fix: release workflow

Author: BigJk

.github/workflows/build.yml

@@ -188,42 +188,81 @@ jobs:
     name: Build snd-android
     runs-on: ubuntu-latest
     needs: build-frontend
+
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
+
       - name: Download Frontend
         uses: actions/download-artifact@v4
         with:
           name: snd-frontend
           path: frontend/dist
+
       - name: Setup Go environment
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
           cache: true
           go-version-file: go.mod
           cache-dependency-path: go.sum
+
       - name: Setup Java
         uses: actions/setup-java@v4
         with:
           distribution: temurin
           java-version: 17
+
       - name: Setup Android SDK
         uses: android-actions/setup-android@v3
+
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4
-        with:
-          gradle-version: 9.5.1
+
       - name: Install gomobile
         run: |
           go install golang.org/x/mobile/cmd/gomobile@latest
           gomobile init
+
+      - name: Restore Android signing keystore
+        shell: bash
+        env:
+          KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+        run: |
+          printf '%s' "$KEYSTORE_BASE64" \
+            | base64 --decode \
+            > "$RUNNER_TEMP/release-key.jks"
+
       - name: Build Android release APK
         run: ./build_android.sh
         env:
           SND_ANDROID_GRADLE_TASK: assembleRelease
           SND_ANDROID_INSTALL_NDK: "true"
           SND_SKIP_FRONTEND_BUILD: "true"
           SND_RELEASE_DIR: build/release
+
+          ANDROID_KEYSTORE_PATH: ${{ runner.temp }}/release-key.jks
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+
+      - name: Verify APK signature
+        shell: bash
+        run: |
+          APK="$(find build/release -name '*.apk' -type f | head -n 1)"
+
+          if [ -z "$APK" ]; then
+            echo "No APK found"
+            exit 1
+          fi
+
+          APKSIGNER="$(find "$ANDROID_HOME/build-tools" \
+            -name apksigner \
+            -type f \
+            | sort -V \
+            | tail -n 1)"
+
+          "$APKSIGNER" verify --verbose --print-certs "$APK"
+
       - name: Archive Android Build
         uses: actions/upload-artifact@v4
         with:

Dockerfile

@@ -1,42 +1,42 @@
 # Build image
-FROM golang:1.25.5-bullseye AS build-stage
-
-ENV SND_TAGS=LIBUSB
-ENV SND_RELEASE_DIR=/app
-ENV SND_APP_NAME=snd
-
-WORKDIR /build
-RUN mkdir /app
-
-RUN curl -fsSL https://deb.nodesource.com/setup_18.x | bash
-RUN apt-get update -y &&\
-    apt-get -y install libusb-1.0-0-dev pkg-config nodejs bzip2 &&\
-    apt-get -y clean &&\
-    apt-get autoremove &&\
-    rm -rf /var/lib/apt/lists/*
-COPY . .
-RUN cd /build/frontend && npm ci && npm cache clean --force && npm run build
-
-RUN ./build.sh
-
-# Release image
-FROM ubuntu:latest
-WORKDIR /app
-
-RUN apt-get -y update &&\
-    apt-get -y install \
-      libusb-1.0.0-dev \
-      pkg-config \
-      curl &&\
-    curl -LO https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb &&\
-    apt-get install -y ./google-chrome-stable_current_amd64.deb &&\
-    apt-get -y clean &&\
-    apt-get autoremove &&\
-    rm -rf /var/lib/apt/lists/* &&\
-    rm google-chrome-stable_current_amd64.deb 
-
-COPY --from=build-stage /app /app
-RUN adduser --system --group --home /home/app app && chown app:app /app
-USER app
-EXPOSE 7123
-CMD ["/app/snd"]
+FROM golang:1.25-bookworm AS build-stage
+
+ENV SND_TAGS=LIBUSB
+ENV SND_RELEASE_DIR=/app
+ENV SND_APP_NAME=snd
+
+WORKDIR /build
+RUN mkdir /app
+
+RUN curl -fsSL https://deb.nodesource.com/setup_18.x | bash
+RUN apt-get update -y &&\
+    apt-get -y install libusb-1.0-0-dev pkg-config nodejs bzip2 &&\
+    apt-get -y clean &&\
+    apt-get autoremove &&\
+    rm -rf /var/lib/apt/lists/*
+COPY . .
+RUN cd /build/frontend && npm ci && npm cache clean --force && npm run build
+
+RUN ./build.sh
+
+# Release image
+FROM ubuntu:latest
+WORKDIR /app
+
+RUN apt-get -y update &&\
+    apt-get -y install \
+      libusb-1.0.0-dev \
+      pkg-config \
+      curl &&\
+    curl -LO https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb &&\
+    apt-get install -y ./google-chrome-stable_current_amd64.deb &&\
+    apt-get -y clean &&\
+    apt-get autoremove &&\
+    rm -rf /var/lib/apt/lists/* &&\
+    rm google-chrome-stable_current_amd64.deb
+
+COPY --from=build-stage /app /app
+RUN adduser --system --group --home /home/app app && chown app:app /app
+USER app
+EXPOSE 7123
+CMD ["/app/snd"]

android/app/build.gradle.kts

@@ -1,7 +1,6 @@
-plugins {
-    id("com.android.application")
-    id("org.jetbrains.kotlin.android")
-}
+fun requiredEnv(name: String): String =
+    System.getenv(name)
+        ?: error("Missing required environment variable: $name")
 
 android {
     namespace = "app.salesanddungeons"
@@ -20,13 +19,24 @@ android {
         targetCompatibility = JavaVersion.VERSION_17
     }
 
+    signingConfigs {
+        create("release") {
+            storeFile = file(requiredEnv("ANDROID_KEYSTORE_PATH"))
+            storePassword = requiredEnv("ANDROID_KEYSTORE_PASSWORD")
+            keyAlias = requiredEnv("ANDROID_KEY_ALIAS")
+            keyPassword = requiredEnv("ANDROID_KEY_PASSWORD")
+        }
+    }
+
+    buildTypes {
+        getByName("release") {
+            signingConfig = signingConfigs.getByName("release")
+        }
+    }
+
     kotlinOptions {
         jvmTarget = "17"
     }
 
     sourceSets["main"].assets.srcDir("../../frontend/dist")
 }
-
-dependencies {
-    implementation(files("libs/sndmobile.aar"))
-}