@@ -1,242 +0,0 @@
1−name: Release MultiGram
2−run-name: Release ${{ inputs.ref }}${{ inputs.dry_run && ' (dry run)' || '' }}
3−
4−# Builds the release APK of a MultiGram commit and publishes it as a GitHub Release.
5−#
6−# Version: Forkgram's own scheme, APP_VERSION_NAME.N (for example 12.10.6.1), where APP_VERSION_NAME
7−# comes from gradle.properties of the Forkgram snapshot and N (1 to 9) counts MultiGram releases on
8−# that Forkgram version. The Android versionCode is (APP_VERSION_CODE * 10 + N) * 10 + 9, so every
9−# release installs as an update over the one before, and a new Forkgram version starts again at N = 1.
10−# The tag is the version itself, like Forkgram's tags.
11−
12−on:
13− workflow_dispatch:
14− inputs:
15− ref:
16− description: Branch, tag or commit to release
17− default: multigram
18− required: true
19− number:
20− description: MultiGram build number for this Forkgram version (1 to 9). Empty picks the next free one.
21− required: false
22− default: ''
23− prerelease:
24− description: Mark it as a pre-release (always the case without your own signing key)
25− type: boolean
26− default: false
27− dry_run:
28− description: Only work out the version and the release notes; build and publish nothing
29− type: boolean
30− default: false
31−
32−permissions:
33− contents: read
34−
35−concurrency:
36− group: release
37− cancel-in-progress: false
38−
39−jobs:
40− check_secrets:
41− # A job of its own, so that no secret value is registered in the job that writes the release
42− # notes: the runner drops any job output that contains a secret's value (a key alias like
43− # "release" would otherwise blank the notes).
44− name: Check the secrets
45− runs-on: ubuntu-latest
46− outputs:
47− signed: ${{ steps.s.outputs.signed }}
48− steps:
49− - name: Check the secrets
50− id: s
51− env:
52− DRY_RUN: ${{ inputs.dry_run }}
53− APP_ID: ${{ secrets.MULTIGRAM_APP_ID }}
54− APP_HASH: ${{ secrets.MULTIGRAM_APP_HASH }}
55− KEYSTORE_BASE64: ${{ secrets.MULTIGRAM_KEYSTORE_BASE64 }}
56− KEYSTORE_PASSWORD: ${{ secrets.MULTIGRAM_KEYSTORE_PASSWORD }}
57− KEY_ALIAS: ${{ secrets.MULTIGRAM_KEY_ALIAS }}
58− run: |
59− set -euo pipefail
60− # Stop here, in seconds, rather than after the long build. A dry run only warns.
61− problem() { if [ "$DRY_RUN" = true ]; then echo "::warning::$1"; else echo "::error::$1"; exit 1; fi; }
62− if [ -z "$APP_ID" ] || [ -z "$APP_HASH" ]; then
63− problem "The MULTIGRAM_APP_ID and MULTIGRAM_APP_HASH secrets are not set, so the APK could not log in. Add them (Settings > Secrets and variables > Actions) and run this again."
64− fi
65− if [ -n "$KEYSTORE_BASE64" ]; then
66− if [ -z "$KEYSTORE_PASSWORD" ] || [ -z "$KEY_ALIAS" ]; then
67− problem "MULTIGRAM_KEYSTORE_BASE64 is set, but MULTIGRAM_KEYSTORE_PASSWORD or MULTIGRAM_KEY_ALIAS is not: signing would fail at the end of the build. Add both."
68− fi
69− echo "signed=true" >> "$GITHUB_OUTPUT"
70− else
71− echo "::warning::No MULTIGRAM_KEYSTORE_BASE64 secret: the release will be signed with Forkgram's public test key and published as a pre-release."
