forked from kiwibrowser/src.next
-
Notifications
You must be signed in to change notification settings - Fork 0
380 lines (309 loc) · 19.8 KB
/
build_and_sign_release_apk.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
# Build APKs for Kiwi Browser Next
name: 'Kiwi: Build and sign release apk'
# Controls when the action will run. Triggers the workflow on push or pull request events
on:
workflow_dispatch:
inputs:
prepareRelease:
description: 'Create a draft release in Google Play Store'
required: true
default: 'no'
announceOnMessengers:
description: 'Announce new release on Discord and Telegram channels'
required: true
default: 'yes'
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
build:
# The type of runner that the job will run on
runs-on: ubuntu-latest
strategy:
fail-fast: false
max-parallel: 4
matrix:
platform: [arm, arm64, x86, x64]
# The GitHub Actions machines have a "slow disk", and a SSD "fast" disk.
# However, there is not enough space to do all the processing on the SSD.
# We refer to the disks based on their name in /dev/disk
# /dev/disk/azure/root-part1 is / ("slow disk")
# /dev/disk/azure/resource-part1 is a 14 GB ephemeral SSD disk mounted in /mnt
# We store the source-code repository (kiwibrowser/src) on /dev/disk/azure/root-part1
# We store cache, dependencies and output on /dev/disk/azure/resource-part1 (SSD)
# Steps represent a sequence of tasks that will be executed as part of the job
steps:
- name: Initializing build
run: echo Initializing build for platform ${{ matrix.platform }}
- name: Updating APT repository
run: sudo apt-get update
- name: Installing rclone
run: sudo -v ; wget https://downloads.rclone.org/v1.63.1/rclone-v1.63.1-linux-amd64.deb && sudo dpkg -i rclone-v1.63.1-linux-amd64.deb
- name: Installing Python and OpenJDK
run: sudo apt-get install -y 2to3 python2-minimal python2 dh-python python-is-python3 openjdk-8-jdk-headless libncurses5 ccache jq
- name: Reclaiming disk space on / by disabling swap partition
run: |
sudo swapoff -av
sudo rm -f /swapfile
- name: Reclaiming disk space on / by removing .NET framework
run: sudo rm -rf /usr/share/dotnet
- name: Checking-out source-code in $GITHUB_WORKSPACE
uses: actions/checkout@v2
- name: Creating secondary disk folder on /dev/disk/azure/resource-part1 (SSD)
run: |
sudo mkdir -p /extended_data
sudo chown -R runner:docker /extended_data
# If you want to use only the SSD, you can use:
- name: On SSD - Creating symlink on /dev/disk/azure/root-part1 pointing to /dev/disk/azure/resource-part1
run: |
sudo ln -s /extended_data /mnt/secondary_disk
sudo ln -s /mnt/secondary_disk $GITHUB_WORKSPACE/
# or alternatively, to work on the main partition
# - name: On HDD - Creating symlink on /dev/disk/azure/root-part1 pointing to /dev/disk/azure/resource-part1
# run: |
# sudo ln -s /extended_data /mnt/secondary_disk
# sudo ln -s /mnt/secondary_disk $GITHUB_WORKSPACE/
# We cannot checkout outside of $GITHUB_WORKSPACE, but we want to checkout to the SSD
- name: Creating output folder
run: mkdir -p secondary_disk/out/android_${{ matrix.platform }}
- name: Generating one-time APK signature key
run: keytool -genkey -v -keystore keystore.jks -alias dev -keyalg RSA -keysize 2048 -validity 10000 -storepass public_password -keypass public_password -dname "cn=Kiwi Browser (unverified), ou=Actions, o=Kiwi Browser, c=GitHub"
- name: Copying args.gn to target folder
run: cat .build/android_arm/args.gn | sed "s#target_cpu = \"arm\"#target_cpu = \"${{ matrix.platform }}\"#" | sed "s#android_default_version_name = \"Git\"#android_default_version_name = \"Git$(date '+%y%m%d')Gen${{ github.run_id }}\"#" > secondary_disk/out/android_${{ matrix.platform }}/args.gn
