upstream-dgca-verifier-app-android.yml

# Sourced from https://github.com/eu-digital-green-certificates/dgca-verifier-app-android/blob/d312c29132477faeb2a2b69d4adb4b1bab533a81/.github/workflows/ci.yml

# Copyright (C) 2021 T-Systems International GmbH and all other contributors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: "Upstream: dgca-verifier-app-android"

on:
  pull_request:
    branches:
      - 'main'
    paths:
      - 'upstream/dgca-verifier-app-android'
      - 'upstream/patches/dgca-verifier-app-android/**'
      - '.github/workflows/upstream-dgca-verifier-app-android.yml'
  push:
    branches:
      - main
    paths:
      - 'upstream/dgca-verifier-app-android'
      - 'upstream/patches/dgca-verifier-app-android/**'
      - '.github/workflows/upstream-dgca-verifier-app-android.yml'

jobs:
  build:
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/setup-java@v2
        with:
          java-version: 8
          distribution: adopt
      - uses: actions/checkout@v2
        with:
          submodules: true
          fetch-depth: 0
      - name: patch-app
        working-directory: ./upstream/dgca-verifier-app-android
        run: >-
          for f in ../patches/dgca-verifier-app-android/*.patch; do
          patch -p1 < $f;
          done;
      - name: patch-core
        working-directory: ./upstream/dgca-app-core-android
        run: >-
          for f in ../patches/dgca-app-core-android/*.patch; do
          patch -p1 < $f;
          done;
      - uses: android-actions/setup-android@v2
      - uses: actions/cache@v2
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
      - name: build
        working-directory: ./upstream/dgca-verifier-app-android
        run: |-
          ./gradlew --no-daemon build -PCONFIG_FILE_NAME="verifier-context.jsonc"
      - name: Archive ACC Release APK
        uses: actions/upload-artifact@v2
        with:
          name: app-acc-release-unsigned
          path: |
            ./upstream/dgca-verifier-app-android/app/build/outputs/apk/acc/release/app-acc-release-unsigned.apk
          retention-days: 1
      - name: Archive ACC Debug APK
        uses: actions/upload-artifact@v2
        with:
          name: app-acc-debug-unsigned
          path: |
            ./upstream/dgca-verifier-app-android/app/build/outputs/apk/acc/debug/app-acc-debug.apk
          retention-days: 1
  sign:
    if: ${{ github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-20.04
    needs: build
    steps:
      - name: Download ACC Release APK
        uses: actions/download-artifact@v2
        with:
          name: app-acc-release-unsigned
      - name: Download ACC Debug APK
        uses: actions/download-artifact@v2
        with:
          name: app-acc-debug-unsigned
      - name: sign-acc-release
        run: |-
          echo "${KEY_STORE_BASE64}" | base64 --decode > ./key.jks
          ZIPALIGN=${ANDROID_HOME}/build-tools/${BUILD_TOOLS_VERSION}/zipalign
          APKSIGNER=${ANDROID_HOME}/build-tools/${BUILD_TOOLS_VERSION}/apksigner
          ${ZIPALIGN} -c -v 4 app-acc-release-unsigned.apk
          ${APKSIGNER} sign \
          --ks ./key.jks \
          --ks-pass pass:${KEY_STORE_PASSWORD} \
          --ks-key-alias ${KEY_ALIAS} \
          --out app-acc-release-signed.apk \
          app-acc-release-unsigned.apk
          ${APKSIGNER} verify app-acc-release-signed.apk
        env:
          BUILD_TOOLS_VERSION: 29.0.3
          KEY_ALIAS: ${{ secrets.DEV_ANDROID_SIGNING_KEY_ALIAS }}
          KEY_STORE_BASE64: ${{ secrets.DEV_ANDROID_SIGNING_KEY }}
          KEY_STORE_PASSWORD: ${{ secrets.DEV_ANDROID_SIGNING_KEY_PASSWORD }}
      - name: sign-acc-debug
        run: |-
          echo "${KEY_STORE_BASE64}" | base64 --decode > ./key.jks
          ZIPALIGN=${ANDROID_HOME}/build-tools/${BUILD_TOOLS_VERSION}/zipalign
          APKSIGNER=${ANDROID_HOME}/build-tools/${BUILD_TOOLS_VERSION}/apksigner
          ${ZIPALIGN} -c -v 4 app-acc-debug.apk
          ${APKSIGNER} sign \
          --ks ./key.jks \
          --ks-pass pass:${KEY_STORE_PASSWORD} \
          --ks-key-alias ${KEY_ALIAS} \
          --out app-acc-debug-signed.apk \
          app-acc-debug.apk
          ${APKSIGNER} verify app-acc-debug-signed.apk
        env:
          BUILD_TOOLS_VERSION: 29.0.3
          KEY_ALIAS: ${{ secrets.DEV_ANDROID_SIGNING_KEY_ALIAS }}
          KEY_STORE_BASE64: ${{ secrets.DEV_ANDROID_SIGNING_KEY }}
          KEY_STORE_PASSWORD: ${{ secrets.DEV_ANDROID_SIGNING_KEY_PASSWORD }}
      - name: Archive ACC Release APK
        uses: actions/upload-artifact@v2
        with:
          name: app-acc-release-signed
          path: |
            app-acc-release-signed.apk
      - name: Archive ACC Debug APK
        uses: actions/upload-artifact@v2
        with:
          name: app-acc-debug-signed
          path: |
            app-acc-debug-signed.apk