNER_TEMP/pedscribe-release.jks
|
|
ls -la $RUNNER_TEMP/pedscribe-release.jks
|
|
|
|
- name: Build signed release APK
|
|
working-directory: mobile/android
|
|
env:
|
|
KS_PASS: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
|
|
KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
|
|
KEY_PASS: ${{ secrets.ANDROID_KEY_PASSWORD }}
|
|
run: |
|
|
./gradlew assembleRelease \
|
|
-Pandroid.injected.signing.store.file=$RUNNER_TEMP/pedscribe-release.jks \
|
|
-Pandroid.injected.signing.store.password="$KS_PASS" \
|
|
-Pandroid.injected.signing.key.alias="$KEY_ALIAS" \
|
|
-Pandroid.injected.signing.key.password="$KEY_PASS" \
|
|
--no-daemon --stacktrace
|
|
|
|
- name: Locate APK
|
|
id: apk
|
|
run: |
|
|
APK=$(find mobile/android/app/build/outputs/apk/release -name '*.apk' | head -1)
|
|
test -n "$APK" || { echo "no APK found"; exit 1; }
|
|
echo "path=$APK" >> "$GITHUB_OUTPUT"
|
|
echo "found: $APK ($(stat -c%s "$APK") bytes)"
|
|
|
|
- name: Rename APK with version
|
|
id: rename
|
|
run: |
|
|
DST="pedscribe-${{ steps.tag.outputs.version }}.apk"
|
|
cp "${{ steps.apk.outputs.path }}" "$DST"
|
|
echo "path=$DST" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Create or update GitHub release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
tag_name: ${{ steps.tag.outputs.tag }}
|
|
name: PedScribe ${{ steps.tag.outputs.version }}
|
|
make_latest: 'true'
|
|
generate_release_notes: true
|
|
files: |
|
|
${{ steps.rename.outputs.path }}
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|