264 lines
8.8 KiB
YAML
264 lines
8.8 KiB
YAML
name: Deliver Mobile Stores
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
release_tag:
|
|
description: "Formal GitHub Release tag to deliver (vX.Y.Z)"
|
|
required: true
|
|
type: string
|
|
platform:
|
|
description: "Store platform"
|
|
required: true
|
|
default: both
|
|
type: choice
|
|
options:
|
|
- both
|
|
- android
|
|
- ios
|
|
android_track:
|
|
description: "Google Play track"
|
|
required: true
|
|
default: production
|
|
type: choice
|
|
options:
|
|
- production
|
|
- alpha
|
|
- beta
|
|
- internal
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: edgeever-store-delivery-${{ inputs.release_tag }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
plan:
|
|
if: github.repository == 'tianma-if/edgeever'
|
|
name: Validate store delivery source
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
version: ${{ steps.validate.outputs.version }}
|
|
version_code: ${{ steps.validate.outputs.version_code }}
|
|
steps:
|
|
- name: Check out the immutable Release tag
|
|
uses: actions/checkout@v5
|
|
with:
|
|
ref: ${{ inputs.release_tag }}
|
|
fetch-depth: 0
|
|
|
|
- name: Validate formal Release and resolve its predecessor
|
|
id: release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
RELEASE_TAG: ${{ inputs.release_tag }}
|
|
run: |
|
|
release="$(
|
|
gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}"
|
|
)"
|
|
test "$(jq -r '.draft' <<<"$release")" = "false"
|
|
test "$(jq -r '.prerelease' <<<"$release")" = "false"
|
|
test "$(jq -r '.tag_name' <<<"$release")" = "$RELEASE_TAG"
|
|
|
|
release_target="$(jq -r '.target_commitish' <<<"$release")"
|
|
test "$(git rev-parse "${RELEASE_TAG}^{commit}")" = "$(git rev-parse "${release_target}^{commit}")"
|
|
|
|
mapfile -t release_tags < <(
|
|
gh api "repos/${GITHUB_REPOSITORY}/releases?per_page=100" \
|
|
--jq '.[] | select(.draft == false and .prerelease == false) | .tag_name'
|
|
)
|
|
previous_tag=""
|
|
current_found="false"
|
|
for candidate in "${release_tags[@]}"; do
|
|
if [[ "$current_found" = "true" ]]; then
|
|
previous_tag="$candidate"
|
|
break
|
|
fi
|
|
if [[ "$candidate" = "$RELEASE_TAG" ]]; then
|
|
current_found="true"
|
|
fi
|
|
done
|
|
test "$current_found" = "true"
|
|
test -n "$previous_tag"
|
|
git fetch origin "refs/tags/${previous_tag}:refs/tags/${previous_tag}"
|
|
echo "previous_tag=$previous_tag" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Validate mobile version and audited change range
|
|
id: validate
|
|
env:
|
|
ANDROID_TRACK: ${{ inputs.android_track }}
|
|
PLATFORM: ${{ inputs.platform }}
|
|
PREVIOUS_TAG: ${{ steps.release.outputs.previous_tag }}
|
|
RELEASE_TAG: ${{ inputs.release_tag }}
|
|
run: |
|
|
node scripts/validate-store-delivery.mjs \
|
|
"$RELEASE_TAG" \
|
|
"$PREVIOUS_TAG" \
|
|
"$PLATFORM" \
|
|
"$ANDROID_TRACK" |
|
|
tee -a "$GITHUB_OUTPUT"
|
|
|
|
android:
|
|
needs: plan
|
|
if: inputs.platform == 'android' || inputs.platform == 'both'
|
|
name: Deliver Google Play
|
|
runs-on: [self-hosted, macOS, ARM64, edgeever-mobile]
|
|
timeout-minutes: 60
|
|
environment: ${{ inputs.android_track == 'production' && 'store-production' || 'store-delivery' }}
|
|
env:
|
|
ANDROID_HOME: /opt/homebrew/share/android-commandlinetools
|
|
ANDROID_SDK_ROOT: /opt/homebrew/share/android-commandlinetools
|
|
JAVA_HOME: /opt/homebrew/opt/openjdk@17/libexec/openjdk.jdk/Contents/Home
|
|
steps:
|
|
- name: Check out the immutable Release tag
|
|
uses: actions/checkout@v5
|
|
with:
|
|
ref: ${{ inputs.release_tag }}
|
|
clean: true
|
|
|
|
- name: Set up Bun
|
|
uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: 1.3.14
|
|
|
|
- name: Set up EAS CLI
|
|
uses: expo/expo-github-action@v8
|
|
with:
|
|
eas-version: 21.4.0
|
|
packager: npm
|
|
token: ${{ secrets.EXPO_TOKEN }}
|
|
|
|
- name: Restore Android upload keystore
|
|
env:
|
|
ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
|
|
run: |
|
|
test -n "$ANDROID_KEYSTORE_BASE64"
|
|
printf '%s' "$ANDROID_KEYSTORE_BASE64" | openssl base64 -d -A > "$RUNNER_TEMP/edgeever-upload.p12"
