copenhagentruckwash/pleno-vue
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Gate mobile releases behind explicit phased rollout (#212)

Browse Source 
Require explicit mobile-v* tags or manual dispatch, gate exact tested master SHAs, and default Google Play production submissions to an initial 1% in-progress rollout.
This commit is contained in:
Jeppe B
2026-07-22 18:51:40 +02:00
committed by GitHub
parent fd26b0ee81
commit 7782d93fe9
4 changed files with 64 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/mobile-artifacts.yml
+40 -23
View File
@@ -30,54 +30,42 @@ on:
description: Google Play release status for manual dispatches
required: false
type: choice
default: completed
default: inProgress
options:
- completed
- draft
- inProgress
- draft
- halted
push:
tags:
- "mobile-v*"
workflow_run:
workflows:
- Automated Tests
types:
- completed
branches:
- master
permissions:
contents: read
actions: read
concurrency:
group: android-store-artifacts-${{ github.event.workflow_run.head_branch || github.ref_name || github.run_id }}
group: android-store-artifacts-${{ github.ref_name || github.run_id }}
cancel-in-progress: true
jobs:
android:
name: Android AAB and Play upload
if: >
github.event_name != 'workflow_run' ||
(github.event.workflow_run.conclusion == 'success' &&
github.event.workflow_run.event == 'push' &&
github.event.workflow_run.head_branch == github.event.repository.default_branch)
runs-on: ubuntu-24.04
environment: mobile-store-production
timeout-minutes: 60
env:
ANDROID_PACKAGE_NAME: ${{ vars.ANDROID_PACKAGE_NAME || 'io.truckwash.twa' }}
ANDROID_AAB_PATH: ${{ vars.ANDROID_AAB_PATH || 'android/app/build/outputs/bundle/release/app-release.aab' }}
ANDROID_SIGNING_IDENTITY_REF: github-environment:mobile-store-production/android-keystore
PLAY_STORE_TRACK: ${{ inputs.android_track || vars.PLAY_STORE_TRACK || 'production' }}
PLAY_STORE_RELEASE_STATUS: ${{ inputs.android_release_status || vars.PLAY_STORE_RELEASE_STATUS || 'completed' }}
PLAY_STORE_USER_FRACTION: ${{ vars.PLAY_STORE_USER_FRACTION || '' }}
PLAY_STORE_RELEASE_STATUS: ${{ inputs.android_release_status || 'inProgress' }}
PLAY_STORE_USER_FRACTION: "0.01"
UPLOAD_ANDROID_TO_PLAY: ${{ github.event_name != 'workflow_dispatch' || inputs.upload_android_to_play }}
steps:
- name: Checkout repository
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
with:
ref: ${{ github.event.workflow_run.head_sha || github.sha }}
ref: ${{ github.sha }}
persist-credentials: false
- name: Guard current master release
@@ -85,8 +73,8 @@ jobs:
shell: bash
env:
EVENT_NAME: ${{ github.event_name }}
EXPECTED_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
RELEASE_BRANCH: ${{ github.event.workflow_run.head_branch || github.ref_name }}
EXPECTED_SHA: ${{ github.sha }}
RELEASE_BRANCH: ${{ github.ref_name }}
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
UPLOAD_TO_PLAY: ${{ github.event_name != 'workflow_dispatch' || inputs.upload_android_to_play }}
GH_TOKEN: ${{ github.token }}
@@ -125,7 +113,7 @@ jobs:
env:
GH_TOKEN: ${{ github.token }}
STORE_SOURCE_SHA: ${{ steps.release-guard.outputs.source_sha }}
TEST_WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id || '' }}
TEST_WORKFLOW_RUN_ID: ""
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
- name: Setup Java
@@ -213,11 +201,23 @@ jobs:
if: steps.release-guard.outputs.current == 'true'
run: jarsigner -verify -certs -verbose "$ANDROID_AAB_PATH" >/dev/null
- name: Record immutable Android artifact proof
if: steps.release-guard.outputs.current == 'true'
id: artifact-proof
shell: bash
run: |
set -euo pipefail
artifact_sha256="$(sha256sum "$ANDROID_AAB_PATH" | awk '{print $1}')"
[[ "$artifact_sha256" =~ ^[0-9a-f]{64}$ ]]
echo "ANDROID_AAB_SHA256=$artifact_sha256" >> "$GITHUB_ENV"
echo "sha256=$artifact_sha256" >> "$GITHUB_OUTPUT"
echo "Android AAB SHA-256: \`$artifact_sha256\`" >> "$GITHUB_STEP_SUMMARY"
- name: Upload Android artifact
if: steps.release-guard.outputs.current == 'true'
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: truck-wash-android-${{ env.MOBILE_VERSION_NAME }}-${{ github.event.workflow_run.head_sha || github.sha }}
name: truck-wash-android-${{ env.MOBILE_VERSION_NAME }}-${{ github.sha }}
path: ${{ env.ANDROID_AAB_PATH }}
if-no-files-found: error
retention-days: 14
@@ -242,6 +242,23 @@ jobs:
- name: Upload Android App Bundle to Google Play
if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_ANDROID_TO_PLAY == 'true'
id: play-upload
env:
GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_BASE64 }}
run: npm run mobile:android:play-upload
- name: Record Google Play submission proof
