1f23333 · Multigram · git.iko.soy

git.iko.soy/Multigram

on main help sign in

Check all signing secrets up front and document releases

1f23333Claude2 weeks ago

.github/workflows/release.yml+40−14

unifiedsplit

@@ -37,8 +37,44 @@ concurrency:

37 cancel-in-progress: false

39jobs:

40+ check_secrets:

41+ # A job of its own, so that no secret value is registered in the job that writes the release

42+ # notes: the runner drops any job output that contains a secret's value (a key alias like

43+ # "release" would otherwise blank the notes).

44+ name: Check the secrets

45+ runs-on: ubuntu-latest

46+ outputs:

47+ signed: ${{ steps.s.outputs.signed }}

48+ steps:

49+ - name: Check the secrets

50+ id: s

51+ env:

52+ DRY_RUN: ${{ inputs.dry_run }}

53+ APP_ID: ${{ secrets.MULTIGRAM_APP_ID }}

54+ APP_HASH: ${{ secrets.MULTIGRAM_APP_HASH }}

55+ KEYSTORE_BASE64: ${{ secrets.MULTIGRAM_KEYSTORE_BASE64 }}

56+ KEYSTORE_PASSWORD: ${{ secrets.MULTIGRAM_KEYSTORE_PASSWORD }}

57+ KEY_ALIAS: ${{ secrets.MULTIGRAM_KEY_ALIAS }}

58+ run: |

59+ set -euo pipefail

60+ # Stop here, in seconds, rather than after the long build. A dry run only warns.

61+ problem() { if [ "$DRY_RUN" = true ]; then echo "::warning::$1"; else echo "::error::$1"; exit 1; fi; }

62+ if [ -z "$APP_ID" ] || [ -z "$APP_HASH" ]; then

63+ problem "The MULTIGRAM_APP_ID and MULTIGRAM_APP_HASH secrets are not set, so the APK could not log in. Add them (Settings > Secrets and variables > Actions) and run this again."

64+ fi

65+ if [ -n "$KEYSTORE_BASE64" ]; then

66+ if [ -z "$KEYSTORE_PASSWORD" ] || [ -z "$KEY_ALIAS" ]; then

67+ problem "MULTIGRAM_KEYSTORE_BASE64 is set, but MULTIGRAM_KEYSTORE_PASSWORD or MULTIGRAM_KEY_ALIAS is not: signing would fail at the end of the build. Add both."

68+ fi

69+ echo "signed=true" >> "$GITHUB_OUTPUT"

70+ else

71+ echo "::warning::No MULTIGRAM_KEYSTORE_BASE64 secret: the release will be signed with Forkgram's public test key and published as a pre-release."

72+ echo "signed=false" >> "$GITHUB_OUTPUT"

73+ fi

74+

40 prepare:

75 prepare:

41 name: Work out the version

76 name: Work out the version

77+ needs: check_secrets

42 runs-on: ubuntu-latest

78 runs-on: ubuntu-latest

43 outputs:

79 outputs:

44 sha: ${{ steps.v.outputs.sha }}

80 sha: ${{ steps.v.outputs.sha }}

@@ -58,9 +94,7 @@ jobs:

58 NUMBER: ${{ inputs.number }}

94 NUMBER: ${{ inputs.number }}

59 PRERELEASE: ${{ inputs.prerelease }}

95 PRERELEASE: ${{ inputs.prerelease }}

60 DRY_RUN: ${{ inputs.dry_run }}

96 DRY_RUN: ${{ inputs.dry_run }}

61− APP_ID: ${{ secrets.MULTIGRAM_APP_ID }}

97+ SIGNED: ${{ needs.check_secrets.outputs.signed }}

62− APP_HASH: ${{ secrets.MULTIGRAM_APP_HASH }}

63− KEYSTORE_BASE64: ${{ secrets.MULTIGRAM_KEYSTORE_BASE64 }}

64 run: |

98 run: |

65 set -euo pipefail

99 set -euo pipefail

66 fail() { echo "::error::$1"; exit 1; }

100 fail() { echo "::error::$1"; exit 1; }

@@ -97,17 +131,9 @@ jobs:

97 fg_version=${fg_version:-unknown}; tg_version=${tg_version:-unknown}

131 fg_version=${fg_version:-unknown}; tg_version=${tg_version:-unknown}

98 fi

132 fi

133

100− if [ -z "$APP_ID" ] || [ -z "$APP_HASH" ]; then

101− m="The MULTIGRAM_APP_ID and MULTIGRAM_APP_HASH secrets are not set, so the APK could not log in. Add them (Settings > Secrets and variables > Actions) and run this again."

102− if [ "$DRY_RUN" = true ]; then echo "::warning::$m"; else fail "$m"; fi

103− fi

104− signed=true

134+ signed=${SIGNED:-false}

105− [ -n "$KEYSTORE_BASE64" ] || signed=false

106 prerelease=$PRERELEASE

135 prerelease=$PRERELEASE

107− if [ "$signed" = false ]; then

108− prerelease=true

136+ [ "$signed" = true ] || prerelease=true

109− echo "::warning::No MULTIGRAM_KEYSTORE_BASE64 secret: MultiGram $version will be signed with Forkgram's public test key and published as a pre-release."

110− fi

111

137

112 notes=$(mktemp)

138 notes=$(mktemp)

113 {

139 {

@@ -151,7 +177,7 @@ jobs:

151

177

152 build:

178 build:

153 name: Build

179 name: Build

154− needs: prepare

180+ needs: [check_secrets, prepare]

155 if: ${{ !inputs.dry_run }}

181 if: ${{ !inputs.dry_run }}

156 uses: ./.github/workflows/build.yml

182 uses: ./.github/workflows/build.yml

157 with:

183 with:

README.md+11

@@ -21,6 +21,17 @@ the exact code, so the stack can be re-applied by hand.

21code (a few minutes). Tick **APK** to also build a release APK; it compiles the native code

22too, so it takes much longer, and the APK is attached to the run as `multigram-apk`.

24+## Releases

25+

26+**Actions > Release MultiGram > Run workflow** builds the release APK of `multigram` and publishes

27+it on the Releases page (about 80 minutes; tick **dry_run** to see only the version and notes).

28+Versions follow Forkgram's scheme: `12.10.6.1` is the first MultiGram release on Forkgram 12.10.6,

29+`12.10.6.2` the second, and after a Forkgram update the count starts again at 1 (at most 9 per

30+Forkgram version). The tag is the version. It needs the API id and hash secrets below. Without the

31+signing secrets the APK is signed with Forkgram's public test key and published as a pre-release

32+that says so. Details: section 10.6 of

33+[PATCH.md](https://github.com/iko-soy/Multigram/blob/docs/PATCH.md).

34+

24## Secrets

35## Secrets

26Set these in **Settings > Secrets and variables > Actions**:

37Set these in **Settings > Secrets and variables > Actions**: