copilot/komikku
1
0
Fork 0
Code Issues Pull requests Projects Releases 5 Packages Wiki Activity Actions

CI: publish only signed release APKs
All checks were successful
Forgejo Release Builder / release (push) Successful in 17m24s
Details

Browse source 
Prevent unsigned artifacts from being published as Obtainium aliases and fail fast when signing secrets are missing so releases remain installable.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
littlecodedragon 2026-05-09 07:55:21 +02:00
parent 7e3738551b
commit a2f9003008
1 changed files with 7 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
.forgejo/workflows/build_release.yml
View file

@ -188,7 +188,7 @@ jobs:
zip -qr "Komikku-mapping-${version_tag}.zip" app/build/outputs/mapping/release zip -qr "Komikku-mapping-${version_tag}.zip" app/build/outputs/mapping/release
fi fi
- name: Sign APKs (optional) - name: Sign APKs
shell: bash shell: bash
env: env:
SIGNING_KEYSTORE_B64: ${{ secrets.SIGNING_KEYSTORE_B64 }} SIGNING_KEYSTORE_B64: ${{ secrets.SIGNING_KEYSTORE_B64 }}
@ -199,8 +199,9 @@ jobs:
set -euo pipefail set -euo pipefail
if [ -z "${SIGNING_KEYSTORE_B64}" ] || [ -z "${SIGNING_KEYSTORE_PASSWORD}" ] || [ -z "${SIGNING_KEY_ALIAS}" ] || [ -z "${SIGNING_KEY_PASSWORD}" ]; then if [ -z "${SIGNING_KEYSTORE_B64}" ] || [ -z "${SIGNING_KEYSTORE_PASSWORD}" ] || [ -z "${SIGNING_KEY_ALIAS}" ] || [ -z "${SIGNING_KEY_PASSWORD}" ]; then
echo "Signing secrets not fully set; keeping unsigned APKs." echo "Signing secrets are required for installable release APKs."
exit 0 echo "Set SIGNING_KEYSTORE_B64, SIGNING_KEYSTORE_PASSWORD, SIGNING_KEY_ALIAS, SIGNING_KEY_PASSWORD."
exit 1
fi fi
keystore_file="$(mktemp)" keystore_file="$(mktemp)"
@ -244,13 +245,12 @@ jobs:
fi fi
} }
# Prefer signed APKs; fallback to unsigned when signing is not configured. # Only publish signed APK aliases.
alias_asset "$(ls -1t Komikku-arm64-v8a-*.apk 2>/dev/null | head -n1)" "Komikku-arm64-v8a.apk" alias_asset "$(ls -1t Komikku-arm64-v8a-*.apk 2>/dev/null | head -n1)" "Komikku-arm64-v8a.apk"
alias_asset "$(ls -1t Komikku-arm64-v8a-*-unsigned.apk 2>/dev/null | head -n1)" "Komikku-arm64-v8a.apk"
for candidate in Komikku-*.apk; do for candidate in Komikku-*.apk; do
case "$candidate" in case "$candidate" in
*arm64-v8a*|*armeabi-v7a*|*x86_64*|*x86*) *arm64-v8a*|*armeabi-v7a*|*x86_64*|*x86*|*-unsigned.apk)
;; ;;
*) *)
alias_asset "$candidate" "Komikku-universal.apk" alias_asset "$candidate" "Komikku-universal.apk"
@ -513,10 +513,7 @@ jobs:
[ -e "$file" ] || continue [ -e "$file" ] || continue
if [ "${file#*-unsigned.apk}" != "${file}" ]; then if [ "${file#*-unsigned.apk}" != "${file}" ]; then
signed_candidate="${file/-unsigned.apk/.apk}" continue
if [ -e "${signed_candidate}" ]; then
continue
fi
fi fi
asset_name="$(basename "$file")" asset_name="$(basename "$file")"