mirror of
https://github.com/bitwarden/android.git
synced 2026-03-09 19:54:19 -05:00
349 lines
13 KiB
YAML
349 lines
13 KiB
YAML
name: Build Authenticator
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- release/**/*
|
|
workflow_dispatch:
|
|
inputs:
|
|
version-name:
|
|
description: "Optional. Version string to use, in X.Y.Z format. Overrides default in the project."
|
|
required: false
|
|
type: string
|
|
version-code:
|
|
description: "Optional. Build number to use. Overrides default of GitHub run number."
|
|
required: false
|
|
type: number
|
|
patch_version:
|
|
description: "Order 999 - Overrides Patch version"
|
|
type: boolean
|
|
distribute-to-firebase:
|
|
description: "Optional. Distribute artifacts to Firebase."
|
|
required: false
|
|
default: false
|
|
type: boolean
|
|
publish-to-play-store:
|
|
description: "Optional. Deploy bundle artifact to Google Play Store"
|
|
required: false
|
|
default: false
|
|
type: boolean
|
|
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
JAVA_VERSION: 21
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
|
|
jobs:
|
|
version:
|
|
name: Calculate Version Name and Number
|
|
uses: bitwarden/android/.github/workflows/_version.yml@main
|
|
with:
|
|
app_codename: "bwa"
|
|
base_version_number: 0
|
|
version_name: ${{ inputs.version-name }}
|
|
version_number: ${{ inputs.version-code }}
|
|
patch_version: ${{ inputs.patch_version && '999' || '' }}
|
|
|
|
build:
|
|
name: Build Authenticator
|
|
runs-on: ubuntu-24.04
|
|
|
|
steps:
|
|
- name: Log inputs to job summary
|
|
uses: bitwarden/android/.github/actions/log-inputs@main
|
|
with:
|
|
inputs: "${{ toJson(inputs) }}"
|
|
|
|
- name: Check out repo
|
|
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Validate Gradle wrapper
|
|
uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
|
|
|
|
- name: Cache Gradle files
|
|
uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
|
|
with:
|
|
path: |
|
|
~/.gradle/caches
|
|
~/.gradle/wrapper
|
|
key: ${{ runner.os }}-gradle-v2-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', '**/libs.versions.toml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gradle-v2-
|
|
|
|
- name: Cache build output
|
|
uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
|
|
with:
|
|
path: |
|
|
${{ github.workspace }}/build-cache
|
|
key: ${{ runner.os }}-build-cache-${{ github.sha }}
|
|
restore-keys: |
|
|
${{ runner.os }}-build-
|
|
|
|
- name: Configure JDK
|
|
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
|
|
with:
|
|
distribution: "temurin"
|
|
java-version: ${{ env.JAVA_VERSION }}
|
|
|
|
- name: Configure Ruby
|
|
uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
|
|
with:
|
|
bundler-cache: true
|
|
|
|
- name: Install Fastlane
|
|
run: |
|
|
bundle config path vendor/bundle
|
|
bundle install --jobs 4 --retry 3
|
|
|
|
- name: Check Authenticator
|
|
run: bundle exec fastlane check
|
|
|
|
- name: Build Authenticator
|
|
run: bundle exec fastlane buildAuthenticatorDebug
|
|
|
|
publish_playstore:
|
|
name: Publish Authenticator Play Store artifacts
|
|
needs:
|
|
- version
|
|
- build
|
|
runs-on: ubuntu-24.04
|
|
permissions:
|
|
id-token: write
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
variant: ["aab", "apk"]
|
|
|
|
steps:
|
|
- name: Check out repo
|
|
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Configure Ruby
|
|
uses: ruby/setup-ruby@44511735964dcb71245e7e55f72539531f7bc0eb # v1.257.0
|
|
with:
|
|
bundler-cache: true
|
|
|
|
- name: Install Fastlane
|
|
run: |
|
|
bundle config path vendor/bundle
|
|
bundle install --jobs 4 --retry 3
|
|
|
|
- name: Log in to Azure
|
|
uses: bitwarden/gh-actions/azure-login@main
|
|
with:
|
|
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
|
|
tenant_id: ${{ secrets.AZURE_TENANT_ID }}
|
|
client_id: ${{ secrets.AZURE_CLIENT_ID }}
|
|
|
|
- name: Get Azure Key Vault secrets
|
|
id: get-kv-secrets
|
|
uses: bitwarden/gh-actions/get-keyvault-secrets@main
|
|
with:
|
|
keyvault: gh-android
|
|
