|
| 1 | +name: Official Release |
| 2 | + |
| 3 | +# Required repository secrets: |
| 4 | +# - ANDROID_SIGNING_KEYSTORE_BASE64 |
| 5 | +# - ANDROID_SIGNING_STORE_PASSWORD |
| 6 | +# - ANDROID_SIGNING_KEY_ALIAS |
| 7 | +# - ANDROID_SIGNING_KEY_PASSWORD |
| 8 | +# |
| 9 | +on: |
| 10 | + push: |
| 11 | + tags: |
| 12 | + - "*" |
| 13 | + |
| 14 | +permissions: |
| 15 | + contents: write |
| 16 | + |
| 17 | +env: |
| 18 | + ANDROID_API: "26" |
| 19 | + GRADLE_ANDROID_NDK_VERSION: "26.3.11579264" |
| 20 | + STORMDNS_ANDROID_NDK_VERSION: "29.0.14206865" |
| 21 | + |
| 22 | +jobs: |
| 23 | + release: |
| 24 | + name: Build, sign, and publish release APKs |
| 25 | + runs-on: ubuntu-latest |
| 26 | + |
| 27 | + steps: |
| 28 | + - name: Checkout WhiteDNS |
| 29 | + uses: actions/checkout@v4 |
| 30 | + with: |
| 31 | + submodules: recursive |
| 32 | + |
| 33 | + - name: Set up JDK |
| 34 | + uses: actions/setup-java@v4 |
| 35 | + with: |
| 36 | + distribution: temurin |
| 37 | + java-version: "17" |
| 38 | + cache: gradle |
| 39 | + |
| 40 | + - name: Install Android SDK packages |
| 41 | + run: | |
| 42 | + set -euo pipefail |
| 43 | + yes | sdkmanager --licenses >/dev/null |
| 44 | + sdkmanager \ |
| 45 | + "platforms;android-36" \ |
| 46 | + "build-tools;36.0.0" \ |
| 47 | + "ndk;${GRADLE_ANDROID_NDK_VERSION}" \ |
| 48 | + "ndk;${STORMDNS_ANDROID_NDK_VERSION}" |
| 49 | +
|
| 50 | + - name: Set up Go |
| 51 | + uses: actions/setup-go@v5 |
| 52 | + with: |
| 53 | + go-version-file: third_party/StormDNS/go.mod |
| 54 | + cache-dependency-path: third_party/StormDNS/go.sum |
| 55 | + |
| 56 | + - name: Build StormDNS native clients |
| 57 | + run: | |
| 58 | + set -euo pipefail |
| 59 | + make stormdns \ |
| 60 | + NDK_HOST=linux-x86_64 \ |
| 61 | + NDK_ROOT="${ANDROID_HOME}/ndk/${STORMDNS_ANDROID_NDK_VERSION}" |
| 62 | +
|
| 63 | + - name: Run unit tests |
| 64 | + run: ./gradlew testDebugUnitTest |
| 65 | + |
| 66 | + - name: Build unsigned release APKs |
| 67 | + run: | |
| 68 | + set -euo pipefail |
| 69 | + TAG_NAME="${GITHUB_REF_NAME}" |
| 70 | + VERSION_NAME="${TAG_NAME#v}" |
| 71 | + ./gradlew :app:assembleRelease \ |
| 72 | + -PWHITE_DNS_VERSION_NAME="${VERSION_NAME}" \ |
| 73 | + -PWHITE_DNS_VERSION_CODE="${GITHUB_RUN_NUMBER}" |
| 74 | +
|
| 75 | + - name: Sign release APKs |
| 76 | + env: |
| 77 | + ANDROID_SIGNING_KEYSTORE_BASE64: ${{ secrets.ANDROID_SIGNING_KEYSTORE_BASE64 }} |
| 78 | + ANDROID_SIGNING_STORE_PASSWORD: ${{ secrets.ANDROID_SIGNING_STORE_PASSWORD }} |
| 79 | + ANDROID_SIGNING_KEY_ALIAS: ${{ secrets.ANDROID_SIGNING_KEY_ALIAS }} |
| 80 | + ANDROID_SIGNING_KEY_PASSWORD: ${{ secrets.ANDROID_SIGNING_KEY_PASSWORD }} |
| 81 | + run: | |
| 82 | + set -euo pipefail |
| 83 | + for secret_name in \ |
| 84 | + ANDROID_SIGNING_KEYSTORE_BASE64 \ |
| 85 | + ANDROID_SIGNING_STORE_PASSWORD \ |
| 86 | + ANDROID_SIGNING_KEY_ALIAS \ |
| 87 | + ANDROID_SIGNING_KEY_PASSWORD |
| 88 | + do |
| 89 | + if [[ -z "${!secret_name:-}" ]]; then |
