fix: correct APK signing key and CI keystore config #6
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Pipeline | |
| # Trigger: push a version tag like v1.9.7 | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| permissions: | |
| contents: write | |
| jobs: | |
| # ─── Build ──────────────────────────────────────────────────────── | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: '17' | |
| cache: gradle | |
| - name: Decode keystore | |
| run: echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > app/release.keystore | |
| - name: Create keystore.properties | |
| run: | | |
| echo "storeFile=release.keystore" > keystore.properties | |
| echo "storePassword=${{ secrets.KEYSTORE_PASSWORD }}" >> keystore.properties | |
| echo "keyAlias=${{ secrets.KEY_ALIAS }}" >> keystore.properties | |
| echo "keyPassword=${{ secrets.KEY_PASSWORD }}" >> keystore.properties | |
| - name: Create secrets.properties | |
| run: | | |
| echo "SUPABASE_URL=${{ secrets.SUPABASE_URL }}" > secrets.properties | |
| echo "SUPABASE_ANON_KEY=${{ secrets.SUPABASE_ANON_KEY }}" >> secrets.properties | |
| echo "GOOGLE_WEB_CLIENT_ID=${{ secrets.GOOGLE_WEB_CLIENT_ID }}" >> secrets.properties | |
| # Fail fast if placeholder leaked through | |
| if grep -q 'your-project' secrets.properties; then | |
| echo "::error::secrets.properties contains placeholder values — set SUPABASE_URL, SUPABASE_ANON_KEY, GOOGLE_WEB_CLIENT_ID in GitHub repo secrets" | |
| exit 1 | |
| fi | |
| - name: Build sideload APK | |
| run: ./gradlew :app:assembleSideloadRelease --stacktrace | |
| - name: Build Play Store AAB | |
| run: ./gradlew :app:bundlePlayRelease --stacktrace | |
| - name: Extract version from tag | |
| id: version | |
| run: echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT" | |
| - name: Upload APK artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sideload-apk | |
| path: app/build/outputs/apk/sideload/release/*.apk | |
| - name: Upload AAB artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: play-aab | |
| path: app/build/outputs/bundle/playRelease/*.aab | |
| outputs: | |
| tag: ${{ steps.version.outputs.tag }} | |
| # ─── GitHub Release ─────────────────────────────────────────────── | |
| github-release: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: sideload-apk | |
| path: artifacts/ | |
| - name: Extract changelog for this version | |
| id: changelog | |
| run: | | |
| TAG="${{ needs.build.outputs.tag }}" | |
| VERSION="${TAG#v}" | |
| # Extract section between this version header and the next version header | |
| NOTES=$(awk "/^## \[${VERSION}\]/{found=1; next} /^## \[/{if(found) exit} found{print}" CHANGELOG.md) | |
| if [ -z "$NOTES" ]; then | |
| NOTES="Release ${TAG}" | |
| fi | |
| # Append download code and write to file for gh release | |
| cat > release_notes.md <<EOFNOTES | |
| ${NOTES} | |
| --- | |
| 📥 **Downloader Code:** \`2633582\` — enter in [Downloader App](https://aftv.news/2633582) on Fire TV / Android TV | |
| EOFNOTES | |
| - name: Create GitHub Release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh release create "${{ needs.build.outputs.tag }}" \ | |
| artifacts/*.apk \ | |
| --title "${{ needs.build.outputs.tag }}" \ | |
| --notes-file release_notes.md | |
| # ─── Play Store Upload ──────────────────────────────────────────── | |
| play-store: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: play-aab | |
| path: artifacts/ | |
| - name: Upload to Play Store (production) | |
| uses: r0adkll/upload-google-play@v1 | |
| with: | |
| serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }} | |
| packageName: com.arvio.tv | |
| releaseFiles: artifacts/*.aab | |
| track: production | |