72− echo "signed=false" >> "$GITHUB_OUTPUT"
73− fi
74−
75− prepare:
76− name: Work out the version
77− needs: check_secrets
78− runs-on: ubuntu-latest
79− outputs:
80− sha: ${{ steps.v.outputs.sha }}
81− number: ${{ steps.v.outputs.number }}
82− version: ${{ steps.v.outputs.version }}
83− version_code: ${{ steps.v.outputs.version_code }}
84− prerelease: ${{ steps.v.outputs.prerelease }}
85− notes: ${{ steps.v.outputs.notes }}
86− steps:
87− - uses: actions/checkout@v4
88− with:
89− ref: ${{ inputs.ref }}
90− fetch-depth: 0
91− - name: Version, secrets and release notes
92− id: v
93− env:
94− NUMBER: ${{ inputs.number }}
95− PRERELEASE: ${{ inputs.prerelease }}
96− DRY_RUN: ${{ inputs.dry_run }}
97− SIGNED: ${{ needs.check_secrets.outputs.signed }}
98− run: |
99− set -euo pipefail
100− fail() { echo "::error::$1"; exit 1; }
101− sha=$(git rev-parse HEAD)
102− name=$(sed -n 's/^APP_VERSION_NAME=//p' gradle.properties | tail -n 1)
103− code=$(sed -n 's/^APP_VERSION_CODE=//p' gradle.properties | tail -n 1)
104− [[ "$name" =~ ^[0-9]+(\.[0-9]+)*$ ]] || fail "APP_VERSION_NAME in gradle.properties is '$name', not a version number."
105− [[ "$code" =~ ^[0-9]+$ ]] || fail "APP_VERSION_CODE in gradle.properties is '$code', not a number."
106−
107− # The next free N for this Forkgram version, from the tags that already exist.
108− last=$(git tag -l "$name.*" | sed -n "s/^${name//./\\.}\.\([0-9]\)$/\1/p" | sort -n | tail -n 1)
109− if [ -n "$NUMBER" ]; then
110− n=$NUMBER
111− else
112− n=$(( ${last:-0} + 1 ))
113− fi
114− [[ "$n" =~ ^[1-9]$ ]] || fail "The MultiGram build number must be 1 to 9 (got '$n'). Nine releases on Forkgram $name are the most its version codes allow; wait for the next Forkgram version."
115− version="$name.$n"
116− if git rev-parse -q --verify "refs/tags/$version" >/dev/null; then
117− fail "Tag $version already exists: MultiGram $version is already released. Leave the number empty to take the next free one."
118− fi
119− if [ -n "$last" ] && [ "$n" -le "$last" ]; then
120− echo "::warning::$name.$last is already released, so $version has a lower version code and will not install as an update over it."
121− fi
122− version_code=$(( (code * 10 + n) * 10 + 9 ))
123−
124− # What it is built on, from the snapshot commit the sync made.
125− snap=$(git log -n 1 --format=%H --grep='^Forkgram-Version: ' HEAD || true)
126− fg_version=unknown; tg_version=unknown
127− if [ -n "$snap" ]; then
128− msg=$(git log -1 --format=%B "$snap")
129− fg_version=$(printf '%s\n' "$msg" | sed -n 's/^Forkgram-Version: //p' | head -n 1)
130− tg_version=$(printf '%s\n' "$msg" | sed -n 's/^Telegram-Base: .*(update to \([0-9.]*\).*/\1/p' | head -n 1)
131− fg_version=${fg_version:-unknown}; tg_version=${tg_version:-unknown}
132− fi
133−
134− signed=${SIGNED:-false}
135− prerelease=$PRERELEASE
136− [ "$signed" = true ] || prerelease=true
137−
138− notes=$(mktemp)
139− {
140− echo "MultiGram $version is Forkgram $fg_version (Telegram $tg_version) with the MultiGram changes listed below."
141− echo
142− if [ "$signed" = true ]; then
143− echo "**Signing:** signed with the MultiGram release key. It installs as an update over earlier MultiGram releases signed with the same key."
144− else
145− echo "**Signing: public test key.** This APK is signed with Forkgram's public test key (\`TMessagesProj/config/test.keystore\`), because the repository has no \`MULTIGRAM_KEYSTORE_BASE64\` secret. Anyone can sign an \"update\" for it, and a later release signed with a real key cannot update it. Use it for testing only."
146− fi
147− echo
148− echo "**Version:** $version (Android version code $version_code). Built from $sha."
