feat: open module configuration from the store install bar #1222
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Core | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [ master ] | |
| tags: [ v* ] | |
| pull_request: | |
| merge_group: | |
| jobs: | |
| build: | |
| # A "Release Vector …" commit is cut straight to a `v*` tag, and the tag build below is what | |
| # publishes it — as the stable, `--latest` release. Skip the master-push run for that one commit | |
| # so the very same code does not also go out as a canary prerelease: a release must reach users | |
| # once, as the stable release, never also as a canary. The tag build is a separate push event | |
| # (ref refs/tags/v*, not refs/heads/master) and is unaffected, so the release still ships. | |
| if: ${{ !(github.event_name == 'push' && github.ref == 'refs/heads/master' && startsWith(github.event.head_commit.message, 'Release Vector')) }} | |
| runs-on: ubuntu-latest | |
| # Needed to publish the canary prerelease below. Everything else here only reads. | |
| permissions: | |
| contents: write | |
| env: | |
| # Where this build's code came from, for the version string the manager and module.prop show. | |
| # Both are the head of the pull request rather than GitHub's defaults, which on a pull request | |
| # describe the run instead of the code: GITHUB_REPOSITORY is this repository even when the | |
| # branch came from a fork, and the checked-out HEAD is an ephemeral merge commit that exists | |
| # nowhere and cannot be looked up by anyone who reads it off a device. Both head.* values are | |
| # null outside a pull request, where the defaults are already right. | |
| VECTOR_BUILD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name || github.repository }} | |
| VECTOR_BUILD_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }} | |
| CCACHE_COMPILERCHECK: "%compiler% -dumpmachine; %compiler% -dumpversion" | |
| CCACHE_NOHASHDIR: "true" | |
| CCACHE_HARDLINK: "true" | |
| CCACHE_BASEDIR: "${{ github.workspace }}" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| submodules: recursive | |
| fetch-depth: 0 | |
| # Before anything is built, because it needs nothing but Python and a translator's mistake | |
| # should not wait twenty minutes to surface. Crowdin owns the content of these files, so what | |
| # this catches is a bad merge or a line pasted into the wrong language -- both of which have | |
| # happened, and neither of which any other check in this repository looks for. | |
| - name: Check translations | |
| run: | | |
| python3 manager/tools/check_translations.py manager/src/main/res | |
| python3 manager/tools/check_translations.py daemon/src/main/res | |
| # A missing secret used to be skipped over in silence, and the build carried on to publish a | |
| # canary or a tag signed with the debug key — which the daemon's InstallerVerifier rejects, | |
| # and which nobody notices until someone tries to install the manager. On this repository the | |
| # secret is always meant to be there, so its absence stops the run here. A fork has no access | |
| # to it and cannot be given one, so a fork builds unsigned, as does any branch that is not | |
| # master: neither publishes anything. | |
| - name: Write key | |
| if: ${{ ( github.event_name != 'pull_request' && github.ref == 'refs/heads/master' ) || github.ref_type == 'tag' }} | |
| env: | |
| KEY_STORE: ${{ secrets.KEY_STORE }} | |
| KEY_STORE_PASSWORD: ${{ secrets.KEY_STORE_PASSWORD }} | |
| ALIAS: ${{ secrets.ALIAS }} | |
| KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }} | |
| IS_UPSTREAM: ${{ github.repository_owner == 'JingMatrix' }} | |
| run: | | |
| set -euo pipefail | |
| if [ -z "$KEY_STORE" ]; then | |
| if [ "$IS_UPSTREAM" = "true" ]; then | |
| echo "::error::KEY_STORE is empty on ${{ github.ref }}. Refusing to publish an unsigned build." | |
| exit 1 | |
| fi | |
| echo "No signing secret on this fork; building unsigned." | |
| exit 0 | |
| fi | |
| # Through the environment rather than interpolated into the script: a password holding a | |
| # quote would otherwise be pasted into a shell word and mangled, or worse, executed. | |
| { | |
| echo "androidStorePassword=$KEY_STORE_PASSWORD" | |
| echo "androidKeyAlias=$ALIAS" | |
| echo "androidKeyPassword=$KEY_PASSWORD" | |