- name: Creating rclone config
run: |
mkdir -p $HOME/.config/rclone/
echo '[cache]' > $HOME/.config/rclone/rclone.conf
echo 'type = sftp' >> $HOME/.config/rclone/rclone.conf
echo 'host = ${{ secrets.STORAGE_HOST }}' >> $HOME/.config/rclone/rclone.conf
echo 'user = storage' >> $HOME/.config/rclone/rclone.conf
echo 'key_pem = ${{ secrets.STORAGE_KEY }}' >> $HOME/.config/rclone/rclone.conf
- name: Modifying args.gn (arm)
if: matrix.platform == 'arm'
run: sed -i "s#android_default_version_code = \"1\"#android_default_version_code = \"$(date '+%y%m%d')1\"#" secondary_disk/out/android_${{ matrix.platform }}/args.gn
- name: Modifying args.gn (arm64)
if: matrix.platform == 'arm64'
run: sed -i "s#android_default_version_code = \"1\"#android_default_version_code = \"$(date '+%y%m%d')2\"#" secondary_disk/out/android_${{ matrix.platform }}/args.gn
- name: Modifying args.gn (x86)
if: matrix.platform == 'x86'
run: sed -i "s#android_default_version_code = \"1\"#android_default_version_code = \"$(date '+%y%m%d')3\"#" secondary_disk/out/android_${{ matrix.platform }}/args.gn
- name: Modifying args.gn (x64)
if: matrix.platform == 'x64'
run: sed -i "s#android_default_version_code = \"1\"#android_default_version_code = \"$(date '+%y%m%d')4\"#" secondary_disk/out/android_${{ matrix.platform }}/args.gn
- name: Displaying args.gn
run: cat secondary_disk/out/android_${{ matrix.platform }}/args.gn
- name: Checking available disk-space
run: df -h
- name: Uploading args.gn
run: rclone copy --fast-list --transfers=128 --retries=10 secondary_disk/out/android_${{ matrix.platform }}/args.gn cache:kiwibrowser-next-builds-${{ matrix.platform }}/
- name: Calling buildbot
if: false
run: curl ipinfo.io
- name: Downloading binary objects cache to $HOME/cache
run: rclone copy --fast-list --transfers=128 --retries=10 cache:kiwibrowser-next-builds-${{ matrix.platform }}/ $HOME/kiwibrowser-next-builds-${{ matrix.platform }}
- name: Transferring build to the standard Kiwi Browser run ID
run: rclone copy --fast-list --transfers=128 --retries=10 cache:kiwibrowser-next-builds-${{ matrix.platform }}/ cache:kiwibrowser-builds/${{ github.run_id }}/${{ matrix.platform }}
- name: Listing files
run: |
echo $HOME
ls -la $HOME/kiwibrowser-next-builds-${{ matrix.platform }}
- name: Uploading APK
uses: actions/upload-artifact@v1
with:
name: apk-${{ matrix.platform }}
path: /home/runner/kiwibrowser-next-builds-${{ matrix.platform }}/
sign_and_upload:
runs-on: ubuntu-latest
needs: build
steps:
- name: Installing rclone
run: curl --http1.1 https://rclone.org/install.sh | sudo bash
- name: Creating rclone config
run: |
mkdir -p $HOME/.config/rclone/
echo '[cache]' > $HOME/.config/rclone/rclone.conf
echo 'type = sftp' >> $HOME/.config/rclone/rclone.conf
echo 'host = ${{ secrets.STORAGE_HOST }}' >> $HOME/.config/rclone/rclone.conf
echo 'user = storage' >> $HOME/.config/rclone/rclone.conf
echo 'key_pem = ${{ secrets.STORAGE_KEY }}' >> $HOME/.config/rclone/rclone.conf
- name: Downloading artifact (arm)
uses: actions/download-artifact@v1
with:
name: apk-arm
- name: Downloading artifact (arm64)
uses: actions/download-artifact@v1
with:
name: apk-arm64
- name: Downloading artifact (x86)
uses: actions/download-artifact@v1
with:
name: apk-x86
- name: Downloading artifact (x64)
uses: actions/download-artifact@v1
with:
name: apk-x64
- name: Prepare release notes
run: |
cat ./apk-arm/last_commits.txt > release_notes.txt
cat <<EOT >> release_notes.txt
This version will replace your currently installed Kiwi Browser (com.kiwibrowser.browser).
