Skip to content
Open
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
135 changes: 135 additions & 0 deletions .github/workflows/android-build.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,135 @@
name: Android Build & Deploy

on:
pull_request:
branches: [universe]
paths:
- 'mobile/android/**'
- 'mobile/fastlane/**'
- 'mobile/Gemfile'
- 'mobile/package.json'
- 'mobile/package-lock.json'
- '.github/workflows/android-build.yml'
push:
branches: [universe]
paths:
- 'mobile/android/**'
- 'mobile/fastlane/**'
- 'mobile/Gemfile'
- 'mobile/package.json'
- 'mobile/package-lock.json'
- '.github/workflows/android-build.yml'
workflow_dispatch:

jobs:
test:
name: Android unit tests
runs-on: ubuntu-latest
defaults:
run:
working-directory: mobile

steps:
- uses: actions/checkout@v4

- uses: actions/setup-node@v4
with:
node-version: '20'

- run: npm ci

- run: npx cap sync android

- uses: actions/setup-java@v4
with:
distribution: temurin
java-version: '17'

- uses: ruby/setup-ruby@v1
with:
ruby-version: '3.2'
bundler-cache: true
working-directory: mobile

- run: bundle exec fastlane android test

build_release:
name: Build signed Android bundle
runs-on: ubuntu-latest
needs: test
if: github.event_name != 'pull_request'
defaults:
run:
working-directory: mobile

steps:
- uses: actions/checkout@v4

- uses: actions/setup-node@v4
with:
node-version: '20'

- run: npm ci

- run: npx cap sync android

- uses: actions/setup-java@v4
with:
distribution: temurin
java-version: '17'

- uses: ruby/setup-ruby@v1
with:
ruby-version: '3.2'
bundler-cache: true
working-directory: mobile

- name: Materialize signing secrets
env:
ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
GOOGLE_PLAY_JSON_KEY: ${{ secrets.GOOGLE_PLAY_JSON_KEY }}
run: |
if [ -z "$ANDROID_KEYSTORE_BASE64" ] || [ -z "$GOOGLE_PLAY_JSON_KEY" ]; then
echo "Missing Android release secrets; skipping signed bundle build."
exit 0
fi
printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 --decode > android/release.keystore
printf '%s' "$GOOGLE_PLAY_JSON_KEY" > fastlane/google-play-key.json

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Decouple build secrets from deployment secrets.

The "Materialize signing secrets" step requires both ANDROID_KEYSTORE_BASE64 and GOOGLE_PLAY_JSON_KEY, but the build step (lines 99-112) only needs the keystore and signing credentials, not the Play key. On push to universe (not PR, not workflow_dispatch), the workflow builds a signed AAB but doesn't deploy, so the Play key is unnecessary. This prevents build-only workflow runs when the Play key is unavailable.

Split the secret materialization: create the keystore unconditionally when ANDROID_KEYSTORE_BASE64 is present, and only materialize the Play key when deploying (on workflow_dispatch).

♻️ Proposed fix to separate build and deploy secrets
-      - name: Materialize signing secrets
+      - name: Materialize keystore
         env:
           ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
-          GOOGLE_PLAY_JSON_KEY: ${{ secrets.GOOGLE_PLAY_JSON_KEY }}
         run: |
-          if [ -z "$ANDROID_KEYSTORE_BASE64" ] || [ -z "$GOOGLE_PLAY_JSON_KEY" ]; then
-            echo "Missing Android release secrets; skipping signed bundle build."
+          if [ -z "$ANDROID_KEYSTORE_BASE64" ]; then
+            echo "Missing keystore; skipping signed bundle build."
             exit 0
           fi
           printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 --decode > android/release.keystore
+
+      - name: Materialize Play Store key
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GOOGLE_PLAY_JSON_KEY: ${{ secrets.GOOGLE_PLAY_JSON_KEY }}
+        run: |
+          if [ -z "$GOOGLE_PLAY_JSON_KEY" ]; then
+            echo "Missing Play Store key; skipping deploy."
+            exit 0
+          fi
           printf '%s' "$GOOGLE_PLAY_JSON_KEY" > fastlane/google-play-key.json
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/android-build.yml around lines 87 - 97, The current
"Materialize signing secrets" step requires both ANDROID_KEYSTORE_BASE64 and
GOOGLE_PLAY_JSON_KEY but the signed build path only needs the keystore; update
the step so it only creates android/release.keystore when
ANDROID_KEYSTORE_BASE64 is set (do not fail or require GOOGLE_PLAY_JSON_KEY),
and move or add a separate step that materializes fastlane/google-play-key.json
only for deployment runs (e.g., gated to workflow_dispatch or the deploy job) by
checking GOOGLE_PLAY_JSON_KEY before creating the file; refer to the step name
"Materialize signing secrets" and the env vars ANDROID_KEYSTORE_BASE64 and
GOOGLE_PLAY_JSON_KEY when locating and changing the workflow.


