@@ -0,0 +1,242 @@
1+name: Release MultiGram
2+run-name: Release ${{ inputs.ref }}${{ inputs.dry_run && ' (dry run)' || '' }}
3+
4+# Builds the release APK of a MultiGram commit and publishes it as a GitHub Release.
5+#
6+# Version: Forkgram's own scheme, APP_VERSION_NAME.N (for example 12.10.6.1), where APP_VERSION_NAME
7+# comes from gradle.properties of the Forkgram snapshot and N (1 to 9) counts MultiGram releases on
8+# that Forkgram version. The Android versionCode is (APP_VERSION_CODE * 10 + N) * 10 + 9, so every
9+# release installs as an update over the one before, and a new Forkgram version starts again at N = 1.
10+# The tag is the version itself, like Forkgram's tags.
11+
12+on:
13+ workflow_dispatch:
14+ inputs:
15+ ref:
16+ description: Branch, tag or commit to release
17+ default: multigram
18+ required: true
19+ number:
20+ description: MultiGram build number for this Forkgram version (1 to 9). Empty picks the next free one.
21+ required: false
22+ default: ''
23+ prerelease:
24+ description: Mark it as a pre-release (always the case without your own signing key)
25+ type: boolean
26+ default: false
27+ dry_run:
28+ description: Only work out the version and the release notes; build and publish nothing
29+ type: boolean
30+ default: false
31+
32+permissions:
33+ contents: read
34+
35+concurrency:
36+ group: release
37+ cancel-in-progress: false
38+
39+jobs:
40+ check_secrets:
41+ # A job of its own, so that no secret value is registered in the job that writes the release
42+ # notes: the runner drops any job output that contains a secret's value (a key alias like
43+ # "release" would otherwise blank the notes).
44+ name: Check the secrets
45+ runs-on: ubuntu-latest
46+ outputs:
47+ signed: ${{ steps.s.outputs.signed }}
48+ steps:
49+ - name: Check the secrets
50+ id: s
51+ env:
52+ DRY_RUN: ${{ inputs.dry_run }}
53+ APP_ID: ${{ secrets.MULTIGRAM_APP_ID }}
54+ APP_HASH: ${{ secrets.MULTIGRAM_APP_HASH }}
55+ KEYSTORE_BASE64: ${{ secrets.MULTIGRAM_KEYSTORE_BASE64 }}
56+ KEYSTORE_PASSWORD: ${{ secrets.MULTIGRAM_KEYSTORE_PASSWORD }}
57+ KEY_ALIAS: ${{ secrets.MULTIGRAM_KEY_ALIAS }}
58+ run: |
59+ set -euo pipefail
60+ # Stop here, in seconds, rather than after the long build. A dry run only warns.
61+ problem() { if [ "$DRY_RUN" = true ]; then echo "::warning::$1"; else echo "::error::$1"; exit 1; fi; }
62+ if [ -z "$APP_ID" ] || [ -z "$APP_HASH" ]; then
63+ problem "The MULTIGRAM_APP_ID and MULTIGRAM_APP_HASH secrets are not set, so the APK could not log in. Add them (Settings > Secrets and variables > Actions) and run this again."
64+ fi
65+ if [ -n "$KEYSTORE_BASE64" ]; then
66+ if [ -z "$KEYSTORE_PASSWORD" ] || [ -z "$KEY_ALIAS" ]; then
67+ problem "MULTIGRAM_KEYSTORE_BASE64 is set, but MULTIGRAM_KEYSTORE_PASSWORD or MULTIGRAM_KEY_ALIAS is not: signing would fail at the end of the build. Add both."
68+ fi
69+ echo "signed=true" >> "$GITHUB_OUTPUT"
70+ else
71+ echo "::warning::No MULTIGRAM_KEYSTORE_BASE64 secret: the release will be signed with Forkgram's public test key and published as a pre-release."
