copilot/frosty
1
0
Fork 0
Code Issues Pull requests Projects Releases 11 Packages Wiki Activity Actions

build(android): guard release signing to allow keyless compile checks

Browse source 
Release builds now use the real upload key when key.properties is present,
fall back to debug signing only when ALLOW_DEBUG_SIGNED_RELEASE is set (CI
compile-only checks), and otherwise fail loudly. Lets CI compile a release
APK without production secrets while ensuring a real release can never be
silently debug-signed if the keystore step goes missing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Tommy Chow 2026-06-08 23:15:38 -07:00
parent f5718e3656
commit 17bbb20b94
1 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
android/app/build.gradle.kts
View file

@ -50,7 +50,16 @@ android {
buildTypes {
release {
signingConfig = signingConfigs.getByName("release")
// Use the real upload key when key.properties is present (release
// workflows create it from secrets). Allow debug signing only when a CI
// compile-only check explicitly opts in via ALLOW_DEBUG_SIGNED_RELEASE;
// otherwise fail loudly so a real release can never be silently
// debug-signed if the keystore step is ever missing.
signingConfig = when {
keystorePropertiesFile.exists() -> signingConfigs.getByName("release")
System.getenv("ALLOW_DEBUG_SIGNED_RELEASE") != null -> signingConfigs.getByName("debug")
else -> error("key.properties missing — set ALLOW_DEBUG_SIGNED_RELEASE=1 for compile-only builds")
}
}
}
}