secrets: "BWA-AAB-KEYSTORE-STORE-PASSWORD,BWA-AAB-KEYSTORE-KEY-PASSWORD,BWA-APK-KEYSTORE-STORE-PASSWORD,BWA-APK-KEYSTORE-KEY-PASSWORD"
|
|
|
|
- name: Retrieve secrets
|
|
env:
|
|
ACCOUNT_NAME: bitwardenci
|
|
CONTAINER_NAME: mobile
|
|
run: |
|
|
mkdir -p ${{ github.workspace }}/secrets
|
|
mkdir -p ${{ github.workspace }}/keystores
|
|
|
|
az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
|
|
--name authenticator_apk-keystore.jks --file ${{ github.workspace }}/keystores/authenticator_apk-keystore.jks --output none
|
|
|
|
az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
|
|
--name authenticator_aab-keystore.jks --file ${{ github.workspace }}/keystores/authenticator_aab-keystore.jks --output none
|
|
|
|
az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
|
|
--name com.bitwarden.authenticator-google-services.json --file ${{ github.workspace }}/authenticator/src/google-services.json --output none
|
|
|
|
az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
|
|
--name com.bitwarden.authenticator.dev-google-services.json --file ${{ github.workspace }}/authenticator/src/debug/google-services.json --output none
|
|
|
|
- name: Download Firebase credentials
|
|
if: ${{ inputs.distribute-to-firebase || github.event_name == 'push' }}
|
|
env:
|
|
ACCOUNT_NAME: bitwardenci
|
|
CONTAINER_NAME: mobile
|
|
run: |
|
|
mkdir -p ${{ github.workspace }}/secrets
|
|
|
|
az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
|
|
--name authenticator_play_firebase-creds.json --file ${{ github.workspace }}/secrets/authenticator_play_firebase-creds.json --output none
|
|
|
|
- name: Download Play Store credentials
|
|
if: ${{ inputs.publish-to-play-store }}
|
|
env:
|
|
ACCOUNT_NAME: bitwardenci
|
|
CONTAINER_NAME: mobile
|
|
run: |
|
|
mkdir -p ${{ github.workspace }}/secrets
|
|
|
|
az storage blob download --account-name "$ACCOUNT_NAME" --container-name "$CONTAINER_NAME" \
|
|
--name authenticator_play_store-creds.json --file ${{ github.workspace }}/secrets/authenticator_play_store-creds.json --output none
|
|
|
|
- name: AZ Logout
|
|
uses: bitwarden/gh-actions/azure-logout@main
|
|
|
|
- name: Verify Play Store credentials
|
|
if: ${{ inputs.publish-to-play-store }}
|
|
run: |
|
|
bundle exec fastlane run validate_play_store_json_key \
|
|
json_key:"${{ github.workspace }}/secrets/authenticator_play_store-creds.json"
|
|
|
|
- name: Validate Gradle wrapper
|
|
uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
|
|
|
|
- name: Cache Gradle files
|
|
uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
|
|
with:
|
|
path: |
|
|
~/.gradle/caches
|
|
~/.gradle/wrapper
|
|
key: ${{ runner.os }}-gradle-v2-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', '**/libs.versions.toml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-gradle-v2-
|
|
|
|
- name: Cache build output
|
|
uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
|
|
with:
|
|
path: |
|
|
${{ github.workspace }}/build-cache
|
|
key: ${{ runner.os }}-build-cache-${{ github.sha }}
|
|
restore-keys: |
|
|
${{ runner.os }}-build-
|
|
|
|
- name: Configure JDK
|
|
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
|
|
with:
|
|
distribution: "temurin"
|
|
java-version: ${{ env.JAVA_VERSION }}
|
|
|
|
- name: Update app CI Build info
|
|
run: |
|
|
./scripts/update_app_ci_build_info.sh \
|
|
"$GITHUB_REPOSITORY" \
|
|
"$GITHUB_REF_NAME" \
|
|
"$GITHUB_SHA" \
|
|
"$GITHUB_RUN_ID" \
|
|
"$GITHUB_RUN_ATTEMPT"
|
|
|
|
- name: Increment version
|
|
env:
|
|
DEFAULT_VERSION_CODE: ${{ github.run_number }}
|
|
INPUT_VERSION_CODE: "${{ needs.version.outputs.version_number }}"
|
|
INPUT_VERSION_NAME: ${{ needs.version.outputs.version_name }}
|
|
run: |
|
|
VERSION_CODE="${INPUT_VERSION_CODE:-$DEFAULT_VERSION_CODE}"
|
|
VERSION_NAME_INPUT="${INPUT_VERSION_NAME:-}"
|
|
bundle exec fastlane setBuildVersionInfo \
|
|
versionCode:"$VERSION_CODE" \
|
|
versionName:"$VERSION_NAME_INPUT"
|
|
|
|
regex='appVersionName = "([^"]+)"'
|
|
if [[ "$(cat gradle/libs.versions.toml)" =~ $regex ]]; then
