chore(deps): bump actions/download-artifact from 6.0.0 to 8.0.1 #129
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Capacitor | |
| on: | |
| pull_request: | |
| paths: | |
| # Native shell only wraps the web app; web/server-only changes do not alter the APK. | |
| - ".github/workflows/capacitor.yml" | |
| - "android/**" | |
| - "ios/**" | |
| - "native_www/**" | |
| - "capacitor.config.ts" | |
| - "scripts/prepare-native-web.mjs" | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - "v*.*.*" | |
| paths: | |
| # Tags still run because GitHub does not evaluate path filters for tag pushes. | |
| - ".github/workflows/capacitor.yml" | |
| - "android/**" | |
| - "ios/**" | |
| - "native_www/**" | |
| - "capacitor.config.ts" | |
| - "scripts/prepare-native-web.mjs" | |
| workflow_dispatch: | |
| # Read-only by default so PR-triggered runs never get a write-scoped token. | |
| # Only the tag-gated release job below is granted contents: write. | |
| permissions: | |
| contents: read | |
| jobs: | |
| android: | |
| name: Build Android APK | |
| runs-on: ubuntu-latest | |
| env: | |
| MISE_ENABLE_TOOLS: android-sdk,aube,java,node | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up mise tools | |
| uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4 | |
| with: | |
| install: true | |
| install_args: android-sdk aube java node | |
| cache: true | |
| - name: Install Android SDK packages | |
| run: mise run setup:android-sdk | |
| - name: Install JavaScript dependencies | |
| run: mise exec -- aube install --frozen-lockfile | |
| - name: Resolve app version | |
| shell: bash | |
| run: | | |
| base_version=$(node -e "const fs = require('fs'); const source = fs.readFileSync('mix.exs', 'utf8'); const match = source.match(/version:\\s*\"([0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][^\"]+)?)\"/); if (!match) process.exit(1); process.stdout.write(match[1]);") | |
| artifact_version="${base_version}-${GITHUB_SHA::7}" | |
| if [[ "${GITHUB_REF_TYPE}" == "tag" && "${GITHUB_REF_NAME}" == v* ]]; then | |
| base_version="${GITHUB_REF_NAME#v}" | |
| artifact_version="${base_version}" | |
| fi | |
| echo "MANAVAULT_VERSION=${base_version}" >> "$GITHUB_ENV" | |
| echo "MANAVAULT_RELEASE_REPOSITORY=${GITHUB_REPOSITORY}" >> "$GITHUB_ENV" | |
| echo "ARTIFACT_VERSION=${artifact_version}" >> "$GITHUB_ENV" | |
| - name: Restore Android release keystore | |
| if: github.ref_type == 'tag' | |
| shell: bash | |
| env: | |
| MANAVAULT_ANDROID_KEYSTORE_BASE64: ${{ secrets.MANAVAULT_ANDROID_KEYSTORE_BASE64 }} | |
| run: | | |
| if [[ -z "${MANAVAULT_ANDROID_KEYSTORE_BASE64}" ]]; then | |
| echo "Missing MANAVAULT_ANDROID_KEYSTORE_BASE64 secret. Run: mise exec -- aube run android:signing:setup" >&2 | |
| exit 1 | |
| fi | |
| mkdir -p android/release | |
| printf '%s' "${MANAVAULT_ANDROID_KEYSTORE_BASE64}" | base64 --decode > android/release/manavault-release.jks | |
| echo "MANAVAULT_ANDROID_KEYSTORE=${GITHUB_WORKSPACE}/android/release/manavault-release.jks" >> "$GITHUB_ENV" | |
| - name: Validate Android release keystore | |
| if: github.ref_type == 'tag' | |
| shell: bash | |
| env: | |
| MANAVAULT_ANDROID_KEYSTORE_PASSWORD: ${{ secrets.MANAVAULT_ANDROID_KEYSTORE_PASSWORD }} | |
| MANAVAULT_ANDROID_KEY_ALIAS: ${{ secrets.MANAVAULT_ANDROID_KEY_ALIAS }} | |
| run: | | |
| # -storepass:env reads the password from the env var by name, so the | |
| # secret never appears in the runner's process table (unlike -storepass). | |
| keytool -list \ | |
| -keystore "${MANAVAULT_ANDROID_KEYSTORE}" \ | |
| -alias "${MANAVAULT_ANDROID_KEY_ALIAS}" \ | |
| -storepass:env MANAVAULT_ANDROID_KEYSTORE_PASSWORD \ | |
| -v | |
| - name: Build release APK | |
| if: github.ref_type == 'tag' | |
| env: | |
| MANAVAULT_ANDROID_KEYSTORE_PASSWORD: ${{ secrets.MANAVAULT_ANDROID_KEYSTORE_PASSWORD }} | |
| MANAVAULT_ANDROID_KEY_ALIAS: ${{ secrets.MANAVAULT_ANDROID_KEY_ALIAS }} | |
| MANAVAULT_ANDROID_KEY_PASSWORD: ${{ secrets.MANAVAULT_ANDROID_KEYSTORE_PASSWORD }} | |
| run: mise exec -- aube run android:build:release | |
| - name: Build debug APK | |
| if: github.ref_type != 'tag' | |
| run: mise exec -- aube run android:build:debug | |
| - name: Stage APK | |
| shell: bash | |
| run: | | |
| mkdir -p dist/native | |
| if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then | |
| cp android/app/build/outputs/apk/release/app-release.apk "dist/native/manavault-${ARTIFACT_VERSION}-release.apk" | |
| else | |
| cp android/app/build/outputs/apk/debug/app-debug.apk "dist/native/manavault-${ARTIFACT_VERSION}-debug.apk" | |
| fi | |
| - name: Upload APK artifact | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 | |
| with: | |
| name: manavault-${{ env.ARTIFACT_VERSION }}-${{ github.ref_type == 'tag' && 'release' || 'debug' }}-apk | |
| path: dist/native/*.apk | |
| if-no-files-found: error | |
| # Separate, tag-only job holds the contents: write token so PR/branch builds | |
| # (which only build and upload the artifact) run read-only. | |
| release: | |
| name: Attach APK to release | |
| needs: android | |
| if: github.ref_type == 'tag' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Download APK artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: dist/native | |
| - name: Attach APK to GitHub release | |
| uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3 | |
| with: | |
| generate_release_notes: true | |
| files: dist/native/**/*.apk |