If you have important data, make sure to backup them or save them before upgrading to this version.
This release was automatically generated from GitHub ${{ github.ref }} in run ID ${{ github.run_id }}.
Summary:
- To install / update Kiwi Browser, use "com.kiwibrowser.browser-arm64-${{ github.run_id }}-github.apk".
If it doesn't work, try again using "com.kiwibrowser.browser-arm64-${{ github.run_id }}-playstore.apk" (if it exists).
Detailed information about the different files:
- ".map" files are files that developers can use to investigate crashes (ProGuard mapping files), these files are not needed to run the browser and are for developers only.
- ".apk" files are packages that you have to install to use Kiwi Browser.
The filenames are in the form "[PACKAGE_NAME]-[ARCHITECTURE]-[BUILD_VERSION]-[SIGNATURE_TYPE].apk"
If you want to keep the Play Store version installed, and still try the GitHub edition then you can install the APKs starting with "com.kiwibrowser.browser.dev" (you will keep all your Play Store bookmarks, settings and passwords, and the GitHub edition will be installed separately).
Build version:
- Everytime a change is introduced in Kiwi Browser, a new build version is generated.
Architecture:
- "-arm64" is compatible with modern devices and offers the best performance.
- "-arm" is compatible with almost all devices and uses less memory.
- "-x86" and "-x64" builds are compatible with emulators and Intel compatible tablets.
Signature type:
- On Android, applications have to be signed by a developer before they can be installed.
Kiwi has two types of builds:
Signed by the developer:
- "-github.apk" are builds signed using the official developer key.
A signed build is a build that comes straight from the GitHub official repository and is always the most updated.
Play Certified by Google:
- Once in a while, we send a "-github.apk" build to be reviewed and signed by Google.
Google reviews the application, checks that the application is not malicious, adds the "Google Play Certified" badge, signs the file and this becomes "-playstore.apk".
We then distribute "-playstore.apk" on Google Play, XDA-Developers, Samsung and other app stores.
This process takes some time and is partially manual so not all GitHub builds have a "-playstore.apk".
On Android, you can install an update to an application only if it was signed by the same developer as the version that you currently have installed:
- You can install a "-github.apk" build on top of a "-github.apk" build, and a "-playstore.apk" build on top of a "-playstore.apk" build.
- You cannot install a "-playstore.apk" build on top of a "-github.apk" build.
Essentially, if you downloaded Kiwi from an app store, you need to use the "-playstore.apk" files or uninstall the version of Kiwi you have and start using the "-github.apk" version.