- name: Build signed AAB
env:
ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
KEYSTORE_PATH: android/release.keystore
SUPPLY_JSON_KEY_DATA: ${{ secrets.GOOGLE_PLAY_JSON_KEY }}
run: |
if [ -z "$ANDROID_KEYSTORE_BASE64" ] || [ -z "$STORE_PASSWORD" ] || [ -z "$KEY_ALIAS" ] || [ -z "$KEY_PASSWORD" ]; then
echo "Missing Android signing secrets; skipping signed bundle build."
exit 0
fi
bundle exec fastlane android build

- name: Upload AAB artifact
if: hashFiles('mobile/android/app/build/outputs/bundle/release/*.aab') != ''
uses: actions/upload-artifact@v4
with:
name: bawes-universe-android-aab
path: mobile/android/app/build/outputs/bundle/release/*.aab

- name: Deploy to Play internal track
if: github.event_name == 'workflow_dispatch'
env:
ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
KEYSTORE_PATH: android/release.keystore
SUPPLY_JSON_KEY_DATA: ${{ secrets.GOOGLE_PLAY_JSON_KEY }}
run: |
if [ -z "$ANDROID_KEYSTORE_BASE64" ] || [ -z "$STORE_PASSWORD" ] || [ -z "$KEY_ALIAS" ] || [ -z "$KEY_PASSWORD" ] || [ -z "$SUPPLY_JSON_KEY_DATA" ]; then
echo "Missing Play Store deployment secrets; skipping deploy."
exit 0
fi
bundle exec fastlane android deploy
101 changes: 101 additions & 0 deletions mobile/android/.gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,101 @@
# Using Android gitignore template: https://github.com/github/gitignore/blob/HEAD/Android.gitignore

# Built application files
*.apk
*.aar
*.ap_
*.aab

# Files for the ART/Dalvik VM
*.dex

# Java class files
*.class

# Generated files
bin/
gen/
out/
# Uncomment the following line in case you need and you don't have the release build type files in your app
# release/

# Gradle files
.gradle/
build/

# Local configuration file (sdk path, etc)
local.properties

# Proguard folder generated by Eclipse
proguard/

# Log Files
*.log

# Android Studio Navigation editor temp files
.navigation/

# Android Studio captures folder
captures/

# IntelliJ
*.iml
.idea/workspace.xml
.idea/tasks.xml
.idea/gradle.xml
.idea/assetWizardSettings.xml
.idea/dictionaries
.idea/libraries
# Android Studio 3 in .gitignore file.
.idea/caches
.idea/modules.xml
# Comment next line if keeping position of elements in Navigation Editor is relevant for you
.idea/navEditor.xml

# Keystore files
# Uncomment the following lines if you do not want to check your keystore files in.
#*.jks
#*.keystore
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated

# External native build folder generated in Android Studio 2.2 and later
.externalNativeBuild
.cxx/

# Google Services (e.g. APIs or Firebase)
# google-services.json
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated

