EasyReader/.github/workflows/ci.yml at main · Aatricks/EasyReader · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
name: Android CI

on:
  push:
    branches: [ "main" ]
    tags: [ "v*" ]
  pull_request:
    branches: [ "main" ]
  workflow_dispatch:
    inputs:
      run_release:
        description: "Run signed release build"
        type: boolean
        required: false
        default: false
  schedule:
    - cron: "0 6 * * 1"

jobs:
  standard-validation:
    name: standard-validation
    runs-on: ubuntu-latest
    # Keep PR and main push validation strictly unsigned standardDebug checks.
    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main')

    steps:
    - uses: actions/checkout@v4

    - name: set up JDK 17
      uses: actions/setup-java@v4
      with:
        java-version: '17'
        distribution: 'temurin'
        cache: gradle

    - name: Grant execute permission for gradlew
      run: chmod +x gradlew

    - name: Validate standardDebug
      # PR/default validation path with no release/signing requirements.
      run: ./gradlew :app:lintStandardDebug :app:testStandardDebugUnitTest :app:assembleStandardDebug

  ai-debug-validation:
    name: ai-debug-validation
    runs-on: ubuntu-latest
    # AI debug validation runs on trusted automation and optional manual dispatch.
    # It stays unsigned and never touches release signing secrets.
    if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.run_release != true)

    steps:
    - uses: actions/checkout@v4

    - name: set up JDK 17
      uses: actions/setup-java@v4
      with:
        java-version: '17'
        distribution: 'temurin'
        cache: gradle

    - name: Grant execute permission for gradlew
      run: chmod +x gradlew

    - name: Validate aiDebug
      run: ./gradlew :app:lintAiDebug :app:testAiDebugUnitTest :app:assembleAiDebug

  release-build:
    name: release-build
    runs-on: ubuntu-latest
    # Signed releases run only from version tag pushes or explicit manual dispatch.
    if: (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) || (github.event_name == 'workflow_dispatch' && inputs.run_release == true)
    steps:
    - uses: actions/checkout@v4

    - name: set up JDK 17
      uses: actions/setup-java@v4
      with:
        java-version: '17'
        distribution: 'temurin'
        cache: gradle

    - name: Decode Keystore
      run: |
        echo "${{ secrets.RELEASE_KEYSTORE_BASE64 }}" | base64 --decode > app/release.jks
        echo "storeFile=../app/release.jks" > keystore.properties
        echo "storePassword=${{ secrets.RELEASE_STORE_PASSWORD }}" >> keystore.properties
        echo "keyAlias=${{ secrets.RELEASE_KEY_ALIAS }}" >> keystore.properties
        echo "keyPassword=${{ secrets.RELEASE_KEY_PASSWORD }}" >> keystore.properties

    - name: Grant execute permission for gradlew
      run: chmod +x gradlew

    - name: Build signed release variants
      run: ./gradlew :app:assembleStandardRelease :app:assembleAiRelease

    - name: Upload release APKs
      uses: actions/upload-artifact@v4
      with:
        name: release-apks
        path: |
          app/build/outputs/apk/standard/release/*.apk
          app/build/outputs/apk/ai/release/*.apk