EOT
- name: Creating release
id: create_release
uses: actions/create-release@v1.1.4
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
owner: "kiwibrowser"
repo: "src.next"
tag_name: ${{ github.run_id }}
release_name: Generation ${{ github.run_id }}
draft: false
prerelease: true
body_path: release_notes.txt
- name: Signing and uploading release to GitHub and send to the Play Store
if: ${{ github.repository_owner == 'kiwibrowser' && contains(github.event.inputs.prepareRelease, 'yes') }}
run: |
curl 'https://${{ secrets.RELEASE_HOST }}/?run_id=${{ github.run_id }}&dk=${{ secrets.DEPLOY_KEY }}&publish=1&target=aab'
- name: Downloading artifacts from storage
if: ${{ github.repository_owner == 'kiwibrowser' }}
run: |
rclone copy --fast-list --transfers=128 --retries=100 cache:kiwibrowser-builds/${{ github.run_id }}/arm/ ./apk-arm
rclone copy --fast-list --transfers=128 --retries=100 cache:kiwibrowser-builds/${{ github.run_id }}/arm64/ ./apk-arm64
rclone copy --fast-list --transfers=128 --retries=100 cache:kiwibrowser-builds/${{ github.run_id }}/x86/ ./apk-x86
rclone copy --fast-list --transfers=128 --retries=100 cache:kiwibrowser-builds/${{ github.run_id }}/x64/ ./apk-x64
- name: Uploading release asset (arm-signed)
if: ${{ github.repository_owner == 'kiwibrowser' }}
uses: actions/upload-release-asset@v1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
upload_url: ${{ steps.create_release.outputs.upload_url }}
asset_path: ./apk-arm/ChromePublic-DevSigned.apk
asset_name: com.kiwibrowser.browser-arm-${{ github.run_id }}-github.apk
asset_content_type: application/vnd.android.package-archive
- name: Uploading release asset (arm64-signed)
if: ${{ github.repository_owner == 'kiwibrowser' }}
uses: actions/upload-release-asset@v1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
upload_url: ${{ steps.create_release.outputs.upload_url }}
asset_path: ./apk-arm64/ChromePublic-DevSigned.apk
asset_name: com.kiwibrowser.browser-arm64-${{ github.run_id }}-github.apk
asset_content_type: application/vnd.android.package-archive
- name: Uploading release asset (x86-signed)
if: ${{ github.repository_owner == 'kiwibrowser' }}
uses: actions/upload-release-asset@v1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
upload_url: ${{ steps.create_release.outputs.upload_url }}
asset_path: ./apk-x86/ChromePublic-DevSigned.apk
asset_name: com.kiwibrowser.browser-x86-${{ github.run_id }}-github.apk
asset_content_type: application/vnd.android.package-archive
- name: Uploading release asset (x64-signed)
if: ${{ github.repository_owner == 'kiwibrowser' }}
uses: actions/upload-release-asset@v1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
upload_url: ${{ steps.create_release.outputs.upload_url }}
asset_path: ./apk-x64/ChromePublic-DevSigned.apk
asset_name: com.kiwibrowser.browser-x64-${{ github.run_id }}-github.apk
asset_content_type: application/vnd.android.package-archive
- name: Uploading dev asset (arm-signed)
if: ${{ github.repository_owner == 'kiwibrowser' }}
uses: actions/upload-release-asset@v1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
upload_url: ${{ steps.create_release.outputs.upload_url }}
asset_path: ./apk-arm/ChromePublic-Next-DevSigned.apk
asset_name: com.kiwibrowser.browser.dev-arm-${{ github.run_id }}-github.apk
asset_content_type: application/vnd.android.package-archive
- name: Uploading dev asset (arm64-signed)
if: ${{ github.repository_owner == 'kiwibrowser' }}
uses: actions/upload-release-asset@v1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
upload_url: ${{ steps.create_release.outputs.upload_url }}
asset_path: ./apk-arm64/ChromePublic-Next-DevSigned.apk
asset_name: com.kiwibrowser.browser.dev-arm64-${{ github.run_id }}-github.apk
asset_content_type: application/vnd.android.package-archive