|
|
VERSION_NAME="${BASH_REMATCH[1]}"
|
|
fi
|
|
echo "Version Name: ${VERSION_NAME}" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "Version Number: $VERSION_CODE" >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- name: Generate release Play Store bundle
|
|
if: ${{ matrix.variant == 'aab' }}
|
|
env:
|
|
STORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.BWA-AAB-KEYSTORE-STORE-PASSWORD }}
|
|
KEY_PASSWORD: ${{ steps.get-kv-secrets.outputs.BWA-AAB-KEYSTORE-KEY-PASSWORD }}
|
|
run: |
|
|
bundle exec fastlane bundleAuthenticatorRelease \
|
|
storeFile:"${{ github.workspace }}/keystores/authenticator_aab-keystore.jks" \
|
|
storePassword:"$STORE_PASSWORD" \
|
|
keyAlias:"authenticatorupload" \
|
|
keyPassword:"$KEY_PASSWORD"
|
|
|
|
- name: Generate release Play Store APK
|
|
if: ${{ matrix.variant == 'apk' }}
|
|
env:
|
|
STORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.BWA-APK-KEYSTORE-STORE-PASSWORD }}
|
|
KEY_PASSWORD: ${{ steps.get-kv-secrets.outputs.BWA-APK-KEYSTORE-KEY-PASSWORD }}
|
|
run: |
|
|
bundle exec fastlane buildAuthenticatorRelease \
|
|
storeFile:"${{ github.workspace }}/keystores/authenticator_apk-keystore.jks" \
|
|
storePassword:"$STORE_PASSWORD" \
|
|
keyAlias:"bitwardenauthenticator" \
|
|
keyPassword:"$KEY_PASSWORD"
|
|
|
|
- name: Upload release Play Store .aab artifact
|
|
if: ${{ matrix.variant == 'aab' }}
|
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
|
with:
|
|
name: com.bitwarden.authenticator.aab
|
|
path: authenticator/build/outputs/bundle/release/com.bitwarden.authenticator.aab
|
|
if-no-files-found: error
|
|
|
|
- name: Upload release .apk artifact
|
|
if: ${{ matrix.variant == 'apk' }}
|
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
|
with:
|
|
name: com.bitwarden.authenticator.apk
|
|
path: authenticator/build/outputs/apk/release/com.bitwarden.authenticator.apk
|
|
if-no-files-found: error
|
|
|
|
- name: Create checksum file for Release AAB
|
|
if: ${{ matrix.variant == 'aab' }}
|
|
run: |
|
|
sha256sum "authenticator/build/outputs/bundle/release/com.bitwarden.authenticator.aab" \
|
|
> ./authenticator-android-aab-sha256.txt
|
|
|
|
- name: Create checksum for release .apk artifact
|
|
if: ${{ matrix.variant == 'apk' }}
|
|
run: |
|
|
sha256sum "authenticator/build/outputs/apk/release/com.bitwarden.authenticator.apk" \
|
|
> ./authenticator-android-apk-sha256.txt
|
|
|
|
- name: Upload .apk SHA file for release
|
|
if: ${{ matrix.variant == 'apk' }}
|
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
|
with:
|
|
name: authenticator-android-apk-sha256.txt
|
|
path: ./authenticator-android-apk-sha256.txt
|
|
if-no-files-found: error
|
|
|
|
- name: Upload .aab SHA file for release
|
|
if: ${{ matrix.variant == 'aab' }}
|
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
|
with:
|
|
name: authenticator-android-aab-sha256.txt
|
|
path: ./authenticator-android-aab-sha256.txt
|
|
if-no-files-found: error
|
|
|
|
- name: Install Firebase app distribution plugin
|
|
if: ${{ inputs.distribute-to-firebase || github.event_name == 'push' }}
|
|
run: bundle exec fastlane add_plugin firebase_app_distribution
|
|
|
|
- name: Publish release bundle to Firebase
|
|
if: ${{ matrix.variant == 'aab' && (inputs.distribute-to-firebase || github.event_name == 'push') }}
|
|
env:
|
|
FIREBASE_CREDS_PATH: ${{ github.workspace }}/secrets/authenticator_play_firebase-creds.json
|
|
run: |
|
|
bundle exec fastlane distributeAuthenticatorReleaseBundleToFirebase \
|
|
serviceCredentialsFile:"$FIREBASE_CREDS_PATH"
|
|
|
|
# Only publish bundles to Play Store when `publish-to-play-store` is true while building
|
|
# bundles
|
|
- name: Publish release bundle to Google Play Store
|
|
if: ${{ inputs.publish-to-play-store && matrix.variant == 'aab' }}
|
|
env:
|
|
PLAY_STORE_CREDS_FILE: ${{ github.workspace }}/secrets/authenticator_play_store-creds.json
|
|
run: |
|
|
bundle exec fastlane publishAuthenticatorReleaseToGooglePlayStore \
|
|
serviceCredentialsFile:"$PLAY_STORE_CREDS_FILE" \
|