fix(android): pass app_root and the release tag to scripts through env by tehw0lf · Pull Request #180 · tehw0lf/workflows

tehw0lf · 2026-10-05T20:46:14Z

Problem

release-android-apk.yml interpolated inputs.app_root directly into the run: scripts of build apk, sign apk and align apk, and env.RELEASE_TAG into the script of check if release already exists. An expression is expanded before the shell sees the script, so the value becomes part of the script text (#179).

Change

The four steps receive the values through env: (APP_ROOT, and the existing RELEASE_TAG environment variable) and use them as quoted shell variables. No run: script in this workflow contains an expression any more. Paths and behaviour are unchanged for a normal app_root.

Closes #179

Verification

actionlint .github/workflows/*.yml passes.

Not covered

The job only runs on a push to the default branch of a calling repository, so the changed steps were not executed.
Other workflows in this repository also interpolate inputs into run: scripts; this PR only changes the Android workflow.

Summary by CodeRabbit

Chores
- Updated Android APK release processing to handle application paths consistently during building, signing, and alignment. Release checks now use the configured release tag from the shell environment when determining whether a release already exists. These changes affect release packaging and do not change app features or behavior.

The build, sign and align steps interpolated inputs.app_root straight into their scripts, and the release check did the same with env.RELEASE_TAG. Both values now reach the scripts as environment variables and are quoted there, so their content is never parsed as shell code. Closes #179

coderabbitai · 2026-10-05T20:46:30Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used

📚 Code guidelines (1)

CLAUDE.md — auto-discovered

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Essentials
Run ID: e2cb3207-3b53-4dea-b5b5-af8fae2677ac

📥 Commits

Reviewing files that changed from the base of the PR and between 72542b6 and 747b9fe.

📒 Files selected for processing (1)

.github/workflows/release-android-apk.yml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

📝 Walkthrough

Walkthrough

The Android APK release workflow now passes app_root through APP_ROOT for build, signing, and alignment commands. The release-existence check reads RELEASE_TAG from the shell environment.

Changes

Android APK release workflow

Layer / File(s)	Summary
Use environment variables in workflow scripts `.github/workflows/release-android-apk.yml`	Build, signing, and alignment commands use quoted paths based on `APP_ROOT`. The release-existence check reads `RELEASE_TAG` from the shell environment.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 747b9

No actionable merge-blocking risk is established in the workflow changes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main workflow changes: passing `app_root` and the release tag to scripts through environment variables.
Linked Issues check	✅ Passed	Issue `#179` requires `app_root` through `env:` in the build, sign, and align steps. The workflow sets `APP_ROOT` in all three steps and quotes its uses in their shell scripts. The PR reports that `acti…
Out of Scope Changes check	✅ Passed	The release-existence check also reads `RELEASE_TAG` as a shell environment variable instead of interpolating it into the script. This change applies the same safe-input handling in the same workflow.…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

✨ Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

tehw0lf · 2026-10-05T20:53:27Z

Independent local review

Reviewed head: 747b9fe9219edff3f44d3959bde8c5b356013ed0

Verdict: safe to merge. No blocking findings and nothing to fix in this PR.

