Repository navigation
Automated signed CI builds - #1769
UnicornsOnLSD wants to merge 19 commits into
Conversation
|
I'd like to help with the Android part of this work. I'm preparing a small follow-up against Before wiring in publication, could you confirm whether the GitHub APK signing key and the Play upload key are the same, and whether someone is already working on the Android portion? I'll adjust the scope if this overlaps existing work. The installability reports in #1759 prompted this: the official 1.0.1-beta GitHub APK has versionCode 201 and targetSdkVersion 36 (its SHA-256 matches the release asset digest). I haven't inspected the Play-delivered artifact or Play Console settings, so I don't assume that build automation alone resolves the store availability issue. The signing helper's tests already round-trip special-character passwords through Java's actual Properties parser; I'm now validating a full build with a disposable key. Implementation and review are AI-assisted; I'll include the actual validation results and limitations with the contribution. |
|
@ciklois-neo just to get back to you on this: that sounds great and I'll take a look at your PR. We currently build a signed APK for GitHub and upload the unsigned AAB to Play Console afaik, but I don't think they use the same certificates (at least cross-updating doesn't seem to work). Maybe @UnicornsOnLSD can share more about that. |
|
Also @UnicornsOnLSD, do you need any help testing this, or should we just review the CI workflow definitions? |
|
Thanks @Chaphasilor — #1775 now supports separate signing configurations for the GitHub APK and Play upload AAB. Signing tests passed locally and in the upstream Linux job; a full release with production keys has not been tested. Could @UnicornsOnLSD confirm whether the APK signing key and Play upload key differ? |
|
@ciklois-neo could you please shorten your comment and remove and notes about your internal PRs? this helps us actually review things. thanks. |
c555842 to
795bb65
Compare
ci: fix Android release artifact generation
| run: flutter build appbundle --release | ||
|
|
||
| - uses: actions/upload-artifact@v6 | ||
| if: steps.build-deb-apk.outcome == 'success' |
There was a problem hiding this comment.
Is this meant to be build-debug-apk?
| # arch can be removed later once isar aarch64 is easily available on pub.dev and overriding is not needed anymore | ||
| pub-cache-key: "flutter-pub-:os:-:channel:-:version:-:arch:-:hash:" | ||
|
|
||
| - name: Setup Android Keys |
There was a problem hiding this comment.
Any particular reason this is integrated into the normal build flow but the ios release is fully separated?
| build-android: | ||
| name: Build for Android | ||
| runs-on: ubuntu-latest | ||
| env: |
There was a problem hiding this comment.
Will mean release apks get generated for every push by someone with repository secrets? I guess this doesn't mean as much without an automated upload like ios has, but I'm still wondering if we actually want that.
| if: *integration_if | ||
| run: flutter test integration_test/test_cases.dart -d 'iPhone 17' | ||
|
|
||
| release-ios: |
There was a problem hiding this comment.
I believe with these additions, that leaves macos as the only platform we support that doesn't create release builds via CI. How complicated would adding macos test/release builds to the CI be?
This PR adds a new GH Actions step to create signed binaries on a tag. The end goal here is to be able to make Finamp releases autonomously without relying on me to make a signed build manually (to those snooping, this has delayed releases by a staggering amount of time 🫠)
iOS
For iOS, I've mostly copied from the GitHub docs, which conveniently has a section on importing provisioning profiles/certificates for use in runners. I've made a distribution profile for CI, which is all pulled from GH Actions secrets. There were some shenanigans required to use this profile in the build (
flutter build ipa --release --export-method app-storedoesn't work >:( ), but the result is clean enough and allows the Xcode project to stay in "automatic" mode by default (rather than having its signing settings forced to CI all the time (not that it really matters, you have to mess with it anyway unless you're me)).Android
Have put my keystore into GitHub Actions secrets, a release APK/bundle is built and uploaded to artifact storage alongside the debug APK. Unlike iOS this is done on every commit since I figured some people might want to easily install Finamp from random commits (think
finamp-gitor something). I haven't automated uploading to Google Play, this could be done with something like https://github.com/r0adkll/upload-google-play if we want to do that.