@@ -90,6 +90,10 @@ jobs:
9090 env:
9191 APP_ID: ${{ secrets.MULTIGRAM_APP_ID }}
9292 APP_HASH: ${{ secrets.MULTIGRAM_APP_HASH }}
93+ KEYSTORE_BASE64: ${{ secrets.MULTIGRAM_KEYSTORE_BASE64 }}
94+ KEYSTORE_PASSWORD: ${{ secrets.MULTIGRAM_KEYSTORE_PASSWORD }}
95+ KEY_ALIAS: ${{ secrets.MULTIGRAM_KEY_ALIAS }}
96+ KEY_PASSWORD: ${{ secrets.MULTIGRAM_KEY_PASSWORD }}
9397 run: |
9498 vars=gradle.properties
9599 echo "org.gradle.workers.max=1" >> $vars
@@ -99,11 +103,25 @@ jobs:
99103 echo "org.gradle.parallel=false" >> $vars
100104 [ -n "$APP_ID" ] && echo "APP_ID=$APP_ID" >> $vars
101105 [ -n "$APP_HASH" ] && echo "APP_HASH=$APP_HASH" >> $vars
102− echo "RELEASE_KEYSTORE_FILE=$PWD/TMessagesProj/config/release.keystore" >> $vars
106+ signing=()
107+ if [ -n "$KEYSTORE_BASE64" ]; then
108+ # Your own release key, from the MULTIGRAM_KEYSTORE_* secrets; it never touches the repository.
109+ echo "$KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.keystore"
110+ signing=(
111+ "-PRELEASE_KEYSTORE_FILE=$RUNNER_TEMP/release.keystore"
112+ "-PRELEASE_STORE_PASSWORD=$KEYSTORE_PASSWORD"
113+ "-PRELEASE_KEY_ALIAS=$KEY_ALIAS"
114+ "-PRELEASE_KEY_PASSWORD=${KEY_PASSWORD:-$KEYSTORE_PASSWORD}"
115+ )
116+ else
117+ # Without RELEASE_KEYSTORE_FILE the build signs with the public test key in
118+ # TMessagesProj/config/test.keystore: fine for testing, not for an APK you give out.
119+ echo "::warning::No MULTIGRAM_KEYSTORE_BASE64 secret: the APK is signed with the public test key."
120+ fi
103121 sudo apt update
104122 sudo apt -y install ninja-build meson nasm gperf pkg-config unzip
105123 rustup target add aarch64-linux-android armv7-linux-androideabi i686-linux-android x86_64-linux-android
106− ./gradlew :TMessagesProj_App:assembleAfatRelease
124+ ./gradlew "${signing[@]}" :TMessagesProj_App:assembleAfatRelease
107125 - uses: actions/upload-artifact@v4
108126 with:
109127 name: multigram-apk