Bump keep to v0.4.4 (restores pre_approve_nostr_event binding) (#277) #25
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| permissions: {} | |
| env: | |
| ANDROID_HOME: /usr/local/lib/android/sdk | |
| NDK_VERSION: "29.0.14206865" | |
| CARGO_NDK_VERSION: "4.1.2" | |
| RUST_VERSION: "1.89.0" | |
| BUILD_TOOLS_VERSION: "36.0.0" | |
| jobs: | |
| build: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup keep checkout | |
| uses: ./.github/actions/setup-keep | |
| - name: Verify toolchain version pins are consistent | |
| run: ./scripts/check-toolchain-pins.sh | |
| - name: Derive SOURCE_DATE_EPOCH | |
| run: | | |
| SDE="$(ANDROID_REPO="$GITHUB_WORKSPACE" KEEP_REPO="$GITHUB_WORKSPACE/keep" \ | |
| ./scripts/derive-sde.sh)" | |
| echo "SOURCE_DATE_EPOCH=$SDE" >> "$GITHUB_ENV" | |
| echo "Using SOURCE_DATE_EPOCH=$SDE" | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 | |
| with: | |
| java-version: '17' | |
| distribution: 'temurin' | |
| - name: Setup Android SDK | |
| uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1 | |
| - name: Install Android NDK and build-tools | |
| run: sdkmanager --install "ndk;${{ env.NDK_VERSION }}" "build-tools;${{ env.BUILD_TOOLS_VERSION }}" | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1 | |
| with: | |
| toolchain: ${{ env.RUST_VERSION }} | |
| targets: aarch64-linux-android,x86_64-linux-android | |
| # cache-targets: false keeps only the cargo registry cached so release | |
| # builds always compile from a clean target/, preserving bit-for-bit | |
| # reproducibility (commit 07445c8) if rust-cache ever regresses and | |
| # restores stale fingerprints. | |
| - name: Cache Rust | |
| uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2 | |
| with: | |
| workspaces: keep/keep-mobile | |
| cache-targets: "false" | |
| # Release outputs cache is keyed by github.sha so it only hits on re-runs | |
| # of the exact same tag commit. This preserves bit-for-bit reproducibility: | |
| # any input change (including SOURCE_DATE_EPOCH derived from commit times) | |
| # produces a new cache entry. Same inputs, same bytes. | |
| - name: Cache Rust build outputs | |
| id: cache-rust-outputs | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: | | |
| app/src/main/jniLibs | |
| app/src/main/kotlin/io/privkey/keep/uniffi | |
| key: rust-outputs-release-${{ runner.os }}-ndk${{ env.NDK_VERSION }}-rust${{ env.RUST_VERSION }}-ndkcargo${{ env.CARGO_NDK_VERSION }}-keep${{ hashFiles('keep.version') }}-lock${{ hashFiles('keep/Cargo.lock') }}-toolchain${{ hashFiles('keep/rust-toolchain.toml') }}-scripts${{ hashFiles('build-rust.sh', 'scripts/**/*.sh') }}-sha${{ github.sha }} | |
| - name: Install cargo-ndk | |
| if: steps.cache-rust-outputs.outputs.cache-hit != 'true' | |
| uses: taiki-e/install-action@213ccc1a076163c093f914550b94feb90fab916d # v2 | |
| with: | |
| tool: cargo-ndk@${{ env.CARGO_NDK_VERSION }} | |
| - name: Build native libraries | |
| if: steps.cache-rust-outputs.outputs.cache-hit != 'true' | |
| run: ./build-rust.sh | |
| env: | |
| KEEP_REPO: ${{ github.workspace }}/keep | |
| ANDROID_NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/${{ env.NDK_VERSION }} | |
| AWS_LC_SYS_CMAKE_BUILDER: "1" | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 | |
| - name: Decode keystore | |
| env: | |
| KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }} | |
| run: | | |
| if [ -z "$KEYSTORE_BASE64" ]; then | |
| echo "error: KEYSTORE_BASE64 secret is empty." >&2 | |
| exit 1 | |
| fi | |
| KEYSTORE_OUT="${{ runner.temp }}/release.keystore" | |
| printf '%s' "$KEYSTORE_BASE64" | base64 -d > "$KEYSTORE_OUT" | |
| if [ ! -s "$KEYSTORE_OUT" ]; then | |
| echo "error: decoded keystore is empty; check KEYSTORE_BASE64 encoding." >&2 | |
| exit 1 | |
| fi | |
| if ! KEYSTORE_PASSWORD="${{ secrets.KEYSTORE_PASSWORD }}" \ | |
| keytool -list -keystore "$KEYSTORE_OUT" -storepass:env KEYSTORE_PASSWORD >/dev/null; then | |
| echo "error: keystore failed to load (corrupt base64 or wrong password)." >&2 | |
| exit 1 | |
| fi | |
| - name: Verify no proprietary dependencies | |
| run: ./gradlew :app:verifyNoProprietaryDeps --no-daemon | |
| - name: Build APK | |
| run: ./gradlew assembleRelease --no-daemon | |
| env: | |
| KEYSTORE_FILE: ${{ runner.temp }}/release.keystore | |
| KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }} | |
| KEY_ALIAS: ${{ secrets.KEY_ALIAS }} | |
| KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }} | |
| SOURCE_DATE_EPOCH: ${{ env.SOURCE_DATE_EPOCH }} | |
| - name: Verify APK is signed | |
| run: | | |
| "$ANDROID_HOME/build-tools/${{ env.BUILD_TOOLS_VERSION }}/apksigner" verify --print-certs app/build/outputs/apk/release/app-release.apk | |
| - name: Rename APK | |
| run: mv app/build/outputs/apk/release/app-release.apk "keep-android-${{ github.ref_name }}.apk" | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: apk | |
| path: keep-android-${{ github.ref_name }}.apk | |
| release: | |
| needs: [build] | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: artifacts | |
| merge-multiple: true | |
| - name: Generate checksums | |
| run: | | |
| cd artifacts | |
| sha256sum * > SHA256SUMS | |
| - name: Create release | |
| uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v2 | |
| with: | |
| files: artifacts/* | |
| generate_release_notes: true |