DPIP/.github/workflows/android.yml at main · ExpTechTW/DPIP · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
name: Build Android

# Pull requests, and the pushes to `main` that publish no snapshot. A push
# that does is handled by release.yml, which builds the signed, uploadable
# artifact — running this as well would spend a second runner producing an
# unsigned one nobody installs. One that does not would otherwise be built by
# nothing at all.
on:
  pull_request:
    branches: ["main"]
  push:
    branches: ["main"]

jobs:
  changes:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      android: ${{ steps.filter.outputs.android }}
      release: ${{ steps.release.outputs.builds }}
    steps:
      - uses: actions/checkout@v5
        with:
          # A push reads its own commit messages below: full history, without
          # the file contents nothing here looks at.
          fetch-depth: ${{ github.event_name == 'push' && '0' || '1' }}
          filter: ${{ github.event_name == 'push' && 'blob:none' || '' }}
      - uses: dorny/paths-filter@v4
        id: filter
        with:
          filters: |
            android:
              - 'android/**'
              - 'assets/**'
              - 'lib/**'
              - 'pubspec.yaml'

      # Whether release.yml builds this push, for the job below. It publishes
      # a snapshot only when a commit since the last tag carries a changelog
      # entry; asked here of the push's own commits, which are always within
      # that range. So "yes" here is always "yes" there, and a push this
      # answers "no" for is built here — at worst by both, never by neither.
      - name: Does release.yml build this push
        id: release
        if: github.event_name == 'push'
        env:
          BEFORE: ${{ github.event.before }}
        run: |
          if bash tool/release/notes.sh --any "$BEFORE..$GITHUB_SHA"; then
            echo "builds=true" >> "$GITHUB_OUTPUT"
            echo "this push brings a changelog entry: release.yml builds it"
          else
            echo "builds=false" >> "$GITHUB_OUTPUT"
            echo "no changelog entry in this push: no snapshot, so it is built here"
          fi

  Android:
    needs: changes
    if: ${{ needs.changes.outputs.android == 'true' && needs.changes.outputs.release != 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v5

      - name: Setup Java
        uses: actions/setup-java@v6
        with:
          distribution: "temurin"
          java-version: "25"
          cache: "gradle"

      # Flutter and Dart come from mise.toml, the same pin CI and every laptop
      # use. Not subosito/flutter-action with `channel: stable`: that resolves
      # to whatever stable is on the day, so this job could ship an artifact
      # built against an SDK nobody chose, and nothing in the build log would
      # say so. See AGENTS.md → Toolchain.
      - name: Install toolchain (mise)
        uses: jdx/mise-action@v4

      - name: Cache Android NDK
        uses: actions/cache@v5
        with:
          path: |
            /usr/local/lib/android/sdk/ndk/27.0.12077973
            /usr/local/lib/android/sdk/ndk/28.2.13676358
          key: ${{ runner.os }}-ndk-27-28

      - name: Cache Android sdk
        uses: actions/cache@v5
        env:
          cache-name: cache-Android-sdk
        with:
          path: |
            /usr/local/lib/android/sdk/platforms/android-31
            /usr/local/lib/android/sdk/platforms/android-33
          key: ${{ runner.os }}-android-platforms-${{ env.cache-name }}-${{ hashFiles('android/gradle.properties') }}
          restore-keys: |
            ${{ runner.os }}-build-${{ env.cache-name }}-
            ${{ runner.os }}-build-

      - name: Install dependencies and run build_runner
        run: |
          bash tool/dev/deps.sh
          bash tool/dev/codegen.sh

      # No keystore, and deliberately so. This job builds the artifact nobody
      # installs — release.yml signs and uploads the one that ships — so the
      # release keystore buys nothing here, and asking for it is what breaks
      # the job outright: a pull request opened from a fork is handed no
      # repository secrets at all, so `secrets.KEYSTORE_BASE64` is the empty
      # string, android/key.properties is written with four empty values, and
      # Gradle fails inside packageRelease with a keystore error that says
      # nothing about forks. Every other check on such a pull request passes,
      # including the iOS build, which never codesigns.
      #
      # android/app/build.gradle.kts already falls back to the debug signing
      # config when android/key.properties is absent, so what comes out is the
      # same release build, debug-signed.
      - name: Build Release APK
        run: bash tool/dev/build.sh android

      - name: Upload Artifacts
        uses: actions/upload-artifact@v6
        with:
          name: DPIP-Android-Release
          path: build/app/outputs/flutter-apk/*.apk
          retention-days: 7
          compression-level: 6