Add optional keystore upload inputs to release workflow for consistent APK signing

Agent-Logs-Url: https://github.com/winnerspiros/osu/sessions/c9e6ebec-a8b6-4aa8-b446-27812ab3b780

Co-authored-by: winnerspiros <1675249+winnerspiros@users.noreply.github.com>

Author: Copilot

.github/workflows/release.yml

@@ -17,6 +17,21 @@ on:
         required: false
         default: true
         type: boolean
+      keystore_base64:
+        description: "Base64-encoded keystore (from SAVE-THESE-SECRETS.txt). Overrides ANDROID_KEYSTORE_BASE64 secret."
+        required: false
+        default: ""
+        type: string
+      key_alias:
+        description: "Signing key alias (from SAVE-THESE-SECRETS.txt). Overrides ANDROID_SIGNING_KEY_ALIAS secret."
+        required: false
+        default: ""
+        type: string
+      key_password:
+        description: "Signing key password (from SAVE-THESE-SECRETS.txt). Overrides ANDROID_SIGNING_KEY_PASSWORD secret."
+        required: false
+        default: ""
+        type: string
 
 jobs:
   build-android:
@@ -82,17 +97,34 @@ jobs:
         run: |
           KS_PATH="${{ github.workspace }}/osu.Android/osu.keystore"
 
-          if [ -n "$KEYSTORE_BASE64" ]; then
-            # ── User provided a persistent keystore secret ──────────────
-            echo "$KEYSTORE_BASE64" | base64 --decode > "$KS_PATH"
+          # Priority: workflow_dispatch inputs > repository secrets > auto-generate.
+          # This lets users paste values from SAVE-THESE-SECRETS.txt directly into
+          # the "Run workflow" form so they don't need to set up repo secrets.
+          EFFECTIVE_KS="${INPUT_KEYSTORE_BASE64:-$KEYSTORE_BASE64}"
+          EFFECTIVE_ALIAS="${INPUT_KEY_ALIAS:-$KEY_ALIAS_SECRET}"
+          EFFECTIVE_PASS="${INPUT_KEY_PASSWORD:-$KEY_PASS_SECRET}"
+          EFFECTIVE_STORE_PASS="${INPUT_KEY_PASSWORD:-$STORE_PASS_SECRET}"
+
+          # Mask passwords so they never appear in logs.
+          if [ -n "$EFFECTIVE_PASS" ]; then echo "::add-mask::$EFFECTIVE_PASS"; fi
+          if [ -n "$EFFECTIVE_STORE_PASS" ]; then echo "::add-mask::$EFFECTIVE_STORE_PASS"; fi
+
+          if [ -n "$EFFECTIVE_KS" ]; then
+            # ── User provided a keystore (via input or secret) ──────────────
+            echo "$EFFECTIVE_KS" | base64 --decode > "$KS_PATH"
             echo "has_keystore=true"  >> "$GITHUB_OUTPUT"
             echo "generated=false"    >> "$GITHUB_OUTPUT"
-            echo "key_alias=$KEY_ALIAS_SECRET" >> "$GITHUB_OUTPUT"
-            echo "key_pass=$KEY_PASS_SECRET"   >> "$GITHUB_OUTPUT"
-            echo "store_pass=$STORE_PASS_SECRET" >> "$GITHUB_OUTPUT"
-            echo "✅ Using saved keystore from repository secrets."
+            echo "key_alias=${EFFECTIVE_ALIAS:-osu-release}" >> "$GITHUB_OUTPUT"
+            echo "key_pass=${EFFECTIVE_PASS}"     >> "$GITHUB_OUTPUT"
+            echo "store_pass=${EFFECTIVE_STORE_PASS}" >> "$GITHUB_OUTPUT"
+
+            if [ -n "$INPUT_KEYSTORE_BASE64" ]; then
+              echo "✅ Using keystore from workflow dispatch inputs."
+            else
+              echo "✅ Using saved keystore from repository secrets."
+            fi
           else
-            # ── No secret → auto-generate a keystore for this build ─────
+            # ── No keystore → auto-generate one for this build ──────────────
             # The APK will install fine on any device, but UPDATING from a
             # previous build signed with a DIFFERENT key will fail.
             # To avoid that, save the generated keystore as a secret
@@ -141,6 +173,9 @@ jobs:
           KEY_ALIAS_SECRET: ${{ secrets.ANDROID_SIGNING_KEY_ALIAS }}
           KEY_PASS_SECRET: ${{ secrets.ANDROID_SIGNING_KEY_PASSWORD }}
           STORE_PASS_SECRET: ${{ secrets.ANDROID_SIGNING_STORE_PASSWORD }}
+          INPUT_KEYSTORE_BASE64: ${{ inputs.keystore_base64 }}
+          INPUT_KEY_ALIAS: ${{ inputs.key_alias }}
+          INPUT_KEY_PASSWORD: ${{ inputs.key_password }}
 
       - name: Determine version
         id: version
@@ -308,6 +343,11 @@ jobs:
           echo ""
           echo "  ⚡ After saving the secrets, all future builds will use the"
           echo "     same keystore automatically — no more setup needed."
+          echo ""
+          echo "  💡 QUICK OPTION: You can also paste the values from"
+          echo "     SAVE-THESE-SECRETS.txt directly into the workflow"
+          echo "     dispatch inputs (keystore_base64, key_alias, key_password)"
+          echo "     when running the 'Build Android APK' workflow manually."
           echo "=================================================================="
 
       # Create a GitHub Release with the APK attached.