Files
.github/workflows/sign-apk.yml

75 lines
3.3 KiB
YAML

on:
workflow_call:
inputs:
unsigned_apk:
required: false
type: string
default: sune-1500-unsigned.apk
secrets:
KEY_ALIAS:
required: true
KEYSTORE_PASS:
required: true
KEY_PASS:
required: true
JKS_BASE64:
required: true
jobs:
sign:
runs-on: ubuntu-latest
env:
KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
KEYSTORE_PASS: ${{ secrets.KEYSTORE_PASS }}
KEY_PASS: ${{ secrets.KEY_PASS }}
steps:
- uses: actions/checkout@v4
- uses: actions/setup-java@v4
with:
distribution: temurin
java-version: '17'
- run: sudo apt-get update && sudo apt-get install -y unzip wget
- env:
ANDROID_SDK_ROOT: ${{ runner.temp }}/android-sdk
run: |
set -e
export ANDROID_SDK_ROOT="${ANDROID_SDK_ROOT}"
mkdir -p "$ANDROID_SDK_ROOT"
cd /tmp
curl -fsSL -o commandlinetools.zip "https://dl.google.com/android/repository/commandlinetools-linux-9477386_latest.zip"
unzip -q commandlinetools.zip -d "$ANDROID_SDK_ROOT/cmdline-tools"
mkdir -p "$ANDROID_SDK_ROOT/cmdline-tools/latest"
mv "$ANDROID_SDK_ROOT/cmdline-tools"/cmdline-tools/* "$ANDROID_SDK_ROOT/cmdline-tools/latest/" || true
export PATH="$ANDROID_SDK_ROOT/cmdline-tools/latest/bin:$PATH"
yes | sdkmanager --sdk_root="$ANDROID_SDK_ROOT" --licenses
sdkmanager --sdk_root="$ANDROID_SDK_ROOT" "platform-tools" "platforms;android-33" "build-tools;33.0.2"
echo "ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT" >> $GITHUB_ENV
- run: echo "${{ secrets.JKS_BASE64 }}" | base64 --decode > sune-keystore.jks && chmod 600 sune-keystore.jks
- run: |
UNSIGNED="${{ inputs.unsigned_apk }}"
OUT=app-release-aligned.apk
SIGNED=app-release-signed.apk
echo "UNSIGNED=$UNSIGNED" >> $GITHUB_ENV
echo "OUT=$OUT" >> $GITHUB_ENV
echo "SIGNED=$SIGNED" >> $GITHUB_ENV
- run: |
if [ ! -f "$UNSIGNED" ]; then echo "Unsigned APK not found at $UNSIGNED" && exit 1; fi
ZIPALIGN=$(find "$ANDROID_SDK_ROOT" -type f -name zipalign -print -quit || true)
[ -z "$ZIPALIGN" ] && ZIPALIGN=$(command -v zipalign || true)
[ -z "$ZIPALIGN" ] && ls -la "$ANDROID_SDK_ROOT"/build-tools && exit 1
"$ZIPALIGN" -v -p 4 "$UNSIGNED" "$OUT"
- run: |
APKSIGNER=$(find "$ANDROID_SDK_ROOT" -type f -name apksigner -print -quit || true)
[ -z "$APKSIGNER" ] && APKSIGNER=$(command -v apksigner || true)
[ -z "$APKSIGNER" ] && ls -la "$ANDROID_SDK_ROOT"/build-tools && exit 1
"$APKSIGNER" sign --ks sune-keystore.jks --ks-key-alias "$KEY_ALIAS" --ks-pass "pass:${KEYSTORE_PASS}" --key-pass "pass:${KEY_PASS}" "$OUT"
mv "$OUT" "$SIGNED"
- run: |
APKSIGNER=$(find "$ANDROID_SDK_ROOT" -type f -name apksigner -print -quit || true)
[ -z "$APKSIGNER" ] && APKSIGNER=$(command -v apksigner || true)
[ -z "$APKSIGNER" ] && echo "apksigner not found for verify" && exit 1
"$APKSIGNER" verify --verbose "$SIGNED"
- uses: actions/upload-artifact@v4
with:
name: sune-signed-apk
path: app-release-signed.apk