Repository navigation
ci(security): the SARIF uploads cannot block while the repo is private #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Unstable | |
| # Unstable / pre-release channel: one rolling pre-release rebuilt on every push to master. | |
| # Unlike EVSwipe and EVLauncher, these builds do NOT self-update — EVChargePilot has no | |
| # network capability at all, in any channel. Installing an unstable build is a manual tap. | |
| on: | |
| push: | |
| branches: [master] | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| jobs: | |
| build: | |
| name: Build and publish unstable APK | |
| runs-on: ubuntu-latest | |
| env: | |
| EV_KEYSTORE_BASE64: ${{ secrets.EV_KEYSTORE_BASE64 }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| fetch-depth: 1 | |
| - uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: "17" | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@v4 | |
| - name: Decode platform keystore | |
| if: ${{ env.EV_KEYSTORE_BASE64 != '' }} | |
| run: | | |
| printf '%s' "$EV_KEYSTORE_BASE64" | tr -d '[:space:]' | base64 -d > "$RUNNER_TEMP/platform.keystore" | |
| if [ "$(head -c1 "$RUNNER_TEMP/platform.keystore" | od -An -tx1 | tr -d ' ')" != "30" ]; then | |
| echo "::error::EV_KEYSTORE_BASE64 is invalid. Recreate the secret with: base64 -w0 platform.keystore" | |
| exit 1 | |
| fi | |
| echo "EV_KEYSTORE=$RUNNER_TEMP/platform.keystore" >> "$GITHUB_ENV" | |
| - name: Run checks | |
| run: | | |
| chmod +x gradlew | |
| bash .github/security/check-permissions.sh | |
| ./gradlew :evhardware:testDebugUnitTest testUnstableDebugUnitTest lintUnstableDebug --no-daemon | |
| - name: Resolve unstable version | |
| id: version | |
| run: | | |
| v=$(./gradlew -q printUnstableVersion -PunstableBuild=${{ github.run_number }} --no-daemon | tail -1) | |
| echo "value=$v" >> "$GITHUB_OUTPUT" | |
| - name: Build unstable release APK | |
| env: | |
| EV_KEYSTORE_PASSWORD: ${{ secrets.EV_KEYSTORE_PASSWORD }} | |
| EV_KEY_ALIAS: ${{ secrets.EV_KEY_ALIAS }} | |
| EV_KEY_PASSWORD: ${{ secrets.EV_KEY_PASSWORD }} | |
| run: | | |
| test -n "${EV_KEYSTORE:-}" | |
| ./gradlew assembleUnstableRelease -PunstableBuild=${{ github.run_number }} --no-daemon | |
| - name: Collect APK | |
| run: | | |
| mkdir -p dist | |
| # The release tag is the fixed string "unstable", so the version lives in the asset | |
| # name — it is the only place a reader can tell two rolling builds apart. | |
| find app/build/outputs/apk/unstable/release -name "*.apk" \ | |
| -exec cp {} "dist/EVChargePilot-unstable-${{ steps.version.outputs.value }}.apk" \; | |
| ls -la dist/ | |
| - name: Build timestamp | |
| id: date | |
| run: echo "value=$(date -u +'%Y-%m-%d %H:%M UTC')" >> "$GITHUB_OUTPUT" | |
| - name: Extract changelog | |
| id: changelog | |
| run: | | |
| { | |
| echo 'notes<<CHANGELOG_EOF' | |
| ./release-notes.sh --latest | |
| echo 'CHANGELOG_EOF' | |
| } >> "$GITHUB_OUTPUT" | |
| # One rolling pre-release: drop the previous release and its tag so the new one is | |
| # published at this commit instead of leaving the tag behind on the old sha. | |
| - name: Reset rolling unstable release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: gh release delete unstable --cleanup-tag --yes || true | |
| - name: Publish pre-release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: unstable | |
| name: Unstable | |
| prerelease: true | |
| files: dist/*.apk | |
| body: | | |
| ## Unstable build ${{ steps.date.outputs.value }} | |
| Version `${{ steps.version.outputs.value }}` (run ${{ github.run_number }}). | |
| Automated build from `master`. **Not tested on a vehicle.** | |
| This channel does not self-update: EVChargePilot declares no network permission | |
| in any channel, so a newer build is always a manual install, parked. | |
| The unstable id is `com.evsuite.chargepilot.unstable`, so it installs beside a | |
| stable build and keeps its own trip history. | |
| ### Changelog | |
| ${{ steps.changelog.outputs.notes }} | |
| Commit: ${{ github.sha }} |