@@ -37,8 +37,44 @@ concurrency:
3737 cancel-in-progress: false
3838
3939jobs:
40+ check_secrets:
41+ # A job of its own, so that no secret value is registered in the job that writes the release
42+ # notes: the runner drops any job output that contains a secret's value (a key alias like
43+ # "release" would otherwise blank the notes).
44+ name: Check the secrets
45+ runs-on: ubuntu-latest
46+ outputs:
47+ signed: ${{ steps.s.outputs.signed }}
48+ steps:
49+ - name: Check the secrets
50+ id: s
51+ env:
52+ DRY_RUN: ${{ inputs.dry_run }}
53+ APP_ID: ${{ secrets.MULTIGRAM_APP_ID }}
54+ APP_HASH: ${{ secrets.MULTIGRAM_APP_HASH }}
55+ KEYSTORE_BASE64: ${{ secrets.MULTIGRAM_KEYSTORE_BASE64 }}
56+ KEYSTORE_PASSWORD: ${{ secrets.MULTIGRAM_KEYSTORE_PASSWORD }}
57+ KEY_ALIAS: ${{ secrets.MULTIGRAM_KEY_ALIAS }}
58+ run: |
59+ set -euo pipefail
60+ # Stop here, in seconds, rather than after the long build. A dry run only warns.
61+ problem() { if [ "$DRY_RUN" = true ]; then echo "::warning::$1"; else echo "::error::$1"; exit 1; fi; }
62+ if [ -z "$APP_ID" ] || [ -z "$APP_HASH" ]; then
63+ problem "The MULTIGRAM_APP_ID and MULTIGRAM_APP_HASH secrets are not set, so the APK could not log in. Add them (Settings > Secrets and variables > Actions) and run this again."
64+ fi
65+ if [ -n "$KEYSTORE_BASE64" ]; then
66+ if [ -z "$KEYSTORE_PASSWORD" ] || [ -z "$KEY_ALIAS" ]; then
67+ problem "MULTIGRAM_KEYSTORE_BASE64 is set, but MULTIGRAM_KEYSTORE_PASSWORD or MULTIGRAM_KEY_ALIAS is not: signing would fail at the end of the build. Add both."
68+ fi
69+ echo "signed=true" >> "$GITHUB_OUTPUT"
70+ else
71+ echo "::warning::No MULTIGRAM_KEYSTORE_BASE64 secret: the release will be signed with Forkgram's public test key and published as a pre-release."
72+ echo "signed=false" >> "$GITHUB_OUTPUT"
73+ fi
74+
4075 prepare:
4176 name: Work out the version
77+ needs: check_secrets
4278 runs-on: ubuntu-latest
4379 outputs:
4480 sha: ${{ steps.v.outputs.sha }}
@@ -58,9 +94,7 @@ jobs:
5894 NUMBER: ${{ inputs.number }}
5995 PRERELEASE: ${{ inputs.prerelease }}
6096 DRY_RUN: ${{ inputs.dry_run }}
61− APP_ID: ${{ secrets.MULTIGRAM_APP_ID }}
62− APP_HASH: ${{ secrets.MULTIGRAM_APP_HASH }}
63− KEYSTORE_BASE64: ${{ secrets.MULTIGRAM_KEYSTORE_BASE64 }}
97+ SIGNED: ${{ needs.check_secrets.outputs.signed }}
6498 run: |
6599 set -euo pipefail
66100 fail() { echo "::error::$1"; exit 1; }
@@ -97,17 +131,9 @@ jobs:
97131 fg_version=${fg_version:-unknown}; tg_version=${tg_version:-unknown}
98132 fi
99133
100− if [ -z "$APP_ID" ] || [ -z "$APP_HASH" ]; then
101− m="The MULTIGRAM_APP_ID and MULTIGRAM_APP_HASH secrets are not set, so the APK could not log in. Add them (Settings > Secrets and variables > Actions) and run this again."
102− if [ "$DRY_RUN" = true ]; then echo "::warning::$m"; else fail "$m"; fi
103− fi
104− signed=true
105− [ -n "$KEYSTORE_BASE64" ] || signed=false
134+ signed=${SIGNED:-false}
106135 prerelease=$PRERELEASE
107− if [ "$signed" = false ]; then
108− prerelease=true
109− echo "::warning::No MULTIGRAM_KEYSTORE_BASE64 secret: MultiGram $version will be signed with Forkgram's public test key and published as a pre-release."
110− fi
136+ [ "$signed" = true ] || prerelease=true
111137
112138 notes=$(mktemp)
113139 {
@@ -151,7 +177,7 @@ jobs:
151177
152178 build:
153179 name: Build
154− needs: prepare
180+ needs: [check_secrets, prepare]
155181 if: ${{ !inputs.dry_run }}
156182 uses: ./.github/workflows/build.yml
157183 with: