generate-keystore.yml

name: Generate Android Signing Keystore

on:
  workflow_dispatch:
    inputs:
      key_password:
        description: "Password for the keystore and key (min 6 characters)"
        required: true
        type: string
      key_alias:
        description: "Key alias name"
        required: false
        default: "osu-release"
        type: string
      validity_days:
        description: "Certificate validity in days"
        required: false
        default: "10000"
        type: string

jobs:
  generate:
    name: Generate Keystore
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      # Mask the password so it is never printed in logs.
      - name: Mask password
        run: echo "::add-mask::${{ inputs.key_password }}"

      - name: Validate inputs
        run: |
          if [ ${#KEY_PASSWORD} -lt 6 ]; then
            echo "::error::Password must be at least 6 characters."
            exit 1
          fi
        env:
          KEY_PASSWORD: ${{ inputs.key_password }}

      - name: Generate keystore
        run: |
          keytool -genkeypair -v \
            -keystore osu-release.keystore \
            -storepass "$KEY_PASSWORD" \
            -keypass "$KEY_PASSWORD" \
            -alias "$KEY_ALIAS" \
            -keyalg RSA -keysize 2048 \
            -validity "$VALIDITY_DAYS" \
            -dname "CN=osu! Android Release,O=osu,C=US"

          echo "Keystore generated successfully ✓"
          keytool -list -v -keystore osu-release.keystore -storepass "$KEY_PASSWORD" | head -20
        env:
          KEY_PASSWORD: ${{ inputs.key_password }}
          KEY_ALIAS: ${{ inputs.key_alias }}
          VALIDITY_DAYS: ${{ inputs.validity_days }}

      - name: Encode keystore as base64
        id: encode
        run: |
          B64=$(base64 -w 0 osu-release.keystore)
          echo "$B64" > keystore-base64.txt
          echo "encoded=true" >> "$GITHUB_OUTPUT"

      - name: Upload keystore artifact
        uses: actions/upload-artifact@v7
        with:
          name: osu-signing-keystore
          path: osu-release.keystore
          retention-days: 1

      - name: Upload base64 artifact
        uses: actions/upload-artifact@v7
        with:
          name: osu-signing-keystore-base64
          path: keystore-base64.txt
          retention-days: 1

      - name: Output setup instructions
        run: |
          echo ""
          echo "==================================================================="
          echo "  KEYSTORE GENERATED — SAVE THESE SECRETS NOW"
          echo "==================================================================="
          echo ""
          echo "  Go to: Settings → Secrets and variables → Actions → New repository secret"
          echo ""
          echo "  Add these four secrets:"
          echo ""
          echo "  1. ANDROID_KEYSTORE_BASE64"
          echo "     → Value: contents of the 'keystore-base64.txt' file from the"
          echo "       'osu-signing-keystore-base64' artifact (download it above)"
          echo ""
          echo "  2. ANDROID_SIGNING_KEY_ALIAS"
          echo "     → Value: ${{ inputs.key_alias }}"
          echo ""
          echo "  3. ANDROID_SIGNING_KEY_PASSWORD"
          echo "     → Value: the password you entered when triggering this workflow"
          echo ""
          echo "  4. ANDROID_SIGNING_STORE_PASSWORD"
          echo "     → Value: the password you entered when triggering this workflow"
          echo ""
          echo "  IMPORTANT:"
          echo "  • Keep a backup of the keystore file! If you lose it, you will"
          echo "    never be able to update your installed APK — you would have to"
          echo "    uninstall and reinstall (losing all local data)."
          echo "  • After saving the secrets, DELETE this workflow run to remove"
          echo "    the keystore artifact (Settings → Actions → this run → Delete)."
          echo ""
          echo "  After saving the secrets, run the 'Build Android APK' workflow."
          echo "==================================================================="