| status: completed | |
| # ─── Discord Announcement ───────────────────────────────────────── | |
| discord: | |
| needs: [build, github-release] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Extract changelog | |
| id: changelog | |
| run: | | |
| TAG="${{ needs.build.outputs.tag }}" | |
| VERSION="${TAG#v}" | |
| NOTES=$(awk "/^## \[${VERSION}\]/{found=1; next} /^## \[/{if(found) exit} found{print}" CHANGELOG.md) | |
| if [ -z "$NOTES" ]; then | |
| NOTES="New release available!" | |
| fi | |
| # Truncate to 1800 chars for Discord embed limit | |
| NOTES="${NOTES:0:1800}" | |
| echo "notes<<EOFNOTES" >> "$GITHUB_OUTPUT" | |
| echo "$NOTES" >> "$GITHUB_OUTPUT" | |
| echo "EOFNOTES" >> "$GITHUB_OUTPUT" | |
| - name: Post to Discord | |
| env: | |
| WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }} | |
| DISCORD_NOTES: ${{ steps.changelog.outputs.notes }} | |
| run: | | |
| TAG="${{ needs.build.outputs.tag }}" | |
| RELEASE_URL="https://github.com/ProdigyV21/ARVIO/releases/tag/${TAG}" | |
| # Build JSON payload with embed — notes passed via env to avoid shell quoting issues | |
| jq -n \ | |
| --arg title "🚀 ARVIO ${TAG} Released!" \ | |
| --arg desc "$DISCORD_NOTES" \ | |
| --arg url "$RELEASE_URL" \ | |
| '{ | |
| embeds: [{ | |
| title: $title, | |
| description: ($desc + "\n\n---\n📥 **Downloader Code:** `2633582` — enter in Downloader App on Fire TV / Android TV\n🔗 [aftv.news/2633582](https://aftv.news/2633582)"), | |
| url: $url, | |
| color: 5814783, | |
| footer: { text: "Download the APK from GitHub or update via Play Store" } | |
| }] | |
| }' > payload.json | |
| curl -f -H "Content-Type: application/json" \ | |
| -d @payload.json \ | |
| "$WEBHOOK_URL" | |
| # ─── Reddit Post ────────────────────────────────────────────────── | |
| reddit: | |
| needs: [build, github-release] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Extract changelog | |
| id: changelog | |
| run: | | |
| TAG="${{ needs.build.outputs.tag }}" | |
| VERSION="${TAG#v}" | |
| NOTES=$(awk "/^## \[${VERSION}\]/{found=1; next} /^## \[/{if(found) exit} found{print}" CHANGELOG.md) | |
| if [ -z "$NOTES" ]; then | |
| NOTES="New release available!" | |
| fi | |
| echo "notes<<EOFNOTES" >> "$GITHUB_OUTPUT" | |
| echo "$NOTES" >> "$GITHUB_OUTPUT" | |
| echo "EOFNOTES" >> "$GITHUB_OUTPUT" | |
| - name: Post to Reddit | |
| env: | |
| REDDIT_CLIENT_ID: ${{ secrets.REDDIT_CLIENT_ID }} | |
| REDDIT_CLIENT_SECRET: ${{ secrets.REDDIT_CLIENT_SECRET }} | |
| REDDIT_USERNAME: ${{ secrets.REDDIT_USERNAME }} | |
| REDDIT_PASSWORD: ${{ secrets.REDDIT_PASSWORD }} | |
| REDDIT_SUBREDDIT: ${{ secrets.REDDIT_SUBREDDIT }} | |
| REDDIT_NOTES: ${{ steps.changelog.outputs.notes }} | |
| run: | | |
| TAG="${{ needs.build.outputs.tag }}" | |
| RELEASE_URL="https://github.com/ProdigyV21/ARVIO/releases/tag/${TAG}" | |
| # Get OAuth token | |
| TOKEN=$(curl -s -X POST https://www.reddit.com/api/v1/access_token \ | |
| -u "${REDDIT_CLIENT_ID}:${REDDIT_CLIENT_SECRET}" \ | |
| -d "grant_type=password&username=${REDDIT_USERNAME}&password=${REDDIT_PASSWORD}" \ | |
| -A "ARVIO-Release-Bot/1.0" | jq -r '.access_token') | |
| # Build post body | |
| BODY="$(cat <<EOFBODY | |
| ## ARVIO ${TAG} Released! | |
| ${REDDIT_NOTES} | |
| --- | |
| 📥 **[Download APK](${RELEASE_URL})** | Also available on Google Play Store | |
| EOFBODY | |
| )" | |
| # Submit post | |
| curl -s -X POST https://oauth.reddit.com/api/submit \ | |
| -H "Authorization: bearer ${TOKEN}" \ | |
| -A "ARVIO-Release-Bot/1.0" \ | |
| -d "sr=${REDDIT_SUBREDDIT}" \ | |
| -d "kind=self" \ | |
| --data-urlencode "title=ARVIO ${TAG} - Update Released" \ | |
| --data-urlencode "text=${BODY}" |