- name: Uploading dev asset (x86-signed)
if: ${{ github.repository_owner == 'kiwibrowser' }}
uses: actions/upload-release-asset@v1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
upload_url: ${{ steps.create_release.outputs.upload_url }}
asset_path: ./apk-x86/ChromePublic-Next-DevSigned.apk
asset_name: com.kiwibrowser.browser.dev-x86-${{ github.run_id }}-github.apk
asset_content_type: application/vnd.android.package-archive
- name: Uploading dev asset (x64-signed)
if: ${{ github.repository_owner == 'kiwibrowser' }}
uses: actions/upload-release-asset@v1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
upload_url: ${{ steps.create_release.outputs.upload_url }}
asset_path: ./apk-x64/ChromePublic-Next-DevSigned.apk
asset_name: com.kiwibrowser.browser.dev-x64-${{ github.run_id }}-github.apk
asset_content_type: application/vnd.android.package-archive
- name: Send announcement on Discord
continue-on-error: true
if: contains(github.event.inputs.announceOnMessengers, 'yes')
run: |
echo "" > commit_message.txt
echo "" >> commit_message.txt
cat ./apk-arm/last_commits.txt >> commit_message.txt
echo "" >> commit_message.txt
COMMIT_MSG=$(<./commit_message.txt)
PAYLOAD=$(jq -n \
--arg username "Kiwi Builder (Next)" \
--arg content "A new build of Kiwi Browser Next (preview version) is available. This version will replace your currently installed Kiwi Browser (com.kiwibrowser.browser) <@&913196471787065344> - https://github.com/kiwibrowser/src.next/releases/tag/${{ github.run_id }} $COMMIT_MSG" \
'{username: $username, content: $content}')
curl -H 'Content-Type: application/json' -X POST -d "$PAYLOAD" ${{ secrets.DISCORD_WEBHOOK }}
- name: Send announcement on Telegram
continue-on-error: true
if: contains(github.event.inputs.announceOnMessengers, 'yes')
run: |
COMMIT_MSG=$(<./commit_message.txt)
PAYLOAD=$(jq -n \
--arg text "A new build of Kiwi Browser Next (preview version) is available. Link: [${{ github.run_id }}](https://github.com/kiwibrowser/src.next/releases/tag/${{ github.run_id }}) $COMMIT_MSG" \
--arg chat_id "@kiwibrowserbuilds" \
--arg parse_mode "markdown" \
--argjson reply_markup '{"inline_keyboard": [[{"text": "x86", "url": "https://github.com/kiwibrowser/src.next/releases/download/${{ github.run_id }}/com.kiwibrowser.browser-x86-${{ github.run_id }}-github.apk"},{"text": "x64", "url": "https://github.com/kiwibrowser/src.next/releases/download/${{ github.run_id }}/com.kiwibrowser.browser-x64-${{ github.run_id }}-github.apk"}],[{"text": "arm", "url": "https://github.com/kiwibrowser/src.next/releases/download/${{ github.run_id }}/com.kiwibrowser.browser-arm-${{ github.run_id }}-github.apk"},{"text": "arm64", "url": "https://github.com/kiwibrowser/src.next/releases/download/${{ github.run_id }}/com.kiwibrowser.browser-arm64-${{ github.run_id }}-github.apk"}],[{"text": ".DEV x86", "url": "https://github.com/kiwibrowser/src.next/releases/download/${{ github.run_id }}/com.kiwibrowser.browser.dev-x86-${{ github.run_id }}-github.apk"},{"text": ".DEV x64", "url": "https://github.com/kiwibrowser/src.next/releases/download/${{ github.run_id }}/com.kiwibrowser.browser.dev-x64-${{ github.run_id }}-github.apk"}],[{"text": ".DEV arm", "url": "https://github.com/kiwibrowser/src.next/releases/download/${{ github.run_id }}/com.kiwibrowser.browser.dev-arm-${{ github.run_id }}-github.apk"},{"text": ".DEV arm64", "url": "https://github.com/kiwibrowser/src.next/releases/download/${{ github.run_id }}/com.kiwibrowser.browser.dev-arm64-${{ github.run_id }}-github.apk"}]]}' \
'{text: $text, chat_id: $chat_id, parse_mode: $parse_mode, reply_markup: $reply_markup}')
curl -H "Content-Type: application/json" -X POST -d "$PAYLOAD" https://api.telegram.org/bot${{ secrets.TELEGRAM_TOKEN }}/sendMessage