Sign release APKs with a fixed key from CI secrets

2026-09-20 17:47:43 +02:00
parent f0a83df667
commit 295f4869c1
7 changed files with 137 additions and 18 deletions
@@ -69,7 +69,25 @@ jobs:
            dist/shockolate-*-linux-*.tar.gz
            dist/shockolate-*-windows-*.zip

+      # The release key is stored base64-encoded in ANDROID_KEYSTORE_BASE64
+      # (see README section 4.3). Without it the APK is a debug build.
+      - name: Prepare release signing
+        env:
+          KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+        run: |
+          set -euo pipefail
+          if [ -z "$KEYSTORE_BASE64" ]; then
+            echo "No signing key: the APK will be a debug build"
+            exit 0
+          fi
+          echo "$KEYSTORE_BASE64" | base64 -d > "${RUNNER_TEMP:-/tmp}/questshock-release.jks"
+          echo "QUESTSHOCK_KEYSTORE=${RUNNER_TEMP:-/tmp}/questshock-release.jks" >> "$GITHUB_ENV"
+
      - name: Build Quest APK
+        env:
+          QUESTSHOCK_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          QUESTSHOCK_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          QUESTSHOCK_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
        # QUESTSHOCK_BUILD_IMAGE is already set (see Preflight above), so
        # this runs build-apk.sh directly instead of trying to docker-run
        # the image again - same reasoning as `make package` above.