mirror of
https://github.com/tiennm99/loto.git
synced 2026-09-01 22:21:28 +00:00
tiennm99
1c1bab8733
Replace pnpm-lock.yaml with package-lock.json and drop pnpm-workspace.yaml. The three security overrides move to package.json#overrides, which npm reads natively; allowBuilds for esbuild is unnecessary because npm runs dependency build scripts by default. android/build:web drove the web build through corepack pnpm, so it would have broken once web/pnpm-lock.yaml was gone. It now uses npm --prefix. Fresh resolution picks up patched versions the old lockfile had pinned below, so npm audit reports no advisories where pnpm audit reported eight.
94 lines
3.2 KiB
YAML
94 lines
3.2 KiB
YAML
# Tag-driven release. Builds standalone rather than consuming ci.yml
|
|
# artifacts: a tag run has no upstream run to pull from, and a release
|
|
# should be reproducible from the tagged tree alone.
|
|
|
|
name: android / release
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*.*.*']
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
concurrency:
|
|
group: android-release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: ./.github/actions/setup-web
|
|
|
|
# ci.yml does not run on tags, so this is the only gate before signing.
|
|
- name: Test web
|
|
run: npm test
|
|
working-directory: web
|
|
|
|
# Base "" — the APK loads the bundle from the domain root.
|
|
- name: Build web
|
|
run: npm run build
|
|
working-directory: web
|
|
|
|
- uses: ./.github/actions/setup-android
|
|
|
|
- name: Sync web bundle into the native project
|
|
run: npm run sync
|
|
working-directory: android
|
|
|
|
- name: Decode keystore
|
|
env:
|
|
KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
|
|
run: printf '%s' "$KEYSTORE_BASE64" | base64 --decode > "$GITHUB_WORKSPACE/keystore.p12"
|
|
|
|
- name: Build signed AAB + APK
|
|
working-directory: android/android
|
|
env:
|
|
LOTO_KEYSTORE_PATH: ${{ github.workspace }}/keystore.p12
|
|
LOTO_KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
|
|
LOTO_KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
|
|
LOTO_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
|
|
run: ./gradlew :app:bundleRelease :app:assembleRelease
|
|
|
|
- name: Upload to GitHub Release
|
|
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
|
|
with:
|
|
files: |
|
|
android/android/app/build/outputs/apk/release/*.apk
|
|
android/android/app/build/outputs/bundle/release/*.aab
|
|
|
|
# Auto-publish to Google Play (gated on the service-account secret).
|
|
# Skips silently if PLAY_SERVICE_ACCOUNT_JSON is not configured, so
|
|
# tagging a release before Play setup still produces a GH Release.
|
|
# Default track is "internal" — change to alpha/beta/production
|
|
# once you trust the pipeline.
|
|
- name: Check Play Store config
|
|
id: play
|
|
env:
|
|
PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
|
|
run: |
|
|
if [ -n "$PLAY_SERVICE_ACCOUNT_JSON" ]; then
|
|
echo "configured=true" >> "$GITHUB_OUTPUT"
|
|
else
|
|
echo "configured=false" >> "$GITHUB_OUTPUT"
|
|
echo "::notice::PLAY_SERVICE_ACCOUNT_JSON not set; skipping Play Store upload."
|
|
fi
|
|
|
|
- name: Upload to Google Play (internal track)
|
|
if: steps.play.outputs.configured == 'true'
|
|
uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
|
|
with:
|
|
serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
|
|
packageName: com.miti99.loto
|
|
releaseFiles: android/android/app/build/outputs/bundle/release/*.aab
|
|
tracks: internal
|
|
status: completed
|
|
# Bumps versionCode automatically? No — must be incremented
|
|
# manually in android/android/app/build.gradle before tagging.
|