|
|
chmod 600 "$RUNNER_TEMP/edgeever-upload.p12"
|
|
|
|
- name: Build and verify signed Play bundle
|
|
env:
|
|
ANDROID_KEYSTORE_FILE: ${{ runner.temp }}/edgeever-upload.p12
|
|
ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
|
|
ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
|
|
ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
|
|
run: bun run build:android:play
|
|
|
|
- name: Preserve Play bundle and deobfuscation mapping
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: edgeever-${{ inputs.release_tag }}-google-play
|
|
path: |
|
|
apps/mobile/android/app/build/outputs/bundle/release/app-release.aab
|
|
apps/mobile/android/app/build/outputs/mapping/release/mapping.txt
|
|
if-no-files-found: error
|
|
compression-level: 0
|
|
|
|
- name: Upload bundle to Google Play
|
|
env:
|
|
ANDROID_TRACK: ${{ inputs.android_track }}
|
|
EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
|
|
run: |
|
|
test -n "$EXPO_TOKEN"
|
|
eas submit \
|
|
--platform android \
|
|
--profile "store-${ANDROID_TRACK}" \
|
|
--path android/app/build/outputs/bundle/release/app-release.aab \
|
|
--non-interactive \
|
|
--wait
|
|
working-directory: apps/mobile
|
|
|
|
- name: Remove temporary upload keystore
|
|
if: always()
|
|
run: rm -f "$RUNNER_TEMP/edgeever-upload.p12"
|
|
|
|
ios:
|
|
needs: plan
|
|
if: inputs.platform == 'ios' || inputs.platform == 'both'
|
|
name: Deliver App Store Connect
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 90
|
|
environment: store-delivery
|
|
steps:
|
|
- name: Check out the immutable Release tag
|
|
uses: actions/checkout@v5
|
|
with:
|
|
ref: ${{ inputs.release_tag }}
|
|
|
|
- name: Set up Bun
|
|
uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: 1.3.14
|
|
|
|
- name: Set up EAS CLI
|
|
uses: expo/expo-github-action@v8
|
|
with:
|
|
eas-version: 21.4.0
|
|
packager: npm
|
|
token: ${{ secrets.EXPO_TOKEN }}
|
|
|
|
- name: Set up Ruby and fastlane
|
|
uses: ruby/setup-ruby@v1
|
|
with:
|
|
ruby-version: "3.3"
|
|
bundler-cache: true
|
|
working-directory: apps/mobile
|
|
|
|
- name: Install dependencies
|
|
run: bun install --frozen-lockfile
|
|
|
|
- name: Build the iOS archive on EAS
|
|
id: build
|
|
env:
|
|
EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
|
|
RELEASE_TAG: ${{ inputs.release_tag }}
|
|
run: |
|
|
test -n "$EXPO_TOKEN"
|
|
build_json="$(
|
|
eas build \
|
|
--platform ios \
|
|
--profile production \
|
|
--message "Store delivery ${RELEASE_TAG}" \
|
|
--freeze-credentials \
|
|
--non-interactive \
|
|
--wait \
|
|
--json
|
|
)"
|
|
build_id="$(jq -r 'if type == "array" then .[0].id else .id end' <<<"$build_json")"
|
|
build_number="$(jq -r 'if type == "array" then .[0].appBuildVersion else .appBuildVersion end' <<<"$build_json")"
|
|
test -n "$build_id"
|
|
test "$build_id" != "null"
|
|
test -n "$build_number"
|
|
test "$build_number" != "null"
|
|
echo "build_id=$build_id" >> "$GITHUB_OUTPUT"
|
|
echo "build_number=$build_number" >> "$GITHUB_OUTPUT"
|
|
working-directory: apps/mobile
|
|
|
|
- name: Upload archive to App Store Connect and TestFlight
|
|
env:
|
|
EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
|
|
run: |
|
|
eas submit \
|
|
--platform ios \
|
|
--profile store-ios \
|
|
--id "${{ steps.build.outputs.build_id }}" \
|
|
--non-interactive \
|
|
--wait
|
|
working-directory: apps/mobile
|
|
|
|
- name: Submit the uploaded build to App Review
|
|
env:
|
|
APP_STORE_BUILD_NUMBER: ${{ steps.build.outputs.build_number }}
|
|
APP_STORE_CONNECT_API_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_ISSUER_ID }}
|
|
APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
|
|
APP_STORE_CONNECT_API_KEY_P8_BASE64: ${{ secrets.APP_STORE_CONNECT_API_KEY_P8_BASE64 }}
|
|
APP_STORE_VERSION: ${{ needs.plan.outputs.version }}
|
|
run: |
|
|
test -n "$APP_STORE_CONNECT_API_ISSUER_ID"
|
|
test -n "$APP_STORE_CONNECT_API_KEY_ID"
|
|
test -n "$APP_STORE_CONNECT_API_KEY_P8_BASE64"
|
|
bundle exec fastlane ios submit_review
|
|
working-directory: apps/mobile
|