claudeandbit
3f14c01b00
Adds sign-apk.sh (align-check + apksigner), fdroid-update.sh (fdroid update over a binary repo, signing the index with its own separate key), publish.sh (S3-compatible upload) and the composite action tying them together, matching weblib-ci's shape. zipalign is not a standalone nixpkgs attribute; resolved by measurement rather than assumption that Gradle/AGP already aligns its output (Android's own docs, corroborated by fdroidserver never shelling out to zipalign) and added check_zip_alignment.py as the safety net, since apksigner itself does not check alignment at all. nixpkgs is pinned via a committed nixpkgs-pin revision, since this repo has no flake.lock of its own for with-nixpkgs.sh to read (fdroid-repo-ci#1, weblib-ci#9) -- a missing or malformed pin fails loudly rather than degrading to an unpinned nix shell. No consumer repo, bucket, hostname or channel name is hard-coded: which repo holds the keys and runs the publish has already changed once during this issue and may again, so every example uses a placeholder. 42 offline/local-only test assertions across five suites (run_tests.sh), including fault injection on the alignment check, the password/argument validation, and the with-nixpkgs.sh fail-loud paths. Co-authored-by: bit <bit@das-labor.org>
40 lines
1.6 KiB
YAML
40 lines
1.6 KiB
YAML
# Makes sign-apk.sh, fdroid-update.sh, publish.sh and with-nixpkgs.sh
|
|
# available to a workflow and reports where they are.
|
|
#
|
|
# Consume it with the **full URL**, the same reason recorded in weblib-ci's
|
|
# README: `uses: owner/repo@main` resolves against the instance's default
|
|
# actions URL rather than this host, and only the full URL form works while
|
|
# the repository being referenced is private -- and the repository holding
|
|
# the signing keys that consumes this one is private on purpose.
|
|
#
|
|
# - uses: actions/checkout@v4
|
|
# - id: ci
|
|
# uses: https://git.chaosbit.de/weblib/fdroid-repo-ci@main
|
|
# - run: bash "${{ steps.ci.outputs.path }}/sign-apk.sh" ...
|
|
#
|
|
# Nothing here reads a secret or names a bucket, a keystore or a consumer
|
|
# repo -- those all stay on the caller's side of this action's output path.
|
|
name: F-Droid repo publishing tools
|
|
description: >-
|
|
Shared, key-free tooling to align-check and sign a prebuilt APK, run
|
|
`fdroid update` over a binary repo, and publish the result to an
|
|
S3-compatible bucket. The caller supplies the keys, the bucket and the
|
|
APK; this action supplies the pinned toolchain and the scripts.
|
|
|
|
outputs:
|
|
path:
|
|
description: >-
|
|
Directory holding with-nixpkgs.sh, nixpkgs-pin, sign-apk.sh,
|
|
fdroid-update.sh and publish.sh.
|
|
value: ${{ github.action_path }}
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- shell: bash
|
|
run: |
|
|
echo "fdroid-repo-ci tools at ${{ github.action_path }}"
|
|
for f in with-nixpkgs.sh nixpkgs-pin sign-apk.sh fdroid-update.sh publish.sh; do
|
|
test -f "${{ github.action_path }}/$f"
|
|
done
|