273 lines
10 KiB
YAML
273 lines
10 KiB
YAML
name: Mobile Store Artifacts
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
version_name:
|
|
description: Store version name, for example 1.4.0
|
|
required: false
|
|
type: string
|
|
version_code:
|
|
description: Store build number/version code
|
|
required: false
|
|
type: string
|
|
push:
|
|
tags:
|
|
- "mobile-v*"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: mobile-store-artifacts-${{ github.ref_name }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
android:
|
|
name: Android AAB
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v5
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v5
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
|
|
- name: Setup Java
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
distribution: temurin
|
|
java-version: 21
|
|
|
|
- name: Install Android SDK packages
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
yes | sdkmanager --licenses >/dev/null || true
|
|
sdkmanager "platforms;android-36" "build-tools;36.0.0"
|
|
|
|
- name: Resolve mobile version
|
|
shell: bash
|
|
env:
|
|
INPUT_VERSION_NAME: ${{ inputs.version_name }}
|
|
INPUT_VERSION_CODE: ${{ inputs.version_code }}
|
|
run: |
|
|
set -euo pipefail
|
|
version_name="$INPUT_VERSION_NAME"
|
|
if [[ -z "$version_name" && "$GITHUB_REF_NAME" == mobile-v* ]]; then
|
|
version_name="${GITHUB_REF_NAME#mobile-v}"
|
|
fi
|
|
if [[ -z "$version_name" ]]; then
|
|
version_name="0.0.${GITHUB_RUN_NUMBER}"
|
|
fi
|
|
version_code="${INPUT_VERSION_CODE:-$GITHUB_RUN_NUMBER}"
|
|
echo "MOBILE_VERSION_NAME=$version_name" >> "$GITHUB_ENV"
|
|
echo "MOBILE_VERSION_CODE=$version_code" >> "$GITHUB_ENV"
|
|
|
|
- name: Install dependencies
|
|
run: npm ci --legacy-peer-deps
|
|
|
|
- name: Decode Android signing key
|
|
shell: bash
|
|
env:
|
|
ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
|
|
ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
|
|
ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
|
|
ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "$ANDROID_KEYSTORE_BASE64"
|
|
test -n "$ANDROID_KEYSTORE_PASSWORD"
|
|
test -n "$ANDROID_KEY_ALIAS"
|
|
test -n "$ANDROID_KEY_PASSWORD"
|
|
keystore_path="$RUNNER_TEMP/android-release.keystore"
|
|
node -e "const fs = require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.ANDROID_KEYSTORE_BASE64, 'base64'))" "$keystore_path"
|
|
echo "ANDROID_KEYSTORE_FILE=$keystore_path" >> "$GITHUB_ENV"
|
|
echo "ANDROID_KEYSTORE_PASSWORD=$ANDROID_KEYSTORE_PASSWORD" >> "$GITHUB_ENV"
|
|
echo "ANDROID_KEY_ALIAS=$ANDROID_KEY_ALIAS" >> "$GITHUB_ENV"
|
|
echo "ANDROID_KEY_PASSWORD=$ANDROID_KEY_PASSWORD" >> "$GITHUB_ENV"
|
|
|
|
- name: Build and sync Android shell
|
|
run: |
|
|
npm run build
|
|
npx cap sync android
|
|
npm run mobile:permissions:check
|
|
|
|
- name: Build signed Android App Bundle
|
|
working-directory: android
|
|
run: ./gradlew --no-daemon bundleRelease
|
|
|
|
- name: Verify Android App Bundle signature