if: steps.release-guard.outputs.current == 'true' && env.UPLOAD_ANDROID_TO_PLAY == 'true'
env:
ARTIFACT_SHA256: ${{ steps.artifact-proof.outputs.sha256 }}
PLAY_EDIT_ID: ${{ steps.play-upload.outputs.play_edit_id }}
PLAY_VERSION_CODE: ${{ steps.play-upload.outputs.version_code }}
run: |
set -euo pipefail
test -n "$ARTIFACT_SHA256"
test -n "$PLAY_EDIT_ID"
test -n "$PLAY_VERSION_CODE"
printf 'Google Play submission proof: platform=android applicationId=%s version=%s buildNumber=%s artifactSha256=%s signingIdentityRef=%s storeSubmissionId=%s status=%s fraction=%s\n' \
"$ANDROID_PACKAGE_NAME" "$MOBILE_VERSION_NAME" "$PLAY_VERSION_CODE" \
"$ARTIFACT_SHA256" "$ANDROID_SIGNING_IDENTITY_REF" "$PLAY_EDIT_ID" \
"$PLAY_STORE_RELEASE_STATUS" "$PLAY_STORE_USER_FRACTION" >> "$GITHUB_STEP_SUMMARY"
scripts/mobile/check-store-upload-env.mjs
+1 -1
View File
@@ -82,7 +82,7 @@ const checkAndroid = () => {
const validTracks = new Set(["production", "beta", "alpha", "internal"]);
const validStatuses = new Set(["completed", "draft", "inProgress", "halted"]);
const track = env.PLAY_STORE_TRACK || "production";
const status = env.PLAY_STORE_RELEASE_STATUS || "completed";
const status = env.PLAY_STORE_RELEASE_STATUS || "inProgress";
if (!validTracks.has(track)) {
failures.push(`PLAY_STORE_TRACK must be one of ${Array.from(validTracks).join(", ")}`);
scripts/mobile/upload-google-play.mjs
+13 -3
View File
@@ -162,7 +162,7 @@ const uploadBundle = async (accessToken, packageName, editId, bundlePath) =>
const updateTrack = async (accessToken, packageName, editId, versionCode) => {
const track = env.PLAY_STORE_TRACK || "production";
const status = env.PLAY_STORE_RELEASE_STATUS || "completed";
const status = env.PLAY_STORE_RELEASE_STATUS || "inProgress";
const validTracks = new Set(["production", "beta", "alpha", "internal"]);
const validStatuses = new Set(["completed", "draft", "inProgress", "halted"]);
@@ -222,6 +222,12 @@ const writeStepSummary = (summary) => {
appendFileSync(env.GITHUB_STEP_SUMMARY, `${summary}\n`);
};
const writeOutput = (name, value) => {
if (env.GITHUB_OUTPUT) {
appendFileSync(env.GITHUB_OUTPUT, `${name}=${value}\n`);
}
};
const main = async () => {
requireEnvironment();
@@ -243,9 +249,13 @@ const main = async () => {
await commitEdit(accessToken, packageName, editId);
const track = env.PLAY_STORE_TRACK || "production";
const status = env.PLAY_STORE_RELEASE_STATUS || "completed";
const status = env.PLAY_STORE_RELEASE_STATUS || "inProgress";
writeOutput("play_edit_id", editId);
writeOutput("version_code", versionCode);
console.log(`Uploaded Android App Bundle ${versionCode} to Google Play ${track} with status ${status}.`);
writeStepSummary(`Android App Bundle ${versionCode} uploaded to Google Play ${track} with status ${status}.`);
writeStepSummary(
`Android App Bundle ${versionCode} uploaded to Google Play ${track} with status ${status}; edit ${editId}; artifact SHA-256 ${env.ANDROID_AAB_SHA256 || "missing"}.`,
);
} catch (error) {
if (editId) {
await deleteEdit(accessToken, packageName, editId);
tests/unit/mobile-store-test-gate.spec.js
+10
View File
@@ -199,12 +199,22 @@ describe("mobile store test gates", () => {
it("resolves current master before any manual or tag Play upload", () => {
const source = readFileSync(join(process.cwd(), ".github/workflows/mobile-artifacts.yml"), "utf8");
expect(source).toContain('tags:\n - "mobile-v*"');
expect(source).not.toContain("workflow_run:");
expect(source).not.toContain("github.event.workflow_run");
expect(source).toContain("UPLOAD_TO_PLAY:");
expect(source).toContain("PLAY_STORE_RELEASE_STATUS: ${{ inputs.android_release_status || 'inProgress' }}");
expect(source).toContain('PLAY_STORE_USER_FRACTION: "0.01"');
expect(source).not.toContain("- completed");
expect(source).toContain("git/ref/heads/$DEFAULT_BRANCH");
expect(source).toContain('[[ "$latest_sha" != "$EXPECTED_SHA" && "$UPLOAD_TO_PLAY" == "true" ]]');
expect(source).toContain('echo "source_sha=$latest_sha" >> "$GITHUB_OUTPUT"');
expect(source).toContain("STORE_SOURCE_SHA: ${{ steps.release-guard.outputs.source_sha }}");
expect(source).toContain("Recheck live master before Play upload");
expect(source).toContain("Record immutable Android artifact proof");
expect(source).toContain("Record Google Play submission proof");
expect(source).toContain("platform=android applicationId=%s version=%s buildNumber=%s");
expect(source).toContain("signingIdentityRef=%s storeSubmissionId=%s");
expect(source).toContain('[[ "$live_master_sha" == "$EXPECTED_SHA" ]]');
expect(source.indexOf("Recheck live master before Play upload")).toBeLessThan(
source.indexOf("Upload Android App Bundle to Google Play")