f203149f4f
- 所有 action 引用改为 commit SHA pin（checkout/setup-java/setup-android/action-gh-release/upload-artifact） - build.gradle.kts 移除硬编码签名密码 fallback，改用 takeIf 防御 null 和空字符串 - release.yml 构建完成后清理 release.jks（if: always()） - ci.yml 补充最小权限声明 permissions: contents: read
129 lines
4.4 KiB
YAML
129 lines
4.4 KiB
YAML
name: CI
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
pull_request:
|
||
|
||
permissions:
|
||
contents: read
|
||
|
||
jobs:
|
||
test:
|
||
name: Unit Tests & Lint
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
||
- uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
|
||
with:
|
||
java-version: '17'
|
||
distribution: 'temurin'
|
||
- uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
|
||
with:
|
||
packages: 'platforms;android-35 build-tools;35.0.0'
|
||
|
||
- name: Grant execute permission for gradlew
|
||
run: chmod +x gradlew
|
||
|
||
- name: Run unit tests
|
||
run: ./gradlew testDebugUnitTest
|
||
|
||
- name: Upload test results
|
||
if: always()
|
||
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
||
with:
|
||
name: unit-test-results
|
||
path: app/build/test-results/testDebugUnitTest/*.xml
|
||
retention-days: 14
|
||
|
||
- name: Run lint
|
||
run: ./gradlew lintDebug
|
||
|
||
- name: Upload lint results
|
||
if: always()
|
||
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
||
with:
|
||
name: lint-results
|
||
path: app/build/reports/lint-results-debug.*
|
||
retention-days: 14
|
||
|
||
build-debug:
|
||
name: Debug APK
|
||
runs-on: ubuntu-latest
|
||
needs: test
|
||
steps:
|
||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
||
- uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
|
||
with:
|
||
java-version: '17'
|
||
distribution: 'temurin'
|
||
- uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
|
||
with:
|
||
packages: 'platforms;android-35 build-tools;35.0.0'
|
||
|
||
- name: Grant execute permission for gradlew
|
||
run: chmod +x gradlew
|
||
|
||
- name: Assemble Debug
|
||
run: ./gradlew assembleDebug
|
||
|
||
- name: Upload Debug APK
|
||
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
||
with:
|
||
name: debug-apk
|
||
path: app/build/outputs/apk/debug/app-debug.apk
|
||
retention-days: 14
|
||
|
||
build-release:
|
||
name: Release APK (debug-signed)
|
||
runs-on: ubuntu-latest
|
||
needs: test
|
||
steps:
|
||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
||
- uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
|
||
with:
|
||
java-version: '17'
|
||
distribution: 'temurin'
|
||
- uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
|
||
with:
|
||
packages: 'platforms;android-35 build-tools;35.0.0'
|
||
|
||
- name: Grant execute permission for gradlew
|
||
run: chmod +x gradlew
|
||
|
||
# 确保存在 debug keystore（某些 runner 镜像可能没有）
|
||
- name: Ensure debug keystore
|
||
run: |
|
||
KS="$HOME/.android/debug.keystore"
|
||
mkdir -p "$HOME/.android"
|
||
if [ ! -f "$KS" ]; then
|
||
keytool -genkeypair -v -keystore "$KS" -storepass android -alias androiddebugkey -keypass android -keyalg RSA -keysize 2048 -validity 10000 -dname "CN=Android Debug,O=Android,C=US"
|
||
echo "Generated debug keystore"
|
||
else
|
||
echo "Debug keystore exists"
|
||
fi
|
||
|
||
# CI 无 release.jks；build.gradle.kts 自动 fallback 到 debug keystore
|
||
# 只验证编译 + 资源完整性，签名由 Release workflow 用 secrets 完成
|
||
- name: Assemble Release
|
||
run: ./gradlew assembleRelease
|
||
|
||
- name: Verify Release APK
|
||
run: |
|
||
APK=app/build/outputs/apk/release/app-release.apk
|
||
if [ ! -f "$APK" ]; then
|
||
echo "❌ Release APK not found"
|
||
exit 1
|
||
fi
|
||
echo "✅ Release APK size: $(du -h "$APK" | cut -f1)"
|
||
unzip -l "$APK" | grep -q "AndroidManifest.xml" || { echo "❌ AndroidManifest.xml missing"; exit 1; }
|
||
unzip -l "$APK" | grep -q "resources.arsc" || { echo "❌ resources.arsc missing"; exit 1; }
|
||
unzip -l "$APK" | grep -q "res/" || { echo "❌ res/ directory missing"; exit 1; }
|
||
echo "✅ APK integrity verified: manifest + arsc + res/ all present"
|
||
|
||
- name: Upload Release APK
|
||
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
||
with:
|
||
name: release-apk
|
||
path: app/build/outputs/apk/release/app-release.apk
|
||
retention-days: 14 |