diff --git a/.gitea/workflows/android-release-signed.yml b/.gitea/workflows/android-release-signed.yml new file mode 100644 index 0000000..5cc385b --- /dev/null +++ b/.gitea/workflows/android-release-signed.yml @@ -0,0 +1,140 @@ +name: Android Release (Signed) + +on: + push: + tags: + - 'v*' + +jobs: + release: + runs-on: android + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Java 17 + run: | + export JAVA_HOME=/usr/lib/jvm/java-17-openjdk + export PATH=$JAVA_HOME/bin:$PATH + echo '=== Java 环境 ===' + java -version + + - name: Setup Keystore + run: | + echo '=== 配置签名证书 ===' + mkdir -p app + echo '${{ secrets.KEYSTORE_BASE64 }}' | base64 -d > app/release.keystore + echo '✅ 证书已解压' + ls -lh app/release.keystore + + - name: Build Signed Release APK + env: + KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }} + KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }} + KEY_ALIAS: ${{ secrets.KEY_ALIAS }} + run: | + echo '=== 编译签名 Release APK ===' + export ANDROID_HOME=/opt/android-sdk + export ANDROID_SDK_ROOT=$ANDROID_HOME + export PATH=$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/platform-tools:$PATH + export CUSTOM_AAPT2_PATH=/usr/bin/aapt2 + + # 创建 gradle.properties + cat >> gradle.properties << EOF +android.aapt2FromMavenOverride=$CUSTOM_AAPT2_PATH +org.gradle.daemon=false +org.gradle.jvmargs=-Xmx2g +EOF + + # 创建签名配置 + cat > app/signing-config.gradle << 'EOF' +android { + signingConfigs { + release { + storeFile file('release.keystore') + storePassword System.getenv('KEYSTORE_PASSWORD') + keyAlias System.getenv('KEY_ALIAS') + keyPassword System.getenv('KEY_PASSWORD') + v1SigningEnabled true + v2SigningEnabled true + } + } + buildTypes { + release { + signingConfig signingConfigs.release + minifyEnabled false + shrinkResources false + } + } +} +EOF + + # 在 app/build.gradle 中应用签名配置(如果还没有) + if ! grep -q 'signing-config.gradle' app/build.gradle; then + sed -i '1i apply from: '"'"'signing-config.gradle'"'"'' app/build.gradle + fi + + echo '开始编译...' + gradle assembleRelease --no-daemon --stacktrace + + # 重命名 APK + VERSION=${GITHUB_REF#refs/tags/} + cp app/build/outputs/apk/release/app-release.apk app/build/outputs/apk/release/app-${VERSION}-signed.apk + echo 'APK_NAME=app-'"${VERSION}"'-signed.apk' >> $GITHUB_ENV + + echo '' + echo '✅ 编译完成!' + ls -lh app/build/outputs/apk/release/ + + - name: Create Gitea Release + id: create_release + run: | + echo '=== 创建 Gitea Release ===' + VERSION=${GITHUB_REF#refs/tags/} + + RESPONSE=$(curl -s -X POST \ + 'https://gitea.kg8.net/api/v1/repos/${{ github.repository }}/releases' \ + -H 'Authorization: token ${{ secrets.ACTIONS_TOKEN }}' \ + -H 'Content-Type: application/json' \ + -d "{ + \\\"tag_name\\\": \\\"$VERSION\\\", + \\\"name\\\": \\\"Release $VERSION\\\", + \\\"body\\\": \\\"## 自动发布的签名版本\\n\\n- ✅ 已签名,可安装到真机\\n- 🔐 使用开发者证书签名\\n- 🚀 自动编译\\\", + \\\"draft\\\": false, + \\\"prerelease\\\": false + }") + + UPLOAD_URL=$(echo "$RESPONSE" | grep -o '"upload_url":"[^"]*' | cut -d'"' -f4) + + if [ -n "$UPLOAD_URL" ]; then + echo "UPLOAD_URL=$UPLOAD_URL" >> $GITHUB_ENV + echo '✅ Release 创建成功' + else + echo '❌ 创建 Release 失败' + echo "响应:$RESPONSE" + exit 1 + fi + + - name: Upload Signed APK + run: | + echo '=== 上传签名 APK ===' + echo 'APK: ${{ env.APK_NAME }}' + echo 'Upload URL: ${{ env.UPLOAD_URL }}' + + curl -s -X POST '${{ env.UPLOAD_URL }}?name=${{ env.APK_NAME }}' \ + -H 'Authorization: token ${{ secrets.ACTIONS_TOKEN }}' \ + -H 'Content-Type: application/vnd.android.package-archive' \ + --data-binary '@app/build/outputs/apk/release/${{ env.APK_NAME }}' + + echo '' + echo '✅ APK 上传成功!' + + - name: Verify Signature + run: | + echo '=== 验证 APK 签名 ===' + $ANDROID_HOME/build-tools/34.0.0/apksigner verify --print-certs \ + app/build/outputs/apk/release/${{ env.APK_NAME }} + + echo '' + echo '✅ 签名验证通过!此 APK 可以安装到真机。'