peetandClaude Fable 5
54cdfad823
- android-signing: the keystore-restore step previously copy-pasted in habitude and ablage-android; no-op without the secret (unsigned build). - trivy-fs-scan: lockfile-based dependency scan for artifact-building repos (APKs); non-blocking by default via enforce input. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
46 lines
1.6 KiB
YAML
46 lines
1.6 KiB
YAML
name: Android Signing
|
|
description: >
|
|
Restore an Android release-signing keystore from repo secrets so Gradle can
|
|
sign the release APK. Writes <key-alias>-release.jks plus keystore.properties
|
|
in the workspace. When the keystore secret is empty the step is a no-op and
|
|
the build stays unsigned — same optional-signing behavior the app repos had
|
|
with their copy-pasted versions of this step.
|
|
|
|
inputs:
|
|
keystore-b64:
|
|
description: Base64-encoded release keystore (ANDROID_KEYSTORE_B64 secret).
|
|
required: false
|
|
default: ""
|
|
keystore-password:
|
|
description: Keystore/key password (ANDROID_KEYSTORE_PASSWORD secret).
|
|
required: false
|
|
default: ""
|
|
key-alias:
|
|
description: Key alias; also names the keystore file (<alias>-release.jks).
|
|
required: true
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- id: restore
|
|
shell: bash
|
|
env:
|
|
KEYSTORE_B64: ${{ inputs.keystore-b64 }}
|
|
KEYSTORE_PASSWORD: ${{ inputs.keystore-password }}
|
|
KEY_ALIAS: ${{ inputs.key-alias }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ -z "${KEYSTORE_B64}" ]]; then
|
|
echo "No keystore secret configured; release build stays unsigned."
|
|
exit 0
|
|
fi
|
|
: "${KEYSTORE_PASSWORD:?keystore-b64 is set but keystore-password is empty}"
|
|
printf '%s' "${KEYSTORE_B64}" | base64 -d > "${KEY_ALIAS}-release.jks"
|
|
{
|
|
echo "storeFile=${PWD}/${KEY_ALIAS}-release.jks"
|
|
echo "storePassword=${KEYSTORE_PASSWORD}"
|
|
echo "keyAlias=${KEY_ALIAS}"
|
|
echo "keyPassword=${KEYSTORE_PASSWORD}"
|
|
} > keystore.properties
|
|
echo "Restored ${KEY_ALIAS}-release.jks and keystore.properties."
|