ml
7a91a37049
build / build (push) Successful in 3m4s
Deployments reachable outside a trusted LAN need some form of access control. Set FUELISH_API_KEY and the server requires a matching X-API-Key header on /jobs; unset, behavior is unchanged (no auth). The Android app gets a matching Settings field. This only checks the key - TLS termination is left to a reverse proxy in front of the server, not handled here.
84 lines
3.5 KiB
YAML
84 lines
3.5 KiB
YAML
name: build
|
|
|
|
# Builds the Android app (android/) debug APK on every push/PR, plus
|
|
# on-demand via the Gitea "Run workflow" button. Runs inside build-image
|
|
# (see ../../build-image/Dockerfile, built/pushed via ../../build-image.sh
|
|
# and ../../upload-image.sh), which bundles the JDK, Android SDK, and
|
|
# Node.js (needed by the JS-based actions below - see
|
|
# build-image/Dockerfile's own comment) so the runner itself doesn't need
|
|
# any of that installed. The Gradle build still needs network access at
|
|
# job runtime (Gradle/AGP/androidx dependency resolution).
|
|
on:
|
|
push:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
# Runner defaults `run:` steps to `sh`, which doesn't understand
|
|
# `set -o pipefail` used below - force bash explicitly.
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
# Must match a label your act_runner is registered with.
|
|
runs-on: ubuntu-latest
|
|
|
|
container:
|
|
image: cr.ladkau.de/fuelish/android-builder:latest
|
|
credentials:
|
|
username: ${{ secrets.REGISTRY_USER }}
|
|
password: ${{ secrets.REGISTRY_PASSWORD }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
# `make android`'s version comes from `git describe --tags` -
|
|
# needs full history/tags, not actions/checkout's default
|
|
# shallow single-commit clone.
|
|
fetch-depth: 0
|
|
|
|
- name: Preflight
|
|
run: |
|
|
set -euo pipefail
|
|
command -v java >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: java not in PATH" >&2; exit 1; }
|
|
command -v make >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: make not in PATH" >&2; exit 1; }
|
|
[ -n "${ANDROID_HOME:-}" ] || { echo "PREFLIGHT FAIL: ANDROID_HOME not set" >&2; exit 1; }
|
|
|
|
- name: Build
|
|
run: make android
|
|
|
|
- name: Upload build artifact
|
|
# v4 uses the newer @actions/artifact backend, which this Gitea
|
|
# instance's artifact storage doesn't support (GHESNotSupportedError) — v3 works.
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: fuelish-android
|
|
path: dist/fuelish-*.apk
|
|
|
|
- name: Publish to dl.ladkau.de
|
|
# Uploads the APK over SFTP instead of using actions/upload-artifact
|
|
# (whose zip wrapping can't be disabled). Runs on push and on a
|
|
# manual "Run workflow" dispatch (the on-demand way to publish an
|
|
# update without pushing a commit) - excludes pull_request so PR
|
|
# builds from unreviewed branches don't publish.
|
|
if: gitea.event_name == 'push' || gitea.event_name == 'workflow_dispatch'
|
|
run: |
|
|
set -euo pipefail
|
|
APK="$(ls dist/fuelish-*.apk)"
|
|
mkdir -p ~/.ssh
|
|
printf '%s\n' '${{ secrets.DL_SFTP_KEY }}' > ~/.ssh/dl_sftp_key
|
|
chmod 600 ~/.ssh/dl_sftp_key
|
|
# Sanity-check the key is actually loadable before attempting the
|
|
# SFTP connection - fails fast with a clear message instead of
|
|
# SFTP's much less obvious "Permission denied" when the key
|
|
# material itself is malformed (e.g. mangled by how the secret
|
|
# was entered into Gitea - see DL_SFTP_KEY in README.md).
|
|
ssh-keygen -y -f ~/.ssh/dl_sftp_key > /dev/null \
|
|
|| { echo "FAIL: ~/.ssh/dl_sftp_key is not a valid private key - re-check the DL_SFTP_KEY secret" >&2; exit 1; }
|
|
sftp -i ~/.ssh/dl_sftp_key -P 2223 \
|
|
-o StrictHostKeyChecking=accept-new \
|
|
uploader@dl.ladkau.de <<EOF
|
|
-mkdir files/fuelish
|
|
put $APK files/fuelish/$(basename "$APK")
|
|
EOF
|