| echo "androidStoreFile=key.jks" | |
| } >> gradle.properties | |
| printf '%s' "$KEY_STORE" | base64 --decode > key.jks | |
| - name: Setup Java | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: 21 | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@v6 | |
| - name: Configure Gradle properties | |
| run: | | |
| echo 'android.native.buildOutput=verbose' >> ~/.gradle/gradle.properties | |
| echo 'org.gradle.parallel=true' >> ~/.gradle/gradle.properties | |
| echo 'org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8 -XX:+UseParallelGC' >> ~/.gradle/gradle.properties | |
| - name: Setup ninja | |
| uses: seanmiddleditch/gha-setup-ninja@v6 | |
| with: | |
| version: 1.13.2 | |
| - name: Setup ccache | |
| uses: actions/cache@v6 | |
| with: | |
| path: | | |
| ~/.ccache | |
| ${{ github.workspace }}/.ccache | |
| key: ${{ runner.os }}-ccache-${{ hashFiles('**/build.gradle') }}-${{ hashFiles('**/CMakeLists.txt') }} | |
| restore-keys: | | |
| ${{ runner.os }}-ccache- | |
| - name: Setup Android SDK | |
| uses: android-actions/setup-android@v4 | |
| - name: Remove Android's cmake | |
| shell: bash | |
| run: rm -rf $ANDROID_HOME/cmake | |
| - name: Build with Gradle | |
| run: | | |
| ./gradlew zipAll | |
| - name: Prepare artifact | |
| if: success() | |
| id: prepareArtifact | |
| run: | | |
| zygiskReleaseName=`ls zygisk/release/Vector-v*-Release.zip | awk -F '(/|.zip)' '{print $3}'` && echo "zygiskReleaseName=$zygiskReleaseName" >> $GITHUB_OUTPUT | |
| zygiskDebugName=`ls zygisk/release/Vector-v*-Debug.zip | awk -F '(/|.zip)' '{print $3}'` && echo "zygiskDebugName=$zygiskDebugName" >> $GITHUB_OUTPUT | |
| versionCode=`echo "$zygiskDebugName" | awk -F '-' '{print $3}'` && echo "versionCode=$versionCode" >> $GITHUB_OUTPUT | |
| versionName=`echo "$zygiskDebugName" | awk -F '-' '{print $2}'` && echo "versionName=$versionName" >> $GITHUB_OUTPUT | |
| unzip zygisk/release/Vector-v*-Release.zip -d Vector-Release | |
| unzip zygisk/release/Vector-v*-Debug.zip -d Vector-Debug | |
| - name: Upload zygisk release | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: ${{ steps.prepareArtifact.outputs.zygiskReleaseName }} | |
| path: "./Vector-Release/*" | |
| - name: Upload zygisk debug | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: ${{ steps.prepareArtifact.outputs.zygiskDebugName }} | |
| path: "./Vector-Debug/*" | |
| # One entry per module that minifies. `app` was the old manager and has not existed since | |
| # #796, so the manager's mapping — the one an obfuscated stack trace from a user actually | |
| # needs — has been missing from every run since. | |
| - name: Upload mappings | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: mappings | |
| path: | | |
| zygisk/build/outputs/mapping | |
| manager/build/outputs/mapping | |
| daemon/build/outputs/mapping | |
| # DEBUG_SYMBOLS_PATH is set from `layout.buildDirectory` inside the root `subprojects` block, | |
| # so each module writes its own build/symbols and nothing ever lands in the root one. | |
| - name: Upload symbols | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: symbols | |
| path: | | |
| zygisk/build/symbols | |
| daemon/build/symbols | |
| dex2oat/build/symbols | |
| # --- stable release -------------------------------------------------------------------- | |
| # | |
| # A pushed `v*` tag is a stable release, not a canary. It is published here from the same | |
| # signed zips this build produced, so cutting a release is `git tag && git push` with nothing | |
| # hand-uploaded afterwards — the hand-assembly is exactly how v2.0's assets came to disagree | |
| # with zygisk/update.json (#811), and an automated attach cannot drift from what was built. | |
| # | |
| # Marked `--latest`, unlike the canaries below: this is what `releases/latest`, and therefore | |
| # the manager's update check, resolves to. The body is the module's own zygisk/changelog.md | |
| # under a GitHub H1 the release page shows. The changelog itself carries no title line — the | |
| # manager renders it beneath its own heading, so a banner there would only read twice. | |
| - name: Publish release | |