149− echo
150− echo "**MultiGram changes on top of Forkgram $fg_version:**"
151− echo
152− if [ -n "$snap" ]; then
153− git log --reverse --format='- %s (%h)' "$snap..HEAD"
154− else
155− echo "- (no Forkgram snapshot found in the history)"
156− fi
157− } > "$notes"
158−
159− {
160− echo "sha=$sha"
161− echo "number=$n"
162− echo "version=$version"
163− echo "version_code=$version_code"
164− echo "prerelease=$prerelease"
165− echo "notes<<MULTIGRAM_NOTES_EOF"
166− cat "$notes"
167− echo "MULTIGRAM_NOTES_EOF"
168− } >> "$GITHUB_OUTPUT"
169− {
170− if [ "$DRY_RUN" = true ]; then echo "## MultiGram $version (dry run: nothing built or published)"; else echo "## MultiGram $version"; fi
171− echo
172− echo "Pre-release: $prerelease"
173− echo
174− cat "$notes"
175− } >> "$GITHUB_STEP_SUMMARY"
176− cat "$notes"
177−
178− build:
179− name: Build
180− needs: [check_secrets, prepare]
181− if: ${{ !inputs.dry_run }}
182− uses: ./.github/workflows/build.yml
183− with:
184− ref: ${{ needs.prepare.outputs.sha }}
185− apk: true
186− build_number: ${{ needs.prepare.outputs.number }}
187− secrets: inherit
188−
189− publish:
190− name: Publish the release
191− needs: [prepare, build]
192− runs-on: ubuntu-latest
193− permissions:
194− contents: write
195− steps:
196− - uses: actions/download-artifact@v4
197− with:
198− name: multigram-apk
199− path: apk
200− - name: Check the APK and publish it
201− env:
202− GH_TOKEN: ${{ github.token }}
203− SHA: ${{ needs.prepare.outputs.sha }}
204− VERSION: ${{ needs.prepare.outputs.version }}
205− VERSION_CODE: ${{ needs.prepare.outputs.version_code }}
206− PRERELEASE: ${{ needs.prepare.outputs.prerelease }}
207− NOTES: ${{ needs.prepare.outputs.notes }}
208− run: |
209− set -euo pipefail
210− fail() { echo "::error::$1"; exit 1; }
211− shopt -s nullglob
212− apks=(apk/*.apk)
213− [ "${#apks[@]}" -eq 1 ] || fail "Expected one APK in the build artifact, found ${#apks[@]}."
214− file="MultiGram-$VERSION.apk"
215− mv "${apks[0]}" "$file"
216−
217− tools=$(ls -d "$ANDROID_HOME"/build-tools/* | sort -V | tail -n 1)
218− badging=$("$tools/aapt2" dump badging "$file" | head -n 1)
219− echo "$badging"
220− got_name=$(printf '%s' "$badging" | sed -n "s/.* versionName='\([^']*\)'.*/\1/p")
221− got_code=$(printf '%s' "$badging" | sed -n "s/.* versionCode='\([^']*\)'.*/\1/p")
222− [ "$got_name" = "$VERSION" ] || fail "The APK says versionName $got_name, expected $VERSION."
223− [ "$got_code" = "$VERSION_CODE" ] || fail "The APK says versionCode $got_code, expected $VERSION_CODE."
224− cert=$("$tools/apksigner" verify --print-certs "$file" | sed -n 's/^Signer #1 certificate SHA-256 digest: //p' | head -n 1)
225− [ -n "$cert" ] || fail "apksigner could not verify the APK's signature."
226− sha256sum "$file" > SHA256SUMS
227−
228− {
229− printf '%s\n' "$NOTES"
230− echo
231− echo "**Checksums:** \`$(cut -d' ' -f1 SHA256SUMS)\` ($file, SHA-256). Signing certificate SHA-256: \`$cert\`."
232− } > notes.md
233−
234− flags=()
235− if [ "$PRERELEASE" = true ]; then flags+=(--prerelease); fi
236− gh release create "$VERSION" "$file" SHA256SUMS \
237− --repo "$GITHUB_REPOSITORY" \
238− --target "$SHA" \
239− --title "MultiGram $VERSION" \
240− --notes-file notes.md \
241− "${flags[@]}"
242− echo "Published https://github.com/$GITHUB_REPOSITORY/releases/tag/$VERSION" | tee -a "$GITHUB_STEP_SUMMARY"