vhaudiquet
81da26b955
The stored `colors` key names a palette — rhema (the default, Jadeite), aquamarine, black-and-white, or dracula — and the Appearance page of /settings cycles it live, like the theme and icon toggles beside it. Each palette carries a dark and a light appearance under the existing `theme` key; dracula's light side is derived, the official palette ships only dark. The appearance decision moves off token comparison: Theme now answers is_dark() from the ground/text luminance, so palettes beyond the original two get the right per-profile fallback tones.
113 lines
4.7 KiB
YAML
113 lines
4.7 KiB
YAML
name: android
|
|
|
|
# The phone client's pipeline, separate from the rust/chart/docker/web
|
|
# gates: it needs its own toolchain (JDK + the Android SDK), and the
|
|
# release job is the only CI job holding a secret. Both artifacts feed
|
|
# the update story: the debug one must install over any local build
|
|
# (committed debug key), the release one anchors the future edge
|
|
# channel (secret key, never in the source).
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
jobs:
|
|
debug:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://gitea.com/actions/checkout@v4
|
|
|
|
- name: Set up JDK 21
|
|
run: |
|
|
sudo apt-get update && sudo apt-get install -y openjdk-21-jdk-headless
|
|
echo "JAVA_HOME=$(dirname "$(dirname "$(readlink -f "$(which java)")")")" >> "$GITHUB_ENV"
|
|
|
|
- name: Set up the Android SDK
|
|
run: |
|
|
sudo apt-get update && sudo apt-get install -y wget unzip
|
|
mkdir -p "$HOME/android-sdk/cmdline-tools"
|
|
wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip \
|
|
-O /tmp/cmdline-tools.zip
|
|
unzip -q /tmp/cmdline-tools.zip -d "$HOME/android-sdk/cmdline-tools"
|
|
mv "$HOME/android-sdk/cmdline-tools/cmdline-tools" \
|
|
"$HOME/android-sdk/cmdline-tools/latest"
|
|
yes | "$HOME/android-sdk/cmdline-tools/latest/bin/sdkmanager" --licenses > /dev/null || true
|
|
echo "ANDROID_HOME=$HOME/android-sdk" >> "$GITHUB_ENV"
|
|
|
|
- name: Build and lint
|
|
run: |
|
|
cd android
|
|
./gradlew :app:assembleDebug :app:lintDebug
|
|
|
|
# The artifact must install over any previous debug build, so the
|
|
# identity is part of the contract: pin the committed keystore's
|
|
# certificate, not merely "some debug key".
|
|
- name: Verify the APK signature
|
|
run: |
|
|
APKSIGNER=$(find "$ANDROID_HOME/build-tools" -name apksigner | sort | tail -1)
|
|
"$APKSIGNER" verify --print-certs android/app/build/outputs/apk/debug/app-debug.apk \
|
|
| grep -q 13e65a1e4fb828318077784c029e8f2664dba5ef8feece01b950b6bc2b015b64
|
|
|
|
- name: Upload the debug APK
|
|
uses: https://gitea.com/actions/gitea-upload-artifact@v4
|
|
with:
|
|
name: rhema-android-debug
|
|
path: android/app/build/outputs/apk/debug/app-debug.apk
|
|
if-no-files-found: error
|
|
retention-days: 14
|
|
|
|
release:
|
|
# The signed release artifact is the future edge channel's payload,
|
|
# so it only exists where the secrets exist: Gitea withholds
|
|
# secrets from fork pull_request runs, and an unsigned artifact
|
|
# would be a build check, not a deliverable.
|
|
if: gitea.event_name != 'pull_request'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://gitea.com/actions/checkout@v4
|
|
|
|
- name: Set up JDK 21
|
|
run: |
|
|
sudo apt-get update && sudo apt-get install -y openjdk-21-jdk-headless
|
|
echo "JAVA_HOME=$(dirname "$(dirname "$(readlink -f "$(which java)")")")" >> "$GITHUB_ENV"
|
|
|
|
- name: Set up the Android SDK
|
|
run: |
|
|
sudo apt-get update && sudo apt-get install -y wget unzip
|
|
mkdir -p "$HOME/android-sdk/cmdline-tools"
|
|
wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip \
|
|
-O /tmp/cmdline-tools.zip
|
|
unzip -q /tmp/cmdline-tools.zip -d "$HOME/android-sdk/cmdline-tools"
|
|
mv "$HOME/android-sdk/cmdline-tools/cmdline-tools" \
|
|
"$HOME/android-sdk/cmdline-tools/latest"
|
|
yes | "$HOME/android-sdk/cmdline-tools/latest/bin/sdkmanager" --licenses > /dev/null || true
|
|
echo "ANDROID_HOME=$HOME/android-sdk" >> "$GITHUB_ENV"
|
|
|
|
- name: Decode the release keystore
|
|
run: |
|
|
echo "${{ secrets.ANDROID_RELEASE_KEYSTORE }}" | base64 -d > /tmp/release.keystore
|
|
|
|
- name: Build
|
|
run: |
|
|
cd android
|
|
./gradlew :app:assembleRelease
|
|
env:
|
|
ANDROID_RELEASE_KEYSTORE: /tmp/release.keystore
|
|
ANDROID_RELEASE_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_RELEASE_KEYSTORE_PASSWORD }}
|
|
|
|
# Same contract as the debug artifact, tighter stakes: this key
|
|
# can update any install that trusts the channel.
|
|
- name: Verify the APK signature
|
|
run: |
|
|
APKSIGNER=$(find "$ANDROID_HOME/build-tools" -name apksigner | sort | tail -1)
|
|
"$APKSIGNER" verify --print-certs android/app/build/outputs/apk/release/app-release.apk \
|
|
| grep -q 8bd94fd4c2fe69557ccde6dd2e5c786c5288420674044ffe2c3fc2c55eb8f4f7
|
|
|
|
- name: Upload the release APK
|
|
uses: https://gitea.com/actions/gitea-upload-artifact@v4
|
|
with:
|
|
name: rhema-android-release
|
|
path: android/app/build/outputs/apk/release/app-release.apk
|
|
if-no-files-found: error
|
|
retention-days: 14
|