72+ echo "signed=false" >> "$GITHUB_OUTPUT"
73+ fi
74+
75+ prepare:
76+ name: Work out the version
77+ needs: check_secrets
78+ runs-on: ubuntu-latest
79+ outputs:
80+ sha: ${{ steps.v.outputs.sha }}
81+ number: ${{ steps.v.outputs.number }}
82+ version: ${{ steps.v.outputs.version }}
83+ version_code: ${{ steps.v.outputs.version_code }}
84+ prerelease: ${{ steps.v.outputs.prerelease }}
85+ notes: ${{ steps.v.outputs.notes }}
86+ steps:
87+ - uses: actions/checkout@v4
88+ with:
89+ ref: ${{ inputs.ref }}
90+ fetch-depth: 0
91+ - name: Version, secrets and release notes
92+ id: v
93+ env:
94+ NUMBER: ${{ inputs.number }}
95+ PRERELEASE: ${{ inputs.prerelease }}
96+ DRY_RUN: ${{ inputs.dry_run }}
97+ SIGNED: ${{ needs.check_secrets.outputs.signed }}
98+ run: |
99+ set -euo pipefail
100+ fail() { echo "::error::$1"; exit 1; }
101+ sha=$(git rev-parse HEAD)
102+ name=$(sed -n 's/^APP_VERSION_NAME=//p' gradle.properties | tail -n 1)
103+ code=$(sed -n 's/^APP_VERSION_CODE=//p' gradle.properties | tail -n 1)
104+ [[ "$name" =~ ^[0-9]+(\.[0-9]+)*$ ]] || fail "APP_VERSION_NAME in gradle.properties is '$name', not a version number."
105+ [[ "$code" =~ ^[0-9]+$ ]] || fail "APP_VERSION_CODE in gradle.properties is '$code', not a number."
106+
107+ # The next free N for this Forkgram version, from the tags that already exist.
108+ last=$(git tag -l "$name.*" | sed -n "s/^${name//./\\.}\.\([0-9]\)$/\1/p" | sort -n | tail -n 1)
109+ if [ -n "$NUMBER" ]; then
110+ n=$NUMBER
111+ else
112+ n=$(( ${last:-0} + 1 ))
113+ fi
114+ [[ "$n" =~ ^[1-9]$ ]] || fail "The MultiGram build number must be 1 to 9 (got '$n'). Nine releases on Forkgram $name are the most its version codes allow; wait for the next Forkgram version."
115+ version="$name.$n"
116+ if git rev-parse -q --verify "refs/tags/$version" >/dev/null; then
117+ fail "Tag $version already exists: MultiGram $version is already released. Leave the number empty to take the next free one."
118+ fi
119+ if [ -n "$last" ] && [ "$n" -le "$last" ]; then
120+ echo "::warning::$name.$last is already released, so $version has a lower version code and will not install as an update over it."
121+ fi
122+ version_code=$(( (code * 10 + n) * 10 + 9 ))
123+
124+ # What it is built on, from the snapshot commit the sync made.
125+ snap=$(git log -n 1 --format=%H --grep='^Forkgram-Version: ' HEAD || true)
126+ fg_version=unknown; tg_version=unknown
127+ if [ -n "$snap" ]; then
128+ msg=$(git log -1 --format=%B "$snap")
129+ fg_version=$(printf '%s\n' "$msg" | sed -n 's/^Forkgram-Version: //p' | head -n 1)
130+ tg_version=$(printf '%s\n' "$msg" | sed -n 's/^Telegram-Base: .*(update to \([0-9.]*\).*/\1/p' | head -n 1)
131+ fg_version=${fg_version:-unknown}; tg_version=${tg_version:-unknown}
132+ fi
133+
134+ signed=${SIGNED:-false}
135+ prerelease=$PRERELEASE
136+ [ "$signed" = true ] || prerelease=true
137+
138+ notes=$(mktemp)
139+ {
140+ echo "MultiGram $version is Forkgram $fg_version (Telegram $tg_version) with the MultiGram changes listed below."
141+ echo
142+ if [ "$signed" = true ]; then
143+ echo "**Signing:** signed with the MultiGram release key. It installs as an update over earlier MultiGram releases signed with the same key."
144+ else
145+ echo "**Signing: public test key.** This APK is signed with Forkgram's public test key (\`TMessagesProj/config/test.keystore\`), because the repository has no \`MULTIGRAM_KEYSTORE_BASE64\` secret. Anyone can sign an \"update\" for it, and a later release signed with a real key cannot update it. Use it for testing only."
146+ fi
147+ echo
148+ echo "**Version:** $version (Android version code $version_code). Built from $sha."
