From ea69546fcb4bf21a51ab54a1eddc2bd038f076b4 Mon Sep 17 00:00:00 2001
From: littlecodedragon <253116839+littlecodedragon@users.noreply.github.com>
Date: Mon, 27 Apr 2026 17:12:18 +0200
Subject: [PATCH] Accept raw or base64 JSON secrets in Forgejo release
 workflow.

Validate secrets as JSON and fall back to base64 decoding when needed so google-services and client secrets are parsed correctly.
---
 .forgejo/workflows/build_release.yml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.forgejo/workflows/build_release.yml b/.forgejo/workflows/build_release.yml
index b009192fb..f27a4180c 100755
--- a/.forgejo/workflows/build_release.yml
+++ b/.forgejo/workflows/build_release.yml
@@ -68,16 +68,24 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          printf '%s' "${{ secrets.GOOGLE_SERVICES_JSON }}" > app/google-services.json
-          python3 -m json.tool app/google-services.json > /dev/null
+          raw='${{ secrets.GOOGLE_SERVICES_JSON }}'
+          printf '%s' "$raw" > app/google-services.json
+          if ! python3 -m json.tool app/google-services.json > /dev/null 2>&1; then
+            printf '%s' "$raw" | base64 -d > app/google-services.json
+            python3 -m json.tool app/google-services.json > /dev/null
+          fi
 
       - name: Write client_secrets.json
         shell: bash
         run: |
           set -euo pipefail
           mkdir -p app/src/main/assets
-          printf '%s' "${{ secrets.GOOGLE_CLIENT_SECRETS_JSON }}" > app/src/main/assets/client_secrets.json
-          python3 -m json.tool app/src/main/assets/client_secrets.json > /dev/null
+          raw='${{ secrets.GOOGLE_CLIENT_SECRETS_JSON }}'
+          printf '%s' "$raw" > app/src/main/assets/client_secrets.json
+          if ! python3 -m json.tool app/src/main/assets/client_secrets.json > /dev/null 2>&1; then
+            printf '%s' "$raw" | base64 -d > app/src/main/assets/client_secrets.json
+            python3 -m json.tool app/src/main/assets/client_secrets.json > /dev/null
+          fi
 
       - name: Prepare release metadata
         id: prepare