f203149f4f
- 所有 action 引用改为 commit SHA pin（checkout/setup-java/setup-android/action-gh-release/upload-artifact） - build.gradle.kts 移除硬编码签名密码 fallback，改用 takeIf 防御 null 和空字符串 - release.yml 构建完成后清理 release.jks（if: always()） - ci.yml 补充最小权限声明 permissions: contents: read
42 lines
1.4 KiB
YAML
42 lines
1.4 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
- uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
|
|
with:
|
|
java-version: '17'
|
|
distribution: 'temurin'
|
|
- uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
|
|
with:
|
|
packages: 'platforms;android-35 build-tools;35.0.0'
|
|
- name: Decode Keystore
|
|
run: echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > release.jks
|
|
- name: Build Release APK
|
|
env:
|
|
KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
|
|
KEYSTORE_ALIAS: ${{ secrets.KEYSTORE_ALIAS }}
|
|
KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
|
|
run: |
|
|
chmod +x gradlew
|
|
./gradlew assembleRelease
|
|
- name: Cleanup keystore (always run for security)
|
|
run: rm -f release.jks
|
|
if: always()
|
|
- name: Rename & Release
|
|
run: |
|
|
cp app/build/outputs/apk/release/app-release.apk "RainyToken-${GITHUB_REF#refs/tags/}.apk"
|
|
- uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
|
|
with:
|
|
name: "🎉 RainyToken ${{ github.ref_name }}"
|
|
files: RainyToken-${{ github.ref_name }}.apk
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |