Release the artifact build.yml produced instead of rebuilding - #125
Merged
Conversation
build.yml gains a workflow_call trigger so release.yml can run it as its build job on a version tag, then sign that exact artifact with apksigner and attach it to a GitHub Release. Fixes the first release attempt, which globbed build-tools/*/apksigner and matched several preinstalled versions on the runner.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first tag run failed in its verify step:
"$ANDROID_HOME"/build-tools/*/apksignerexpanded to several preinstalled build-tools directories on the runner, so the command never ran cleanly. It also rebuilt the app instead of releasing what Build had just tested, and left two runs on the same commit. This keeps the two workflows but makes Release reuse Build.build.ymladds aworkflow_calltrigger with an optionaltaginput. When called with a tag it passes-PreleaseVersionso versionName/versionCode come from the tag; pushes and pull requests are unchanged. Concurrency moves to the job so it does not collide with the caller's group.release.ymlon avX.Y.Ztag runsbuild.ymlas its first job, downloads the APK that job uploaded, installsbuild-tools;36.0.0explicitly, signs the artifact withapksigner(passwords via--ks-pass env:/--key-pass env:), verifies it, and publishes it withgh release create. The keystore is decoded only in this job and removed in analways()step.signingConfigstays for local signed builds from~/.android/release/; CI never hands Gradle a keystore, so the artifact Build uploads is unsigned and Release is the only place a signature is added.