CI: tag-triggered Play publish (signed AAB to a test track)#21
Merged
Conversation
Builds a signed AAB on a version tag (or manual run) and uploads it to a Play test track. Signing reuses the release signingConfig from #20: the workflow writes keystore.properties from repository secrets, so no key material is committed. The build runs in the SDK container; the upload is a Docker action, so it runs in a separate runner-native job (Docker actions cannot run inside a container job). It asserts 16 KB .so alignment in the AAB before uploading. Inert until the five secrets are set and a v* tag is pushed. Defaults are the internal track and draft status, so nothing reaches testers without a Console release. Required secrets are documented at the top of the workflow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
Security-review follow-up. r0adkll/upload-google-play runs in the job that holds the Play service-account credential, so it is the one action worth pinning to a commit: a retagged v1 could otherwise exfiltrate the credential. Pinned to v1.1.5's SHA. The remaining actions are GitHub-owned and left on major tags. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wires the Play upload so a version tag produces a signed AAB on a test track. This is the automation half of the closed-beta path; #20 was the code half.
On a
v*tag (or a manual run), it buildsbundleReleasein the SDK container, reusing the releasesigningConfigfrom #20 by writingkeystore.propertiesfrom repository secrets, then uploads the AAB withr0adkll/upload-google-play. The upload is a Docker action, which cannot run inside acontainer:job, so it lives in a separate runner-native job that consumes the AAB as an artifact. It asserts 16 KB.soalignment in the AAB before uploading, so a misaligned bundle fails here rather than at the Console.Safe by default and inert until you act:
v*tag is pushed. Merging it changes no existing job.keystore.propertiesis written on the runner (gitignored,umask 077) and GitHub masks the secret values in logs.internaland status todraft, so a run uploads the bundle but does not release it to testers until you promote it in the Console. Override both via the manual-dispatch inputs.permissions: contents: readonly.Required repository secrets (Settings → Secrets and variables → Actions), also listed at the top of the workflow:
UPLOAD_KEYSTORE_BASE64—base64 -w0 httrack-upload.jksUPLOAD_KEYSTORE_PASSWORD,UPLOAD_KEY_ALIAS,UPLOAD_KEY_PASSWORDPLAY_SERVICE_ACCOUNT_JSON— a Play Console service account with publishing rights, scoped tocom.httrack.androidBefore the first tag: bump
versionCodeabove whatever is live on the listing, confirm the upload-key cert is registered, and grant the service account release permissions in the Console.