149+ echo
150+ echo "**MultiGram changes on top of Forkgram $fg_version:**"
151+ echo
152+ if [ -n "$snap" ]; then
153+ git log --reverse --format='- %s (%h)' "$snap..HEAD"
154+ else
155+ echo "- (no Forkgram snapshot found in the history)"
156+ fi
157+ } > "$notes"
158+
159+ {
160+ echo "sha=$sha"
161+ echo "number=$n"
162+ echo "version=$version"
163+ echo "version_code=$version_code"
164+ echo "prerelease=$prerelease"
165+ echo "notes<<MULTIGRAM_NOTES_EOF"
166+ cat "$notes"
167+ echo "MULTIGRAM_NOTES_EOF"
168+ } >> "$GITHUB_OUTPUT"
169+ {
170+ if [ "$DRY_RUN" = true ]; then echo "## MultiGram $version (dry run: nothing built or published)"; else echo "## MultiGram $version"; fi
171+ echo
172+ echo "Pre-release: $prerelease"
173+ echo
174+ cat "$notes"
175+ } >> "$GITHUB_STEP_SUMMARY"
176+ cat "$notes"
177+
178+ build:
179+ name: Build
180+ needs: [check_secrets, prepare]
181+ if: ${{ !inputs.dry_run }}
182+ uses: ./.github/workflows/build.yml
183+ with:
184+ ref: ${{ needs.prepare.outputs.sha }}
185+ apk: true
186+ build_number: ${{ needs.prepare.outputs.number }}
187+ secrets: inherit
188+
189+ publish:
190+ name: Publish the release
191+ needs: [prepare, build]
192+ runs-on: ubuntu-latest
193+ permissions:
194+ contents: write
195+ steps:
196+ - uses: actions/download-artifact@v4
197+ with:
198+ name: multigram-apk
199+ path: apk
200+ - name: Check the APK and publish it
201+ env:
202+ GH_TOKEN: ${{ github.token }}
203+ SHA: ${{ needs.prepare.outputs.sha }}
204+ VERSION: ${{ needs.prepare.outputs.version }}
205+ VERSION_CODE: ${{ needs.prepare.outputs.version_code }}
206+ PRERELEASE: ${{ needs.prepare.outputs.prerelease }}
207+ NOTES: ${{ needs.prepare.outputs.notes }}
208+ run: |
209+ set -euo pipefail
210+ fail() { echo "::error::$1"; exit 1; }
211+ shopt -s nullglob
212+ apks=(apk/*.apk)
213+ [ "${#apks[@]}" -eq 1 ] || fail "Expected one APK in the build artifact, found ${#apks[@]}."
214+ file="MultiGram-$VERSION.apk"
215+ mv "${apks[0]}" "$file"
216+
217+ tools=$(ls -d "$ANDROID_HOME"/build-tools/* | sort -V | tail -n 1)
218+ badging=$("$tools/aapt2" dump badging "$file" | head -n 1)
219+ echo "$badging"
220+ got_name=$(printf '%s' "$badging" | sed -n "s/.* versionName='\([^']*\)'.*/\1/p")
221+ got_code=$(printf '%s' "$badging" | sed -n "s/.* versionCode='\([^']*\)'.*/\1/p")
222+ [ "$got_name" = "$VERSION" ] || fail "The APK says versionName $got_name, expected $VERSION."
223+ [ "$got_code" = "$VERSION_CODE" ] || fail "The APK says versionCode $got_code, expected $VERSION_CODE."
224+ cert=$("$tools/apksigner" verify --print-certs "$file" | sed -n 's/^Signer #1 certificate SHA-256 digest: //p' | head -n 1)
225+ [ -n "$cert" ] || fail "apksigner could not verify the APK's signature."
226+ sha256sum "$file" > SHA256SUMS
227+
228+ {
229+ printf '%s\n' "$NOTES"
230+ echo
231+ echo "**Checksums:** \`$(cut -d' ' -f1 SHA256SUMS)\` ($file, SHA-256). Signing certificate SHA-256: \`$cert\`."
232+ } > notes.md
233+
234+ flags=()
235+ if [ "$PRERELEASE" = true ]; then flags+=(--prerelease); fi
236+ gh release create "$VERSION" "$file" SHA256SUMS \
237+ --repo "$GITHUB_REPOSITORY" \
238+ --target "$SHA" \
239+ --title "MultiGram $VERSION" \
240+ --notes-file notes.md \
241+ "${flags[@]}"
242+ echo "Published https://github.com/$GITHUB_REPOSITORY/releases/tag/$VERSION" | tee -a "$GITHUB_STEP_SUMMARY"