[PM-38570] New signing keystore for testharness (#7188)

Co-authored-by: Álison Fernandes <vvolkgang@users.noreply.github.com>

.github/workflows/build-testharness.yml

@@ -40,6 +40,8 @@ jobs:
     name: Build Test Harness
     runs-on: ubuntu-24.04
     needs: version
+    permissions:
+      id-token: write
 
     steps:
       - name: Log inputs to job summary
@@ -52,6 +54,33 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Log in to Azure
+        uses: bitwarden/gh-actions/azure-login@main
+        with:
+          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+          client_id: ${{ secrets.AZURE_CLIENT_ID }}
+
+      - name: Get Azure Key Vault secrets
+        id: get-kv-secrets
+        uses: bitwarden/gh-actions/get-keyvault-secrets@main
+        with:
+          keyvault: gh-android
+          secrets: "TESTHARNESS-KEYSTORE-STORE-PASSWORD,TESTHARNESS-KEYSTORE-KEY-PASSWORD"
+
+      - name: Retrieve keystore
+        env:
+          ACCOUNT_NAME: bitwardenci
+          CONTAINER_NAME: mobile
+        run: |
+          mkdir -p ${{ github.workspace }}/keystores
+
+          az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
+          --name testharness_apk-keystore.jks --file ${{ github.workspace }}/keystores/testharness_apk-keystore.jks --output none
+
+      - name: AZ Logout
+        uses: bitwarden/gh-actions/azure-logout@main
+
       - name: Setup Android Build
         uses: ./.github/actions/setup-android-build
 
@@ -61,24 +90,32 @@ jobs:
           VERSION_NAME: ${{ needs.version.outputs.version_name }}
         run: ./.github/scripts/set-build-version.sh "$VERSION_CODE" "$VERSION_NAME"
 
-      - name: Build Test Harness Debug APK
-        run: ./gradlew :testharness:assembleDebug
-
-      - name: Upload Test Harness APK
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: com.bitwarden.testharness.dev-debug.apk
-          path: testharness/build/outputs/apk/debug/com.bitwarden.testharness.dev.apk
-          if-no-files-found: error
-
-      - name: Create checksum for Test Harness APK
+      - name: Build and sign Test Harness Release APK
+        env:
+          STORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.TESTHARNESS-KEYSTORE-STORE-PASSWORD }}
+          KEY_PASSWORD: ${{ steps.get-kv-secrets.outputs.TESTHARNESS-KEYSTORE-KEY-PASSWORD }}
         run: |
-          sha256sum "testharness/build/outputs/apk/debug/com.bitwarden.testharness.dev.apk" \
-            > ./com.bitwarden.testharness.dev.apk-sha256.txt
+          bundle exec fastlane buildTestHarnessRelease \
+          storeFile:"${{ github.workspace }}/keystores/testharness_apk-keystore.jks" \
+          storePassword:"$STORE_PASSWORD" \
+          keyAlias:"bitwardentestharness" \
+          keyPassword:"$KEY_PASSWORD"
 
-      - name: Upload Test Harness SHA file
+      - name: Upload Test Harness Release APK
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: com.bitwarden.testharness.dev.apk-sha256.txt
-          path: ./com.bitwarden.testharness.dev.apk-sha256.txt
+          name: com.bitwarden.testharness.apk
+          path: testharness/build/outputs/apk/release/com.bitwarden.testharness.apk
+          if-no-files-found: error
+
+      - name: Create checksum for Test Harness Release APK
+        run: |
+          sha256sum "testharness/build/outputs/apk/release/com.bitwarden.testharness.apk" \
+            > ./com.bitwarden.testharness.apk-sha256.txt
+
+      - name: Upload Test Harness Release SHA file
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: com.bitwarden.testharness.apk-sha256.txt
+          path: ./com.bitwarden.testharness.apk-sha256.txt
           if-no-files-found: error

fastlane/Fastfile

@@ -448,6 +448,21 @@ platform :android do
     )
   end
 
+  desc "Assemble and sign release Test Harness APK"
+  lane :buildTestHarnessRelease do |options|
+    gradle(
+      task: "testharness:assemble",
+      build_type: "Release",
+      properties: {
+        "android.injected.signing.store.file" => options[:storeFile],
+        "android.injected.signing.store.password" => options[:storePassword],
+        "android.injected.signing.key.alias" => options[:keyAlias],
+        "android.injected.signing.key.password" => options[:keyPassword]
+      },
+      print_command: false,
+    )
+  end
+
   desc "Publish release AAB to Firebase"
   lane :distributeAuthenticatorReleaseBundleToFirebase do |options|
     release_notes = changelog_from_git_commits(