mirror of
https://github.com/tiennm99/loto.git
synced 2026-10-12 18:16:31 +00:00
tiennm99
c6c839fd95
Both subprojects ship from the same commit, so ordinary CI is now a single ci.yml; only the tag-driven release stands apart. The web app is built twice per run — once per base path — and every consumer downloads the artifact instead of rebuilding, replacing three redundant base-"" builds on main. Nothing deploys unless the test job is green, and android-release runs the suite before signing (ci.yml does not fire on tags, so it was the only gap). Shared toolchain setup moves into composite actions, which puts the web build and the APK on the same Node version for the first time. The Firebase PR path was still on npm ci against a stale web/package-lock.json that could resolve a different tree than pnpm-lock.yaml; drop the lockfile and the npm path with it. Also: least-privilege permissions widened per job, persist-credentials off on every checkout, concurrency groups that cancel superseded PRs but never a live deploy, npm caching for android, and the Firebase action pinned by commit SHA to match how the release actions were already pinned.
94 lines
3.2 KiB
YAML
94 lines
3.2 KiB
YAML
# Tag-driven release. Builds standalone rather than consuming ci.yml
|
|
# artifacts: a tag run has no upstream run to pull from, and a release
|
|
# should be reproducible from the tagged tree alone.
|
|
|
|
name: android / release
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*.*.*']
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
concurrency:
|
|
group: android-release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: ./.github/actions/setup-web
|
|
|
|
# ci.yml does not run on tags, so this is the only gate before signing.
|
|
- name: Test web
|
|
run: pnpm test
|
|
working-directory: web
|
|
|
|
# Base "" — the APK loads the bundle from the domain root.
|
|
- name: Build web
|
|
run: pnpm build
|
|
working-directory: web
|
|
|
|
- uses: ./.github/actions/setup-android
|
|
|
|
- name: Sync web bundle into the native project
|
|
run: npm run sync
|
|
working-directory: android
|
|
|
|
- name: Decode keystore
|
|
env:
|
|
KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
|
|
run: printf '%s' "$KEYSTORE_BASE64" | base64 --decode > "$GITHUB_WORKSPACE/keystore.p12"
|
|
|
|
- name: Build signed AAB + APK
|
|
working-directory: android/android
|
|
env:
|
|
LOTO_KEYSTORE_PATH: ${{ github.workspace }}/keystore.p12
|
|
LOTO_KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
|
|
LOTO_KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
|
|
LOTO_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
|
|
run: ./gradlew :app:bundleRelease :app:assembleRelease
|
|
|
|
- name: Upload to GitHub Release
|
|
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
|
|
with:
|
|
files: |
|
|
android/android/app/build/outputs/apk/release/*.apk
|
|
android/android/app/build/outputs/bundle/release/*.aab
|
|
|
|
# Auto-publish to Google Play (gated on the service-account secret).
|
|
# Skips silently if PLAY_SERVICE_ACCOUNT_JSON is not configured, so
|
|
# tagging a release before Play setup still produces a GH Release.
|
|
# Default track is "internal" — change to alpha/beta/production
|
|
# once you trust the pipeline.
|
|
- name: Check Play Store config
|
|
id: play
|
|
env:
|
|
PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
|
|
run: |
|
|
if [ -n "$PLAY_SERVICE_ACCOUNT_JSON" ]; then
|
|
echo "configured=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "configured=false" >> "$GITHUB_OUTPUT"
|
|
echo "::notice::PLAY_SERVICE_ACCOUNT_JSON not set; skipping Play Store upload."
|
|
fi
|
|
|
|
- name: Upload to Google Play (internal track)
|
|
if: steps.play.outputs.configured == 'true'
|
|
uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
|
|
with:
|
|
serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
|
|
packageName: com.miti99.loto
|
|
releaseFiles: android/android/app/build/outputs/bundle/release/*.aab
|
|
tracks: internal
|
|
status: completed
|
|
# Bumps versionCode automatically? No — must be incremented
|
|
# manually in android/android/app/build.gradle before tagging.
|