DPIP/.github/workflows/android.yml at main · ExpTechTW/DPIP · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
name: Build Android

# Pull requests only. A push to `main` is handled by release.yml,
# which builds the signed, uploadable artifact — running this as well would
# spend a second runner producing an unsigned one nobody installs.
on:
  pull_request:
    branches: ["main"]

jobs:
  changes:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      android: ${{ steps.filter.outputs.android }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            android:
              - 'android/**'
              - 'assets/**'
              - 'lib/**'
              - 'pubspec.yaml'

  Android:
    needs: changes
    if: ${{ needs.changes.outputs.android == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v4

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: "25"
          cache: "gradle"

      # Flutter and Dart come from mise.toml, the same pin CI and every laptop
      # use. Not subosito/flutter-action with `channel: stable`: that resolves
      # to whatever stable is on the day, so this job could ship an artifact
      # built against an SDK nobody chose, and nothing in the build log would
      # say so. See AGENTS.md → Toolchain.
      - name: Install toolchain (mise)
        uses: jdx/mise-action@v4

      - name: Cache Gradle
        uses: actions/cache@v4
        env:
          cache-name: cache-gradle
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/wrapper/gradle-wrapper.properties', '**/build.gradle') }}
          restore-keys: |
            ${{ runner.os }}-build-${{ env.cache-name }}-
            ${{ runner.os }}-build-

      - name: Cache Android NDK
        uses: actions/cache@v4
        with:
          path: |
            /usr/local/lib/android/sdk/ndk/27.0.12077973
            /usr/local/lib/android/sdk/ndk/28.2.13676358
          key: ${{ runner.os }}-ndk-27-28

      - name: Cache Android sdk
        uses: actions/cache@v4
        env:
          cache-name: cache-Android-sdk
        with:
          path: |
            /usr/local/lib/android/sdk/platforms/android-31
            /usr/local/lib/android/sdk/platforms/android-33
          key: ${{ runner.os }}-android-platforms-${{ env.cache-name }}-${{ hashFiles('android/gradle.properties') }}
          restore-keys: |
            ${{ runner.os }}-build-${{ env.cache-name }}-
            ${{ runner.os }}-build-

      - name: Install dependencies and run build_runner
        run: |
          bash tool/dev/deps.sh
          bash tool/dev/codegen.sh

      - name: Decode keystore
        run: |
          echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 --decode > android/app/my-release-key.jks

      - name: Create key.properties
        run: |
          cat > android/key.properties << EOF
          storePassword=${{ secrets.KEYSTORE_PASSWORD }}
          keyPassword=${{ secrets.KEY_PASSWORD }}
          keyAlias=${{ secrets.KEY_ALIAS }}
          storeFile=my-release-key.jks
          EOF

      - name: Build Release APK
        run: bash tool/dev/build.sh android

      - name: Upload Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: DPIP-Android-Release
          path: build/app/outputs/flutter-apk/*.apk
          retention-days: 7
          compression-level: 6