|
|
run: jarsigner -verify -certs -verbose android/app/build/outputs/bundle/release/app-release.aab >/dev/null
|
|
|
|
- name: Upload Android artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: truck-wash-android-${{ env.MOBILE_VERSION_NAME }}-${{ github.sha }}
|
|
path: android/app/build/outputs/bundle/release/app-release.aab
|
|
if-no-files-found: error
|
|
retention-days: 14
|
|
|
|
ios:
|
|
name: iOS IPA
|
|
runs-on: macos-latest
|
|
timeout-minutes: 60
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v5
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v5
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
|
|
- name: Resolve mobile version
|
|
shell: bash
|
|
env:
|
|
INPUT_VERSION_NAME: ${{ inputs.version_name }}
|
|
INPUT_VERSION_CODE: ${{ inputs.version_code }}
|
|
run: |
|
|
set -euo pipefail
|
|
version_name="$INPUT_VERSION_NAME"
|
|
if [[ -z "$version_name" && "$GITHUB_REF_NAME" == mobile-v* ]]; then
|
|
version_name="${GITHUB_REF_NAME#mobile-v}"
|
|
fi
|
|
if [[ -z "$version_name" ]]; then
|
|
version_name="0.0.${GITHUB_RUN_NUMBER}"
|
|
fi
|
|
version_code="${INPUT_VERSION_CODE:-$GITHUB_RUN_NUMBER}"
|
|
echo "MOBILE_VERSION_NAME=$version_name" >> "$GITHUB_ENV"
|
|
echo "MOBILE_VERSION_CODE=$version_code" >> "$GITHUB_ENV"
|
|
|
|
- name: Install dependencies
|
|
run: npm ci --legacy-peer-deps
|
|
|
|
- name: Build and sync iOS shell
|
|
run: |
|
|
npm run build
|
|
npx cap sync ios
|
|
npm run mobile:permissions:check
|
|
|
|
- name: Install Apple signing assets
|
|
shell: bash
|
|
env:
|
|
IOS_CERTIFICATE_BASE64: ${{ secrets.IOS_CERTIFICATE_BASE64 }}
|
|
IOS_CERTIFICATE_PASSWORD: ${{ secrets.IOS_CERTIFICATE_PASSWORD }}
|
|
IOS_PROVISION_PROFILE_BASE64: ${{ secrets.IOS_PROVISION_PROFILE_BASE64 }}
|
|
IOS_KEYCHAIN_PASSWORD: ${{ secrets.IOS_KEYCHAIN_PASSWORD }}
|
|
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "$IOS_CERTIFICATE_BASE64"
|
|
test -n "$IOS_CERTIFICATE_PASSWORD"
|
|
test -n "$IOS_PROVISION_PROFILE_BASE64"
|
|
test -n "$IOS_KEYCHAIN_PASSWORD"
|
|
test -n "$APPLE_TEAM_ID"
|
|
|
|
certificate_path="$RUNNER_TEMP/apple-distribution.p12"
|
|
profile_path="$RUNNER_TEMP/app-store.mobileprovision"
|
|
keychain_path="$RUNNER_TEMP/app-signing.keychain-db"
|
|
profile_plist="$RUNNER_TEMP/profile.plist"
|
|
|
|
node -e "const fs = require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_CERTIFICATE_BASE64, 'base64'))" "$certificate_path"
|
|
node -e "const fs = require('fs'); fs.writeFileSync(process.argv[1], Buffer.from(process.env.IOS_PROVISION_PROFILE_BASE64, 'base64'))" "$profile_path"
|
|
|
|
security create-keychain -p "$IOS_KEYCHAIN_PASSWORD" "$keychain_path"
|
|
security set-keychain-settings -lut 21600 "$keychain_path"
|
|
security unlock-keychain -p "$IOS_KEYCHAIN_PASSWORD" "$keychain_path"
|
|
security import "$certificate_path" -P "$IOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
|
|
security list-keychain -d user -s "$keychain_path" $(security list-keychains -d user | tr -d '"')
