Merge pull request #885 from MaplePrivacyLabs/codex-mono-agent-maple #1119
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Android App CI | |
| permissions: | |
| contents: read | |
| id-token: write | |
| attestations: write | |
| artifact-metadata: write | |
| on: | |
| push: | |
| branches: [ master ] | |
| jobs: | |
| changes: | |
| uses: ./.github/workflows/app-change-detection.yml | |
| build-android: | |
| needs: changes | |
| if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.android != 'false') }} | |
| runs-on: ubuntu-latest-8-cores | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22 | |
| with: | |
| github-token: "" | |
| - name: Cache Bun dependencies | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4 | |
| with: | |
| path: | | |
| ~/.bun/install/cache | |
| key: ${{ runner.os }}-bun-${{ hashFiles('apps/maple-research/frontend/bun.lock', 'sdk/bun.lock') }} | |
| - name: Cache Gradle | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4 | |
| with: | |
| path: | | |
| ~/.gradle/caches | |
| ~/.gradle/wrapper | |
| key: ${{ runner.os }}-gradle-${{ hashFiles('apps/maple-research/frontend/src-tauri/gen/android/**/*.gradle*', 'apps/maple-research/frontend/src-tauri/gen/android/gradle/wrapper/gradle-wrapper.properties') }} | |
| restore-keys: | | |
| ${{ runner.os }}-gradle- | |
| - name: Cache sccache | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4 | |
| with: | |
| path: ~/.cache/sccache | |
| key: ${{ runner.os }}-sccache-android-release-${{ hashFiles('apps/maple-research/frontend/src-tauri/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-sccache-android-release- | |
| ${{ runner.os }}-sccache-android- | |
| ${{ runner.os }}-sccache- | |
| - name: Build Tauri Android App (signed) | |
| run: nix develop --no-update-lock-file .#android -c ./scripts/ci/android-release.sh | |
| env: | |
| ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }} | |
| ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }} | |
| ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }} | |
| - name: Show sccache stats | |
| if: always() | |
| run: nix develop --no-update-lock-file .#android -c sccache --show-stats | |
| - name: Collect Android release checksums | |
| run: | | |
| nix develop --no-update-lock-file .#android -c ./scripts/ci/attestation-manifest.sh \ | |
| android-release-artifacts.sha256 \ | |
| apps/maple-research/frontend/src-tauri/target/reproducibility/android-release-final.sha256 \ | |
| apps/maple-research/frontend/src-tauri/target/reproducibility/android-release-*.sha256 | |
| cat android-release-artifacts.sha256 | |
| - name: Attest Android release artifacts | |
| # Keep uploads/verifiers running if GitHub token policy rejects artifact attestation. | |
| continue-on-error: true | |
| uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb # was v4 | |
| with: | |
| subject-checksums: android-release-artifacts.sha256 | |
| - name: Upload Android APK | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4 | |
| with: | |
| name: maple-android-apk | |
| path: | | |
| apps/maple-research/frontend/src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release.apk | |
| apps/maple-research/frontend/src-tauri/target/reproducibility/*.sha256 | |
| retention-days: 5 | |
| - name: Upload Android AAB | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4 | |
| with: | |
| name: maple-android-aab | |
| path: | | |
| apps/maple-research/frontend/src-tauri/gen/android/app/build/outputs/bundle/universalRelease/app-universal-release.aab | |
| apps/maple-research/frontend/src-tauri/target/reproducibility/*.sha256 | |
| retention-days: 5 | |
| verify-android-artifacts: | |
| needs: build-android | |
| runs-on: ubuntu-latest-8-cores | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22 | |
| with: | |
| github-token: "" | |
| - name: Download Android artifacts | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4 | |
| with: | |
| path: artifacts | |
| - name: Verify Android artifact reproducibility proofs | |
| env: | |
| MAPLE_REQUIRE_ANDROID_SIGNATURE_VERIFICATION: "1" | |
| run: nix develop --no-update-lock-file .#android -c ./scripts/ci/verify-release-artifacts.sh artifacts android |