From 17c6e6bd059c3be182279a79222c7822d4e0ee61 Mon Sep 17 00:00:00 2001
From: littlecodedragon <253116839+littlecodedragon@users.noreply.github.com>
Date: Mon, 27 Apr 2026 17:13:47 +0200
Subject: [PATCH] Normalize Forgejo JSON secrets before writing release files.

Accept raw JSON, quoted JSON, or base64 JSON for secret payloads and emit valid canonical JSON files for Gradle processing.
---
 .forgejo/workflows/build_release.yml | 74 +++++++++++++++++++++++-----
 1 file changed, 62 insertions(+), 12 deletions(-)

diff --git a/.forgejo/workflows/build_release.yml b/.forgejo/workflows/build_release.yml
index f27a4180c..0a0f6604f 100755
--- a/.forgejo/workflows/build_release.yml
+++ b/.forgejo/workflows/build_release.yml
@@ -68,24 +68,74 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          raw='${{ secrets.GOOGLE_SERVICES_JSON }}'
-          printf '%s' "$raw" > app/google-services.json
-          if ! python3 -m json.tool app/google-services.json > /dev/null 2>&1; then
-            printf '%s' "$raw" | base64 -d > app/google-services.json
-            python3 -m json.tool app/google-services.json > /dev/null
-          fi
+          RAW_SECRET='${{ secrets.GOOGLE_SERVICES_JSON }}' python3 - <<'PY'
+          import base64
+          import json
+          import os
+          from pathlib import Path
+
+          raw = os.environ.get("RAW_SECRET", "")
+          candidates = [raw, raw.strip()]
+
+          try:
+              decoded = base64.b64decode(raw, validate=True).decode("utf-8")
+              candidates.extend([decoded, decoded.strip()])
+          except Exception:
+              pass
+
+          out = Path("app/google-services.json")
+          for candidate in candidates:
+              if not candidate:
+                  continue
+              try:
+                  value = json.loads(candidate)
+                  if isinstance(value, str):
+                      value = json.loads(value)
+                  out.write_text(json.dumps(value, ensure_ascii=False))
+                  break
+              except Exception:
+                  continue
+          else:
+              raise SystemExit("GOOGLE_SERVICES_JSON is neither valid JSON nor base64 JSON")
+          PY
+          python3 -m json.tool app/google-services.json > /dev/null
 
       - name: Write client_secrets.json
         shell: bash
         run: |
           set -euo pipefail
           mkdir -p app/src/main/assets
-          raw='${{ secrets.GOOGLE_CLIENT_SECRETS_JSON }}'
-          printf '%s' "$raw" > app/src/main/assets/client_secrets.json
-          if ! python3 -m json.tool app/src/main/assets/client_secrets.json > /dev/null 2>&1; then
-            printf '%s' "$raw" | base64 -d > app/src/main/assets/client_secrets.json
-            python3 -m json.tool app/src/main/assets/client_secrets.json > /dev/null
-          fi
+          RAW_SECRET='${{ secrets.GOOGLE_CLIENT_SECRETS_JSON }}' python3 - <<'PY'
+          import base64
+          import json
+          import os
+          from pathlib import Path
+
+          raw = os.environ.get("RAW_SECRET", "")
+          candidates = [raw, raw.strip()]
+
+          try:
+              decoded = base64.b64decode(raw, validate=True).decode("utf-8")
+              candidates.extend([decoded, decoded.strip()])
+          except Exception:
+              pass
+
+          out = Path("app/src/main/assets/client_secrets.json")
+          for candidate in candidates:
+              if not candidate:
+                  continue
+              try:
+                  value = json.loads(candidate)
+                  if isinstance(value, str):
+                      value = json.loads(value)
+                  out.write_text(json.dumps(value, ensure_ascii=False))
+                  break
+              except Exception:
+                  continue
+          else:
+              raise SystemExit("GOOGLE_CLIENT_SECRETS_JSON is neither valid JSON nor base64 JSON")
+          PY
+          python3 -m json.tool app/src/main/assets/client_secrets.json > /dev/null
 
       - name: Prepare release metadata
         id: prepare