|
|
security set-key-partition-list -S apple-tool:,apple: -s -k "$IOS_KEYCHAIN_PASSWORD" "$keychain_path"
|
|
|
|
mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"
|
|
security cms -D -i "$profile_path" > "$profile_plist"
|
|
profile_uuid="$(/usr/libexec/PlistBuddy -c 'Print UUID' "$profile_plist")"
|
|
profile_name="$(/usr/libexec/PlistBuddy -c 'Print Name' "$profile_plist")"
|
|
cp "$profile_path" "$HOME/Library/MobileDevice/Provisioning Profiles/$profile_uuid.mobileprovision"
|
|
|
|
echo "APPLE_TEAM_ID=$APPLE_TEAM_ID" >> "$GITHUB_ENV"
|
|
echo "IOS_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
|
|
echo "IOS_PROFILE_UUID=$profile_uuid" >> "$GITHUB_ENV"
|
|
echo "IOS_PROFILE_NAME=$profile_name" >> "$GITHUB_ENV"
|
|
|
|
- name: Resolve Swift packages
|
|
run: xcodebuild -resolvePackageDependencies -project ios/App/App.xcodeproj -scheme App
|
|
|
|
- name: Archive iOS app
|
|
run: |
|
|
xcodebuild \
|
|
-project ios/App/App.xcodeproj \
|
|
-scheme App \
|
|
-configuration Release \
|
|
-destination "generic/platform=iOS" \
|
|
-archivePath "$RUNNER_TEMP/TruckWash.xcarchive" \
|
|
archive \
|
|
DEVELOPMENT_TEAM="$APPLE_TEAM_ID" \
|
|
CODE_SIGN_STYLE=Manual \
|
|
CODE_SIGN_IDENTITY="Apple Distribution" \
|
|
PROVISIONING_PROFILE_SPECIFIER="$IOS_PROFILE_NAME" \
|
|
MARKETING_VERSION="$MOBILE_VERSION_NAME" \
|
|
CURRENT_PROJECT_VERSION="$MOBILE_VERSION_CODE"
|
|
|
|
- name: Export iOS IPA
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
export_method="app-store-connect"
|
|
if ! xcodebuild -help 2>&1 | grep -q "app-store-connect"; then
|
|
export_method="app-store"
|
|
fi
|
|
export_options="$RUNNER_TEMP/ExportOptions.plist"
|
|
cat > "$export_options" <<EOF
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>method</key>
|
|
<string>$export_method</string>
|
|
<key>signingStyle</key>
|
|
<string>manual</string>
|
|
<key>teamID</key>
|
|
<string>$APPLE_TEAM_ID</string>
|
|
<key>provisioningProfiles</key>
|
|
<dict>
|
|
<key>io.truckwash.app</key>
|
|
<string>$IOS_PROFILE_NAME</string>
|
|
</dict>
|
|
<key>stripSwiftSymbols</key>
|
|
<true/>
|
|
<key>manageAppVersionAndBuildNumber</key>
|
|
<false/>
|
|
</dict>
|
|
</plist>
|
|
EOF
|
|
xcodebuild \
|
|
-exportArchive \
|
|
-archivePath "$RUNNER_TEMP/TruckWash.xcarchive" \
|
|
-exportPath "$RUNNER_TEMP/ios-export" \
|
|
-exportOptionsPlist "$export_options"
|
|
|
|
- name: Upload iOS artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: truck-wash-ios-${{ env.MOBILE_VERSION_NAME }}-${{ github.sha }}
|
|
path: ${{ runner.temp }}/ios-export/*.ipa
|
|
if-no-files-found: error
|
|
retention-days: 14
|
|
|
|
- name: Clean up Apple signing assets
|
|
if: always()
|
|
shell: bash
|
|
run: |
|
|
if [[ -n "${IOS_KEYCHAIN_PATH:-}" ]]; then
|
|
security delete-keychain "$IOS_KEYCHAIN_PATH" || true
|
|
fi
|
|
if [[ -n "${IOS_PROFILE_UUID:-}" ]]; then
|
|
rm -f "$HOME/Library/MobileDevice/Provisioning Profiles/$IOS_PROFILE_UUID.mobileprovision"
|
|
fi
|