# Freeline
freeline.py
freeline/
freeline_project_description.json

# fastlane
fastlane/report.xml
fastlane/Preview.html
fastlane/screenshots
fastlane/test_output
fastlane/readme.md

# Version control
vcs.xml

# lint
lint/intermediates/
lint/generated/
lint/outputs/
lint/tmp/
# lint/reports/

# Android Profiling
*.hprof

# Cordova plugins for Capacitor
capacitor-cordova-android-plugins

# Copied web assets
app/src/main/assets/public

# Generated Config files
app/src/main/assets/capacitor.config.json
app/src/main/assets/capacitor.plugins.json
app/src/main/res/xml/config.xml
2 changes: 2 additions & 0 deletions mobile/android/app/.gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
/build/*
!/build/.npmkeep
54 changes: 54 additions & 0 deletions mobile/android/app/build.gradle
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
apply plugin: 'com.android.application'

android {
namespace = "net.bawes.universe"
compileSdk = rootProject.ext.compileSdkVersion
defaultConfig {
applicationId "net.bawes.universe"
minSdkVersion rootProject.ext.minSdkVersion
targetSdkVersion rootProject.ext.targetSdkVersion
versionCode 1
versionName "1.0"
testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
aaptOptions {
// Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.
// Default: https://android.googlesource.com/platform/frameworks/base/+/282e181b58cf72b6ca770dc7ca5f91f135444502/tools/aapt/AaptAssets.cpp#61
ignoreAssetsPattern = '!.svn:!.git:!.ds_store:!*.scc:.*:!CVS:!thumbs.db:!picasa.ini:!*~'
}
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
}
buildTypes {
release {
minifyEnabled false
proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
}
}
}

repositories {
flatDir{
dirs '../capacitor-cordova-android-plugins/src/main/libs', 'libs'
}
}

dependencies {
implementation fileTree(include: ['*.jar'], dir: 'libs')
implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
implementation "androidx.coordinatorlayout:coordinatorlayout:$androidxCoordinatorLayoutVersion"
implementation "androidx.core:core-splashscreen:$coreSplashScreenVersion"
implementation project(':capacitor-android')
testImplementation "junit:junit:$junitVersion"
androidTestImplementation "androidx.test.ext:junit:$androidxJunitVersion"
androidTestImplementation "androidx.test.espresso:espresso-core:$androidxEspressoCoreVersion"
implementation project(':capacitor-cordova-android-plugins')
}

apply from: 'capacitor.build.gradle'

try {
def servicesJSON = file('google-services.json')
if (servicesJSON.text) {
apply plugin: 'com.google.gms.google-services'
}
} catch(Exception e) {
logger.info("google-services.json not found, google-services plugin not applied. Push Notifications won't work")
}
20 changes: 20 additions & 0 deletions mobile/android/app/capacitor.build.gradle
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
// DO NOT EDIT THIS FILE! IT IS GENERATED EACH TIME "capacitor update" IS RUN

android {
compileOptions {
sourceCompatibility JavaVersion.VERSION_21
targetCompatibility JavaVersion.VERSION_21
}
}

apply from: "../capacitor-cordova-android-plugins/cordova.variables.gradle"
dependencies {
implementation project(':capacitor-push-notifications')
implementation project(':capacitor-splash-screen')

}


if (hasProperty('postBuildExtras')) {
postBuildExtras()
}
21 changes: 21 additions & 0 deletions mobile/android/app/proguard-rules.pro
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
# Add project specific ProGuard rules here.
# You can control the set of applied configuration files using the
# proguardFiles setting in build.gradle.
#
# For more details, see
# http://developer.android.com/guide/developing/tools/proguard.html

# If your project uses WebView with JS, uncomment the following
# and specify the fully qualified class name to the JavaScript interface
# class:
#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
# public *;
#}

# Uncomment this to preserve the line number information for
# debugging stack traces.
#-keepattributes SourceFile,LineNumberTable

# If you keep the line number information, uncomment this to
# hide the original source file name.
#-renamesourcefileattribute SourceFile
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
package net.bawes.universe;

import static org.junit.Assert.*;

import android.content.Context;
import androidx.test.ext.junit.runners.AndroidJUnit4;
import androidx.test.platform.app.InstrumentationRegistry;
import org.junit.Test;
import org.junit.runner.RunWith;

/**
* Instrumented test, which will execute on an Android device.
*
* @see <a href="http://d.android.com/tools/testing">Testing documentation</a>
*/
@RunWith(AndroidJUnit4.class)
public class ExampleInstrumentedTest {

@Test
public void useAppContext() throws Exception {
// Context of the app under test.
Context appContext = InstrumentationRegistry.getInstrumentation().getTargetContext();

assertEquals("net.bawes.universe", appContext.getPackageName());
}
}
Loading