copilot/komikku
1
0
Fork 0
Code Issues Pull requests Projects Releases 5 Packages Wiki Activity Actions

Normalize Forgejo JSON secrets before writing release files.
Some checks failed
Forgejo Release Builder / release (push) Failing after 3s
Details

Browse source 
Accept raw JSON, quoted JSON, or base64 JSON for secret payloads and emit valid canonical JSON files for Gradle processing.
This commit is contained in:
littlecodedragon 2026-04-27 17:13:47 +02:00
parent ea69546fcb
commit 17c6e6bd05
1 changed files with 62 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

74
.forgejo/workflows/build_release.yml
View file

@ -68,24 +68,74 @@ jobs:
shell: bash
run: |
set -euo pipefail
raw='${{ secrets.GOOGLE_SERVICES_JSON }}'
printf '%s' "$raw" > app/google-services.json
if ! python3 -m json.tool app/google-services.json > /dev/null 2>&1; then
printf '%s' "$raw" | base64 -d > app/google-services.json
python3 -m json.tool app/google-services.json > /dev/null
fi
RAW_SECRET='${{ secrets.GOOGLE_SERVICES_JSON }}' python3 - <<'PY'
import base64
import json
import os
from pathlib import Path
raw = os.environ.get("RAW_SECRET", "")
candidates = [raw, raw.strip()]
try:
decoded = base64.b64decode(raw, validate=True).decode("utf-8")
candidates.extend([decoded, decoded.strip()])
except Exception:
pass
out = Path("app/google-services.json")
for candidate in candidates:
if not candidate:
continue
try:
value = json.loads(candidate)
if isinstance(value, str):
value = json.loads(value)
out.write_text(json.dumps(value, ensure_ascii=False))
break
except Exception:
continue
else:
raise SystemExit("GOOGLE_SERVICES_JSON is neither valid JSON nor base64 JSON")
PY
python3 -m json.tool app/google-services.json > /dev/null
- name: Write client_secrets.json
shell: bash
run: |
set -euo pipefail
mkdir -p app/src/main/assets
raw='${{ secrets.GOOGLE_CLIENT_SECRETS_JSON }}'
printf '%s' "$raw" > app/src/main/assets/client_secrets.json
if ! python3 -m json.tool app/src/main/assets/client_secrets.json > /dev/null 2>&1; then
printf '%s' "$raw" | base64 -d > app/src/main/assets/client_secrets.json
python3 -m json.tool app/src/main/assets/client_secrets.json > /dev/null
fi
RAW_SECRET='${{ secrets.GOOGLE_CLIENT_SECRETS_JSON }}' python3 - <<'PY'
import base64
import json
import os
from pathlib import Path
raw = os.environ.get("RAW_SECRET", "")
candidates = [raw, raw.strip()]
try:
decoded = base64.b64decode(raw, validate=True).decode("utf-8")
candidates.extend([decoded, decoded.strip()])
except Exception:
pass
out = Path("app/src/main/assets/client_secrets.json")
for candidate in candidates:
if not candidate:
continue
try:
value = json.loads(candidate)
if isinstance(value, str):
value = json.loads(value)
out.write_text(json.dumps(value, ensure_ascii=False))
break
except Exception:
continue
else:
raise SystemExit("GOOGLE_CLIENT_SECRETS_JSON is neither valid JSON nor base64 JSON")
PY
python3 -m json.tool app/src/main/assets/client_secrets.json > /dev/null
- name: Prepare release metadata
id: prepare