claudeandbit
a5e4cb6a01
bit settled the model on weblib-viewer#19: the builder signs an APK, and this repo only distributes it -- the same signature has to work whether the APK reached a device via a git release or via F-Droid, and fdroid update never creates a signature of its own. sign-apk.sh remains for a consumer whose build genuinely produces an unsigned artifact, but action.yml's header comment and the README's "Using it" example no longer show it as a default-flow step, and both now say explicitly that this repo is never handed an app signing key -- only the repo index key. Also records two decisions that had nowhere to live yet: the index key's config/secret names must stay distinct from the APK key's even while both resolve to the same keystore for now (bit intends to split them later), and the index key must be generated as RSA 4096, overriding F-Droid's own docs, which suggest 2048. Fixes #9. Co-authored-by: bit <bit@das-labor.org>
54 lines
2.4 KiB
YAML
54 lines
2.4 KiB
YAML
# Makes sign-apk.sh, fdroid-update.sh, publish.sh, next-version-code.sh and
|
|
# with-nixpkgs.sh available to a workflow and reports where they are.
|
|
#
|
|
# Consume it with the **full URL**, the same reason recorded in weblib-ci's
|
|
# README: `uses: owner/repo@main` resolves against the instance's default
|
|
# actions URL rather than this host, and only the full URL form works while
|
|
# the repository being referenced is private -- and the repository holding
|
|
# the signing keys that consumes this one is private on purpose.
|
|
#
|
|
# - uses: actions/checkout@v4
|
|
# - id: ci
|
|
# uses: https://git.chaosbit.de/weblib/fdroid-repo-ci@main
|
|
# - run: bash "${{ steps.ci.outputs.path }}/fdroid-update.sh" ...
|
|
# - run: bash "${{ steps.ci.outputs.path }}/publish.sh" ...
|
|
#
|
|
# sign-apk.sh is deliberately not in that default flow: the builder signs
|
|
# the APK before it ever reaches this action (weblib-viewer#19), so this
|
|
# repo's normal job is to index and publish an already-signed artifact.
|
|
# sign-apk.sh stays available for the exceptional consumer whose build
|
|
# genuinely produces an unsigned APK -- see the README.
|
|
#
|
|
# Nothing here reads a secret or names a bucket, a keystore or a consumer
|
|
# repo -- those all stay on the caller's side of this action's output path.
|
|
# This action is also never handed an *app* signing key -- only the repo
|
|
# index key that fdroid-update.sh signs the index with (see README).
|
|
name: F-Droid repo publishing tools
|
|
description: >-
|
|
Key-free tooling to index an already-signed F-Droid binary repo (`fdroid
|
|
update`), compute the next monotonic versionCode for a commit's committer
|
|
date, and publish the result to an S3-compatible bucket. Also includes
|
|
sign-apk.sh for the exceptional consumer whose build does not already
|
|
produce a signed APK. The caller supplies the keys, the bucket, the APK
|
|
and the commit being built; this action supplies the pinned toolchain and
|
|
the scripts.
|
|
|
|
outputs:
|
|
path:
|
|
description: >-
|
|
Directory holding with-nixpkgs.sh, nixpkgs-pin, sign-apk.sh,
|
|
fdroid-update.sh, next-version-code.sh, next_version_code.py and
|
|
publish.sh.
|
|
value: ${{ github.action_path }}
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- shell: bash
|
|
run: |
|
|
echo "fdroid-repo-ci tools at ${{ github.action_path }}"
|
|
for f in with-nixpkgs.sh nixpkgs-pin sign-apk.sh fdroid-update.sh \
|
|
next-version-code.sh next_version_code.py publish.sh; do
|
|
test -f "${{ github.action_path }}/$f"
|
|
done
|