|
| 1 | +name: Test build |
| 2 | + |
| 3 | +# Build de test signé par la clé plateforme, SANS publication dans les Releases. |
| 4 | +# Les APK sortent en artifacts du run (onglet Actions → run → section Artifacts). |
| 5 | +# L'OTA interroge /releases/latest, qui ignore artifacts, drafts et prereleases : |
| 6 | +# ce workflow ne peut donc PAS perturber les mises à jour des utilisateurs. |
| 7 | +on: |
| 8 | + workflow_dispatch: |
| 9 | + inputs: |
| 10 | + variant: |
| 11 | + description: "Variante à construire" |
| 12 | + type: choice |
| 13 | + options: [both, online, offline] |
| 14 | + default: both |
| 15 | + build_type: |
| 16 | + description: "Type de build" |
| 17 | + type: choice |
| 18 | + options: [release, debug] |
| 19 | + default: release |
| 20 | + |
| 21 | +permissions: |
| 22 | + contents: read |
| 23 | + |
| 24 | +jobs: |
| 25 | + build: |
| 26 | + runs-on: ubuntu-latest |
| 27 | + env: |
| 28 | + MG4_KEYSTORE_BASE64: ${{ secrets.MG4_KEYSTORE_BASE64 }} |
| 29 | + steps: |
| 30 | + - uses: actions/checkout@v4 |
| 31 | + |
| 32 | + - uses: actions/setup-java@v4 |
| 33 | + with: |
| 34 | + distribution: temurin |
| 35 | + java-version: "17" |
| 36 | + |
| 37 | + - name: Setup Gradle |
| 38 | + uses: gradle/actions/setup-gradle@v4 |
| 39 | + |
| 40 | + - name: Decode platform keystore |
| 41 | + if: ${{ env.MG4_KEYSTORE_BASE64 != '' }} |
| 42 | + run: | |
| 43 | + printf '%s' "$MG4_KEYSTORE_BASE64" | tr -d '[:space:]' | base64 -d > "$RUNNER_TEMP/platform.keystore" |
| 44 | + if [ "$(head -c1 "$RUNNER_TEMP/platform.keystore" | od -An -tx1 | tr -d ' ')" != "30" ]; then |
| 45 | + echo "::error::MG4_KEYSTORE_BASE64 est invalide. Recréer le secret avec : base64 -w0 platform.keystore" |
| 46 | + exit 1 |
| 47 | + fi |
| 48 | + echo "MG4_KEYSTORE=$RUNNER_TEMP/platform.keystore" >> "$GITHUB_ENV" |
| 49 | +
|
| 50 | + - name: Build APK(s) |
| 51 | + env: |
| 52 | + MG4_KEYSTORE_PASSWORD: ${{ secrets.MG4_KEYSTORE_PASSWORD }} |
| 53 | + MG4_KEY_ALIAS: ${{ secrets.MG4_KEY_ALIAS }} |
| 54 | + MG4_KEY_PASSWORD: ${{ secrets.MG4_KEY_PASSWORD }} |
| 55 | + run: | |
| 56 | + chmod +x gradlew |
| 57 | + # "release" → assembleOnlineRelease ; "debug" → assembleOnlineDebug |
| 58 | + case "${{ inputs.build_type }}" in |
| 59 | + release) SUFFIX="Release" ;; |
| 60 | + debug) SUFFIX="Debug" ;; |
| 61 | + esac |
| 62 | + case "${{ inputs.variant }}" in |
| 63 | + both) TASKS="assembleOnline$SUFFIX assembleOffline$SUFFIX" ;; |
| 64 | + online) TASKS="assembleOnline$SUFFIX" ;; |
| 65 | + offline) TASKS="assembleOffline$SUFFIX" ;; |
| 66 | + esac |
| 67 | + echo "Tâches : $TASKS" |
| 68 | + ./gradlew $TASKS --no-daemon |
| 69 | +
|
| 70 | + - name: Collect APKs |
| 71 | + run: | |
| 72 | + mkdir -p dist |
| 73 | + find app/build/outputs/apk -name "*.apk" -exec cp {} dist/ \; |
| 74 | + ls -la dist/ |
| 75 | +
|
| 76 | + # Affiche les schémas de signature réellement posés (v1 / v2 / v3) et l'empreinte du |
| 77 | + # certificat. Permet de contrôler ce que produit VRAIMENT la CI, sans installer l'APK. |
| 78 | + - name: Signature report |
| 79 | + run: | |
| 80 | + APKSIGNER=$(ls "$ANDROID_SDK_ROOT"/build-tools/*/apksigner | sort -V | tail -1) |
| 81 | + echo "apksigner : $APKSIGNER" |
| 82 | + for f in dist/*.apk; do |
| 83 | + echo "── $(basename "$f") ──" |
| 84 | + "$APKSIGNER" verify --print-certs -v "$f" 2>&1 \ |
| 85 | + | grep -E 'Verified using v[0-9]|certificate SHA-256 digest' || echo " (non vérifiable)" |
| 86 | + echo |
| 87 | + done |
| 88 | +
|
| 89 | + - name: Upload APKs (artifacts, PAS une release) |
| 90 | + uses: actions/upload-artifact@v4 |
| 91 | + with: |
| 92 | + name: mg4control-test-${{ inputs.variant }}-${{ inputs.build_type }}-${{ github.run_number }} |
| 93 | + path: dist/*.apk |
| 94 | + retention-days: 14 |
| 95 | + if-no-files-found: error |
0 commit comments