| if: ${{ success() && github.ref_type == 'tag' && startsWith(github.ref_name, 'v') }} | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| TAG: ${{ github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| # `%s` arguments, never the format string, so a `%` anywhere in the changelog is literal. | |
| notes=$(printf '# 🎉 Vector %s 🎉\n\n%s\n' "${TAG#v}" "$(cat zygisk/changelog.md)") | |
| # Recreated rather than edited so a re-run replaces the assets instead of appending a | |
| # second copy. No `--cleanup-tag`: the release is rebuilt, the pushed release tag is kept. | |
| gh release delete "$TAG" --yes 2>/dev/null || true | |
| gh release create "$TAG" \ | |
| --latest \ | |
| --title "Vector ${TAG}" \ | |
| --notes "$notes" \ | |
| zygisk/release/Vector-v*-Release.zip \ | |
| zygisk/release/Vector-v*-Debug.zip | |
| # --- canary distribution --------------------------------------------------------------- | |
| # | |
| # The zips above are also attached to a prerelease, because an Actions artifact cannot be | |
| # downloaded without a GitHub account — `GET /actions/artifacts/<id>/zip` answers 401 to an | |
| # anonymous caller, while a release asset answers 206. Testing a canary is the lowest-friction | |
| # way for an ordinary user to help, so it must not require handing an OAuth grant to anyone, | |
| # and it must work for the many users who cannot reach GitHub's login page at all. | |
| # | |
| # Marked prerelease so `releases/latest` — which is what update checks read — keeps pointing | |
| # at the last stable tag. | |
| - name: Publish canary prerelease | |
| if: >- | |
| success() && | |
| (github.event_name == 'workflow_dispatch' || | |
| (github.event_name == 'push' && github.ref == 'refs/heads/master')) | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| VERSION_CODE: ${{ steps.prepareArtifact.outputs.versionCode }} | |
| VERSION_NAME: ${{ steps.prepareArtifact.outputs.versionName }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| COMMIT_URL: ${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| tag="canary-${VERSION_CODE}" | |
| subject=$(git log -1 --pretty=%s) | |
| short=$(git rev-parse --short HEAD) | |
| notes=$(cat <<EOF | |
| **${subject}** | |
| Built from [\`${short}\`](${COMMIT_URL}) by [run ${{ github.run_id }}](${RUN_URL}). | |
| This is a canary: the current state of \`master\`, tested by CI and nothing else. It is | |
| published here rather than left as a workflow artifact so that it can be downloaded | |
| without a GitHub account. | |
| | Build | Use it when | | |
| | :-- | :-- | | |
| | \`Vector-${VERSION_NAME}-${VERSION_CODE}-Debug.zip\` | You are chasing a bug. Far more logging, and the build maintainers ask for in reports. | | |
| | \`Vector-${VERSION_NAME}-${VERSION_CODE}-Release.zip\` | You just want the newest code. | | |
| Only the five most recent canaries are kept. | |
| EOF | |
| ) | |
| # Recreated rather than edited: re-running the workflow for the same commit should | |
| # replace that build, not append a second copy of every asset to it. | |
| gh release delete "$tag" --yes --cleanup-tag 2>/dev/null || true | |
| gh release create "$tag" \ | |
| --prerelease \ | |
| --target "${{ github.sha }}" \ | |
| --title "Vector ${VERSION_NAME} canary ${VERSION_CODE}" \ | |
| --notes "$notes" \ | |
| zygisk/release/Vector-v*-Release.zip \ | |
| zygisk/release/Vector-v*-Debug.zip | |
| # Five is what a tester needs: enough to bisect a regression across a few days, few enough | |
| # that the releases page is still mostly releases. Sorted by version code, which is the commit | |
| # count and therefore monotonic, rather than by date, which reruns and reverts can disorder. | |
| - name: Keep only the five most recent canaries | |
| if: >- | |
| success() && | |
| (github.event_name == 'workflow_dispatch' || | |
| (github.event_name == 'push' && github.ref == 'refs/heads/master')) | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| # `grep` exits 1 when nothing matches, which under `pipefail` would fail the step on a | |
| # repository that has no canaries yet. Collected first, then acted on. | |
| tags=$(gh release list --limit 100 --json tagName --jq '.[].tagName' | grep '^canary-' || true) | |
| [ -n "$tags" ] || exit 0 | |
| echo "$tags" | sort -t- -k2 -n -r | tail -n +6 | while read -r old; do | |
| echo "Removing $old" | |
| gh release delete "$old" --yes --cleanup-tag | |
| done |