What was checked

Scope. One commit, one file (.github/workflows/release-android-apk.yml, +13/-8). The diff matches the description. One detail the description does not spell out: ${ANDROID_SDK_ROOT} in the align apk step is now quoted as well; this does not change the command for a normal SDK path.
Equivalence. For app_root: apps/numveil the old and new scripts produce the same argument lists: cd target, -keystore path, the unsigned APK followed by the alias my-key for jarsigner, and -v 4 <unsigned> <aligned> for zipalign. Line continuations and argument order are unchanged. A trailing slash and an empty value behave as before. A value containing spaces used to be split into several words and is now passed as one path.
Variables. APP_ROOT is set in env: of each of the three steps that use it (build apk, sign apk, align apk). RELEASE_TAG is written to $GITHUB_ENV by extract version from package.json, the step immediately before check if release already exists; both steps have the same if: condition, and no workflow-, job- or step-level env: redefines the name.
"No run: script contains an expression any more". True: all seven run: blocks of the file were extracted from the parsed YAML and none contains ${{. The remaining inputs.* / env.* expressions in the file are in runs-on:, if:, with: and env:, none of which is script text.
Injection path. Removed for the four steps: the values now reach the shell as environment variables and are only expanded inside double quotes.
Lint. actionlint over all workflow files at this head reports nothing. shellcheck was not available for this review, so the scripts were not checked with it here.
Orchestrator gate. build-test-publish.yml calls this workflow only when inputs.app_root != ''.
Interaction with feat(android): let callers choose the JDK of the APK release job #178. The diff of feat(android): let callers choose the JDK of the APK release job #178 applies cleanly on top of this head; the hunks of the two PRs in release-android-apk.yml do not overlap (input block and set up jdk there, build apk and later steps here), so either merge order works.
Existing review and checks. The automated review left no actionable comments and there are no inline review comments. The required checks have passed on this head.
Closing release-android-apk.yml interpolates app_root directly into run scripts #179. Justified: release-android-apk.yml interpolates app_root directly into run scripts #179 asks for app_root to be passed through env: in build apk, sign apk and align apk, and this PR does exactly that (plus the release tag).

Blocking

none

Fix in PR

none

Follow-up

RELEASE_TAG is written to $GITHUB_ENV without validation (extract version from package.json, a line this PR does not change): echo "RELEASE_TAG=v${VERSION}" >> $GITHUB_ENV, with VERSION taken from jq -r .version package.json. A version value containing a newline would add further lines, and therefore further environment variables, for all later steps of the job. The value comes from the caller's own package.json on a push, so the risk is on the same low level as the one release-android-apk.yml interpolates app_root directly into run scripts #179 describes. Rejecting versions that are not a single line of expected characters would close it. No issue. Tracked in release-android-apk.yml writes an unvalidated version to GITHUB_ENV #181.
Other workflows still expand expressions inside run: scripts, as the description says. At this head: 116 expressions in 39 run: steps across 14 other workflow files, 83 of them inputs.* (most in test-and-build.yml, publish-docker-image.yml, summarize-workflow.yml, set-git-tag.yml, release-github.yml). Some of these inputs are commands by design (for example install, lint, test, docker_pre, release_pre), others are plain values such as artifact_path, tool, registry or trivy_severity. release-android-apk.yml interpolates app_root directly into run scripts #179 only covers release-android-apk.yml. No issue. Tracked in Expressions are interpolated into run scripts across the workflows #182.

Not covered

The changed steps were not executed: the job only runs in a calling repository on a push with app_root set. Equivalence was established by reading the scripts and comparing the resulting argument lists, not by building, signing and aligning an APK.
Whether softprops/action-gh-release and actions/download-artifact handle unusual app_root values (they still receive the input through with:) was not examined.
release-android-apk.yml interpolates app_root directly into run scripts #179 refers to an input-handling convention documented in CLAUDE.md; no such rule about env: versus run: was found in that file at this head, so the change was judged on its own merits, not against that convention.

This was referenced Oct 5, 2026

release-android-apk.yml writes an unvalidated version to GITHUB_ENV #181

Open

Expressions are interpolated into run scripts across the workflows #182

Open

tehw0lf merged commit aa27646 into main Oct 5, 2026
3 checks passed

tehw0lf deleted the fix/179-android-app-root-env branch October 5, 2026 20:53

Navigation Menu

Repository navigation

fix(android): pass app_root and the release tag to scripts through env - #180

fix(android): pass app_root and the release tag to scripts through env#180
tehw0lf merged 1 commit into
mainfrom
fix/179-android-app-root-env

tehw0lf commented Oct 5, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 5, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

tehw0lf commented Oct 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

tehw0lf commented Oct 5, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Change

Verification

Not covered

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

tehw0lf commented Oct 5, 2026

Independent local review

What was checked

Blocking

Fix in PR

Follow-up

Not covered

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

tehw0lf commented Oct 5, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 5, 2026 •

edited

Loading