1818 id-token : write
1919 steps :
2020 - name : Harden Runner
21- uses : step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
21+ uses : step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
2222 with :
2323 egress-policy : audit
2424
@@ -43,15 +43,20 @@ jobs:
4343 # `KEY_JKS` should contain the result of:
4444 # gpg -c --armor keystore.jks
4545 # `KEY_JKS_PASSPHRASE` should contain the passphrase used for the command above
46+ # The SkSL bundle must be produced with the same Flutter engine as the one used to build the artifact
47+ # flutter build <subcommand> --bundle-sksl-path shaders.sksl.json
48+ # do not bundle shaders for izzy/libre flavours, to avoid crashes in some environments:
49+ # cf https://github.com/deckerst/aves/issues/388
50+ # cf https://github.com/deckerst/aves/issues/398
4651 run : |
4752 echo "${{ secrets.KEY_JKS }}" > release.keystore.asc
4853 gpg -d --passphrase "${{ secrets.KEY_JKS_PASSPHRASE }}" --batch release.keystore.asc > $AVES_STORE_FILE
4954 rm release.keystore.asc
5055 mkdir outputs
5156 scripts/apply_flavor_play.sh
52- ./flutterw build appbundle -t lib/main_play.dart --flavor play
57+ ./flutterw build appbundle -t lib/main_play.dart --flavor play --bundle-sksl-path shaders.sksl.json
5358 cp build/app/outputs/bundle/playRelease/*.aab outputs
54- ./flutterw build apk -t lib/main_play.dart --flavor play
59+ ./flutterw build apk -t lib/main_play.dart --flavor play --bundle-sksl-path shaders.sksl.json
5560 cp build/app/outputs/apk/play/release/*.apk outputs
5661 scripts/apply_flavor_izzy.sh
5762 ./flutterw build apk -t lib/main_izzy.dart --flavor izzy --split-per-abi
7075 AVES_GOOGLE_API_KEY : ${{ secrets.AVES_GOOGLE_API_KEY }}
7176
7277 - name : Generate artifact attestation
73- uses : actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
78+ uses : actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd # v2.3.0
7479 with :
7580 subject-path : ' outputs/*'
7681
@@ -93,15 +98,15 @@ jobs:
9398 runs-on : ubuntu-latest
9499 steps :
95100 - name : Harden Runner
96- uses : step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
101+ uses : step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
97102 with :
98103 egress-policy : audit
99104
100105 - name : Checkout repository
101106 uses : actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
102107
103108 - name : Get appbundle from artifacts
104- uses : actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
109+ uses : actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
105110 with :
106111 name : appbundle
107112
0 commit comments