| 90 | + echo "::error::Missing GitHub secret: ${secret_name}" |
| 91 | + exit 1 |
| 92 | + fi |
| 93 | + done |
| 94 | +
|
| 95 | + TAG_NAME="${GITHUB_REF_NAME}" |
| 96 | + KEYSTORE_PATH="${RUNNER_TEMP}/whitedns-release.keystore" |
| 97 | + echo "${ANDROID_SIGNING_KEYSTORE_BASE64}" | base64 --decode > "${KEYSTORE_PATH}" |
| 98 | +
|
| 99 | + BUILD_TOOLS_DIR="$(find "${ANDROID_HOME}/build-tools" -mindepth 1 -maxdepth 1 -type d | sort -V | tail -n 1)" |
| 100 | + mkdir -p dist |
| 101 | +
|
| 102 | + shopt -s nullglob |
| 103 | + unsigned_apks=(app/build/outputs/apk/release/*-release-unsigned.apk) |
| 104 | + if (( ${#unsigned_apks[@]} == 0 )); then |
| 105 | + echo "::error::No unsigned release APKs found." |
| 106 | + exit 1 |
| 107 | + fi |
| 108 | +
|
| 109 | + for unsigned_apk in "${unsigned_apks[@]}"; do |
| 110 | + base_name="$(basename "${unsigned_apk}" -release-unsigned.apk)" |
| 111 | + abi_name="${base_name#app-}" |
| 112 | + aligned_apk="${RUNNER_TEMP}/${base_name}-aligned.apk" |
| 113 | + signed_apk="dist/WhiteDNS-${TAG_NAME}-${abi_name}.apk" |
| 114 | +
|
| 115 | + "${BUILD_TOOLS_DIR}/zipalign" -f -p 4 "${unsigned_apk}" "${aligned_apk}" |
| 116 | + "${BUILD_TOOLS_DIR}/apksigner" sign \ |
| 117 | + --ks "${KEYSTORE_PATH}" \ |
| 118 | + --ks-pass "pass:${ANDROID_SIGNING_STORE_PASSWORD}" \ |
| 119 | + --ks-key-alias "${ANDROID_SIGNING_KEY_ALIAS}" \ |
| 120 | + --key-pass "pass:${ANDROID_SIGNING_KEY_PASSWORD}" \ |
| 121 | + --out "${signed_apk}" \ |
| 122 | + "${aligned_apk}" |
| 123 | + "${BUILD_TOOLS_DIR}/apksigner" verify --verbose "${signed_apk}" |
| 124 | + done |
| 125 | +
|
| 126 | + cp THIRD_PARTY_NOTICES.md "dist/WhiteDNS-${TAG_NAME}-THIRD_PARTY_NOTICES.md" |
| 127 | + (cd dist && shasum -a 256 * > SHA256SUMS.txt) |
| 128 | +
|
| 129 | + - name: Publish GitHub Release |
| 130 | + env: |
| 131 | + GH_TOKEN: ${{ github.token }} |
| 132 | + run: | |
| 133 | + set -euo pipefail |
| 134 | + TAG_NAME="${GITHUB_REF_NAME}" |
| 135 | + RELEASE_TITLE="WhiteDNS ${TAG_NAME}" |
| 136 | + NOTES_FILE="${RUNNER_TEMP}/release-notes.md" |
| 137 | +
|
| 138 | + cat > "${NOTES_FILE}" <<EOF |
| 139 | + Official WhiteDNS release for ${TAG_NAME}. |
| 140 | +
|
| 141 | + WhiteDNS is not published on Google Play. APKs attached to this GitHub release are the official release artifacts for this tag. |
| 142 | +
|
| 143 | + See LICENSE.MD, CONTRIBUTING.md, CLA.md, and TRADEMARK.MD before using or contributing to this project. |
| 144 | + EOF |
| 145 | +
|
| 146 | + release_flags=() |
| 147 | + if [[ "${TAG_NAME}" =~ (alpha|beta|rc) ]]; then |
| 148 | + release_flags+=(--prerelease) |
| 149 | + fi |
| 150 | +
|
| 151 | + if gh release view "${TAG_NAME}" >/dev/null 2>&1; then |
| 152 | + gh release upload "${TAG_NAME}" dist/* --clobber |
| 153 | + else |
| 154 | + gh release create "${TAG_NAME}" dist/* \ |
| 155 | + --title "${RELEASE_TITLE}" \ |
| 156 | + --notes-file "${NOTES_FILE}" \ |
| 157 | + "${release_flags[@]}" |
| 158 | + fi |
0 commit comments