feat: add release step to CI

.github/workflows/default.yml

@@ -6,7 +6,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:
@@ -44,4 +44,7 @@ jobs:
         uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
 
       - name: Run QA
-        run: ./gradlew client-android:qa client-android:assembleDebug client-android:assembleRelease
+        run: ./gradlew client-android:qa
+
+      - name: Build
+        run: ./gradlew client-android:assembleDebug client-android:assembleRelease

.github/workflows/publish_release.yml

@@ -0,0 +1,79 @@
+name: Eventually Publish (Release)
+
+permissions:
+  contents: read
+
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+  workflow_dispatch:
+
+jobs:
+  android:
+    runs-on: ubuntu-latest
+
+    if: startsWith(github.ref, 'refs/tags/v')
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup JDK 21
+        uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6.2.0
+        with:
+          java-version: 21
+          distribution: temurin
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
+
+      - name: Decode Keystore
+        id: decode_keystore
+        uses: timheuer/base64-to-file@dfa5a5dd38803cb4f5c3a081eeb28e8362d43e9c # v2.0.0
+        with:
+          fileName: 'signing.jks'
+          fileDir: './client-android/secrets/'
+          encodedString: ${{ secrets.ANDROID_SIGNING_KEYSTORE }}
+
+      - name: Build client-android artifacts
+        env:
+          ANDROID_SIGNING_KEY_ALIAS: ${{ secrets.ANDROID_SIGNING_KEY_ALIAS }}
+          ANDROID_SIGNING_KEY_PASSWORD: ${{ secrets.ANDROID_SIGNING_KEY_PASSWORD }}
+          ANDROID_SIGNING_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_SIGNING_KEYSTORE_PASSWORD }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          ./gradlew :client-android:assembleRelease
+          mv client-android/build/outputs/apk/release/client-android-release.apk "client-android/build/outputs/apk/release/eventually-${RELEASE_TAG}.apk"
+
+      - name: Upload client-android artifacts
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: client-android
+          path: client-android/build/outputs/apk/release/eventually-${{ github.ref_name }}.apk
+          if-no-files-found: error
+          retention-days: 1
+
+  release:
+    permissions:
+      contents: write
+
+    runs-on: ubuntu-latest
+
+    needs:
+      - android
+
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: client-android
+          path: client-android
+
+      - name: Release
+        uses: softprops/action-gh-release@8a0cd651e5b2365bd640854a3fa5dfc70e4875f3 # v3.0.4
+        with:
+          fail_on_unmatched_files: true
+          files: |
+            client-android/eventually-${{ github.ref_name }}.apk

.github/workflows/release.yml

@@ -0,0 +1,55 @@
+name: Eventually Release
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+on:
+  workflow_dispatch:
+    inputs:
+      next_version:
+        description: 'Next release version'
+        required: true
+        default: 'patch'
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+      verbose:
+        description: 'Enable debug logging during release'
+        required: false
+        type: boolean
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+
+    if: github.ref == 'refs/heads/master'
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ssh-key: ${{ secrets.RELEASE_KEY }}
+          ref: master
+
+      - name: Setup Python 3
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: '3.14'
+
+      - name: Release project
+        run: |
+          pip install semver==3.1.1
+          git config --global user.name ${{ github.actor }}
+          git config --global user.email ${{ github.actor }}@users.noreply.github.com
+          ./release.py $VERBOSE --next $NEXT_VERSION
+          git push
+          git push --tags
+
+        env:
+          NEXT_VERSION: ${{ inputs.next_version }}
+          VERBOSE: ${{ inputs.verbose && '--verbose' || '' }}

.gitignore

@@ -31,5 +31,7 @@ libraries/tools/kotlin-test-js-runner/lib/
 local.properties
 *.hprof
 client-android/release
+client-android/secrets
+*.jks
 .local
 .kotlin

client-android/build.gradle.kts

@@ -8,6 +8,8 @@ plugins {
     alias(libs.plugins.hilt)
 }
 
+val releaseKeystore: File = file("secrets/signing.jks")
+
 android {
     namespace = "eventually.client"
     compileSdk = 37
@@ -22,6 +24,15 @@ android {
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }
 
+    signingConfigs {
+        create("release") {
+            storeFile = releaseKeystore
+            storePassword = System.getenv("ANDROID_SIGNING_KEYSTORE_PASSWORD")
+            keyAlias = System.getenv("ANDROID_SIGNING_KEY_ALIAS")
+            keyPassword = System.getenv("ANDROID_SIGNING_KEY_PASSWORD")
+        }
+    }
+
     buildTypes {
         getByName("debug") {
             applicationIdSuffix = ".debug"
@@ -33,6 +44,10 @@ android {
                 getDefaultProguardFile("proguard-android-optimize.txt"),
                 "proguard-rules.pro"
             )
+
+            if (releaseKeystore.exists()) {
+                signingConfig = signingConfigs.getByName("release")
+            }
         }
     }