ci: publish rolling -SNAPSHOT build of main to a GitHub prerelease#6160
Merged
Conversation
Every push to main now republishes the debug APKs the CI already builds as a rolling `snapshot` prerelease, giving testers a stable download link instead of expiring, login-gated Actions artifacts. - reusable-check: stamp VERSION_NAME=<base>-SNAPSHOT on main pushes only (PR/merge-queue builds keep the plain base version). - main-check: new publish-snapshot job. Reuses the existing debug APKs, embeds the monotonic versionCode in each filename (so Obtainium's asset-URL fingerprint sees a new build; a static moving-tag URL never changes on its own), then delete+recreates the `snapshot` release and tag at HEAD. The recreate prunes stale differently-named assets and sidesteps the Releases API refusing to retarget an existing tag. - Uses CROWDIN_GITHUB_TOKEN for the tag delete/create, matching every other tag-touching workflow (default GITHUB_TOKEN is blocked by tag rulesets). - obtainium-test-builds: document the snapshot channel (installs as a separate `.debug` package, so no uninstall dance) and fix the "bleeding edge" filter, which would otherwise now follow snapshot instead of the newest open/closed beta. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR adds snapshot release automation for debug APKs, tags push builds with a ChangesSnapshot Release Automation
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant ArtifactStore
participant GH_CLI
participant GitHubReleases
GitHubActions->>ArtifactStore: Download app-debug-apks artifact
GitHubActions->>GitHubActions: Compute VERSION_CODE and rename APKs
GitHubActions->>GH_CLI: Delete existing snapshot release
GitHubActions->>GitHubReleases: Create snapshot prerelease with renamed APKs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
github-actions
Bot
added
ci
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/main-check.yml (1)
76-90: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConsider replacing
action-gh-releasewithgh release create.zizmor flags this as redundant since
gh(already used for the delete step) provides the same release-creation functionality natively on the runner, avoiding an extra third-party action dependency.♻️ Proposed refactor
- - name: Publish snapshot release - uses: softprops/action-gh-release@v3 - with: - token: ${{ secrets.CROWDIN_GITHUB_TOKEN }} - tag_name: snapshot - name: Snapshot ${{ env.VERSION_CODE }} (${{ github.sha }}) - target_commitish: ${{ github.sha }} - body: | - Automated debug build from the latest commit on `main` (${{ github.sha }}), versionCode ${{ env.VERSION_CODE }}. - Unsigned/debug-keyed, F-Droid and Google flavors. Not for production use — this release is replaced on every push to main. - - **Obtainium:** enable *Include prereleases*. Each build's APK filename carries the versionCode, so updates are detected. - files: upload/*.apk - prerelease: true - generate_release_notes: false + - name: Publish snapshot release + run: | + gh release create snapshot upload/*.apk \ + --title "Snapshot ${VERSION_CODE} (${GITHUB_SHA})" \ + --target "${GITHUB_SHA}" \ + --prerelease \ + --notes "Automated debug build from the latest commit on \`main\` (${GITHUB_SHA}), versionCode ${VERSION_CODE}."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/main-check.yml around lines 76 - 90, Replace the Snapshot release publishing step in the main-check workflow by using the built-in gh release create command instead of softprops/action-gh-release. Rework the publish snapshot release job to create/update the snapshot tag with gh, preserving the same tag_name, name, target_commitish, body, prerelease behavior, and upload/*.apk attachment handling while removing the third-party action dependency.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/main-check.yml:
- Around line 43-47: The Checkout code step in the main-check workflow is
persisting the CROWDIN_GITHUB_TOKEN in git config; update the actions/checkout
invocation to disable credential persistence by setting persist-credentials to
false. Keep the existing token and fetch-depth settings, and make the change
directly in the checkout step so later steps like download-artifact, shell
commands, and gh usage do not inherit unnecessary git credentials.
---
Nitpick comments:
In @.github/workflows/main-check.yml:
- Around line 76-90: Replace the Snapshot release publishing step in the
main-check workflow by using the built-in gh release create command instead of
softprops/action-gh-release. Rework the publish snapshot release job to
create/update the snapshot tag with gh, preserving the same tag_name, name,
target_commitish, body, prerelease behavior, and upload/*.apk attachment
handling while removing the third-party action dependency.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: c92eaff7-6483-4c78-ae15-782761ba7940
📒 Files selected for processing (3)
.github/workflows/main-check.yml.github/workflows/reusable-check.ymlobtainium-test-builds.md
- persist-credentials: false on checkout (token isn't needed by later steps; gh does the authed work via GH_TOKEN). Fixes zizmor artipacked. - Replace softprops/action-gh-release with the runner's built-in gh release create, dropping a third-party action already duplicated by the gh-based delete step. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jamesarich
enabled auto-merge
July 8, 2026 20:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
There's currently no easy way to grab a build of the very latest
main— testers have to dig through Actions artifacts, which require a GitHub login and expire after 7 days. This adds a rollingsnapshotprerelease that tracksmainand gives testers (and Obtainium) a stable download link, at essentially zero extra CI cost since it reuses the debug APKs the pipeline already builds.Changes
🌟 New Features
snapshotprerelease. Newpublish-snapshotjob inmain-check.ymlruns on every push tomain, republishing the existing debug APKs as a GitHub prerelease under the movingsnapshottag. No new build steps, no new secrets, no Play/Firebase channel.-SNAPSHOTversionName stamped on main-branch builds only (reusable-check.yml); PR and merge-queue builds keep the plain base version.🛠️ Architecture / mechanics
versionCode(…-debug-<versionCode>.apk). A moving tag reuses the same asset URL forever, and Obtainium fingerprints that URL — so without a changing filename it would never detect a new build.HEADrather than updating in place. This prunes stale, differently-named assets (which would otherwise accumulate) and sidesteps the Releases API refusing to retarget an already-existing tag.CROWDIN_GITHUB_TOKENfor the tag delete/create — the same token every other tag-touching workflow uses, since the defaultGITHUB_TOKENis blocked by the repo's tag rulesets.🧹 Chores (docs)
obtainium-test-builds.md: documented the new snapshot channel — notably it installs as a separate.debugpackage, so the uninstall-the-Play-version dance doesn't apply. Also fixed the "bleeding edge" instructions, which would otherwise now followsnapshot(always the newest prerelease) instead of the newest open/closed beta.Reviewer notes
docs-release.ymlonly fires onv*.*.*(snapshot doesn't match), and the real release pipeline isworkflow_dispatch/workflow_callonly.androidApp-google-arm64-v8a-debug-<vc>.apk) are derived from the build config; the first real snapshot run is the cheap way to confirm the documented regexes match..debugsuffix already isolates snapshot installs from production.Testing Performed
Workflow-only change; validated both YAML files parse. Full behavior is exercised by the first push to
mainafter merge (build → rename → delete/recreate release).Summary by CodeRabbit
New Features
Documentation