-
-
Notifications
You must be signed in to change notification settings - Fork 5
Add initial Android build and development support #83
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -13,6 +13,108 @@ env: | |||||||||||||
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | ||||||||||||||
|
|
||||||||||||||
| jobs: | ||||||||||||||
| android-release: | ||||||||||||||
| name: Release (android) | ||||||||||||||
| runs-on: ubuntu-22.04 | ||||||||||||||
| steps: | ||||||||||||||
| - name: Check out Git repository | ||||||||||||||
| uses: actions/checkout@v4 | ||||||||||||||
|
|
||||||||||||||
|
Comment on lines
+20
to
+22
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Show the relevant workflow sections around the referenced lines
FILE=".github/workflows/release.yml"
echo "== File: $FILE =="
nl -ba "$FILE" | sed -n '1,120p'
echo
echo "== Snippet around lines 15-40 =="
nl -ba "$FILE" | sed -n '15,45p'
echo
echo "== Find all checkout uses in this workflow =="
rg -n "uses:\s*actions/checkout@v" "$FILE" -n || true
echo
echo "== For each checkout, show following lines to inspect 'with:' config =="
# Print checkout blocks (checkout line + next 12 lines)
python3 - <<'PY'
import re, itertools, pathlib
path = pathlib.Path(".github/workflows/release.yml")
lines = path.read_text().splitlines()
for i,l in enumerate(lines):
if re.search(r"uses:\s*actions/checkout@v\d+", l):
start = max(0, i-2)
end = min(len(lines), i+14)
print(f"\n--- checkout occurrence at line {i+1} ---")
for j in range(start, end):
ln = j+1
print(f"{ln:4d} {lines[j]}")
PYRepository: YueMiyuki/Risuko Length of output: 163 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/release.yml"
echo "== File: $FILE (first 140 lines) =="
# Show with line numbers using awk
awk '{printf "%4d %s\n", NR, $0}' "$FILE" | sed -n '1,140p'
echo
echo "== Snippet around lines 15-45 (requested area) =="
awk '{if (NR>=15 && NR<=45) printf "%4d %s\n", NR, $0}' "$FILE"
echo
echo "== Find all checkout uses in this workflow =="
rg -n "uses:\s*actions/checkout@v" "$FILE" || true
echo
echo "== For each checkout occurrence, print nearby lines (uses line + 15 lines) =="
python3 - <<'PY'
import re, pathlib
p=pathlib.Path(".github/workflows/release.yml")
lines=p.read_text().splitlines()
for i,l in enumerate(lines):
if re.search(r"uses:\s*actions/checkout@v\d+", l):
print(f"\n--- checkout occurrence at line {i+1} ---")
for j in range(i, min(len(lines), i+16)):
print(f"{j+1:4d} {lines[j]}")
PYRepository: YueMiyuki/Risuko Length of output: 7222 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/release.yml"
echo "== Snippet around line 130-190 =="
awk '{if (NR>=130 && NR<=200) printf "%4d %s\n", NR, $0}' "$FILE"
echo
echo "== Extract all 'uses: actions/checkout@v4' blocks including their immediate 'with:' sections (up to 15 lines) =="
python3 - <<'PY'
import re, pathlib
p=pathlib.Path(".github/workflows/release.yml")
lines=p.read_text().splitlines()
for i,l in enumerate(lines):
if re.search(r"uses:\s*actions/checkout@v4\s*$", l):
print(f"\n--- checkout occurrence at line {i+1} ---")
# print until next step header or 20 lines
for j in range(i, min(len(lines), i+22)):
print(f"{j+1:4d} {lines[j]}")
if j>i and re.search(r"^\s*-\s+name:\s+", lines[j]):
break
PYRepository: YueMiyuki/Risuko Length of output: 3594 🌐 Web query:
💡 Result: For actions/checkout@v4, the input persist-credentials defaults to true (i.e., if you omit Citations:
Disable persisted checkout credentials in the Both Suggested patch - name: Check out Git repository
uses: actions/checkout@v4
+ with:
+ persist-credentials: false - name: Check out Git repository
uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
Suggested change
🧰 Tools🪛 zizmor (1.25.2)[warning] 20-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 21-21: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI Agents |
||||||||||||||
| - name: Setup pnpm | ||||||||||||||
| uses: pnpm/action-setup@v4 | ||||||||||||||
| with: | ||||||||||||||
| run_install: false | ||||||||||||||
|
|
||||||||||||||
| - name: Setup Node.js | ||||||||||||||
| uses: actions/setup-node@v4 | ||||||||||||||
| with: | ||||||||||||||
| node-version: 24 | ||||||||||||||
| cache: pnpm | ||||||||||||||
|
|
||||||||||||||
| - name: Setup Java | ||||||||||||||
| uses: actions/setup-java@v4 | ||||||||||||||
| with: | ||||||||||||||
| distribution: temurin | ||||||||||||||
| java-version: 17 | ||||||||||||||
|
|
||||||||||||||
| - name: Setup Android SDK | ||||||||||||||
| uses: android-actions/setup-android@v3 | ||||||||||||||
|
|
||||||||||||||
| - name: Install Android SDK packages | ||||||||||||||
| shell: bash | ||||||||||||||
| run: | | ||||||||||||||
| set -euo pipefail | ||||||||||||||
| sdkmanager \ | ||||||||||||||
| "platforms;android-36" \ | ||||||||||||||
| "build-tools;35.0.0" \ | ||||||||||||||
| "ndk;27.2.12479018" | ||||||||||||||
|
|
||||||||||||||
| - name: Setup Rust Android targets | ||||||||||||||
| uses: dtolnay/rust-toolchain@stable | ||||||||||||||
| with: | ||||||||||||||
| targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android | ||||||||||||||
|
|
||||||||||||||
| - name: Install dependencies | ||||||||||||||
| run: pnpm install --no-frozen-lockfile | ||||||||||||||
|
|
||||||||||||||
| - name: Build Android release APKs | ||||||||||||||
| run: pnpm android:build | ||||||||||||||
| env: | ||||||||||||||
| ANDROID_NDK_VERSION: 27.2.12479018 | ||||||||||||||
| ANDROID_API_LEVEL: 35 | ||||||||||||||
|
|
||||||||||||||
| - name: Sign Android release APKs | ||||||||||||||
| run: pnpm android:sign | ||||||||||||||
| env: | ||||||||||||||
| ANDROID_SIGNING_KEYSTORE_BASE64: ${{ secrets.ANDROID_SIGNING_KEYSTORE_BASE64 }} | ||||||||||||||
| ANDROID_SIGNING_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_SIGNING_KEYSTORE_PASSWORD }} | ||||||||||||||
| ANDROID_SIGNING_KEY_ALIAS: ${{ secrets.ANDROID_SIGNING_KEY_ALIAS }} | ||||||||||||||
| ANDROID_SIGNING_KEY_PASSWORD: ${{ secrets.ANDROID_SIGNING_KEY_PASSWORD }} | ||||||||||||||
|
|
||||||||||||||
| - name: Package Android APKs with standardized names | ||||||||||||||
| shell: bash | ||||||||||||||
| run: | | ||||||||||||||
| set -euo pipefail | ||||||||||||||
| if [[ "${{ github.ref }}" == refs/tags/* ]]; then | ||||||||||||||
| version="${{ github.ref_name }}"; version="${version#v}" | ||||||||||||||
| else | ||||||||||||||
| version=$(grep -m1 '^version' src-tauri/Cargo.toml | sed 's/.*"\(.*\)"/\1/') | ||||||||||||||
| fi | ||||||||||||||
| mkdir -p dist/android | ||||||||||||||
| declare -A labels=( | ||||||||||||||
| [arm]=arm | ||||||||||||||
| [arm64]=arm64 | ||||||||||||||
| [x86]=x86 | ||||||||||||||
| [x86_64]=x64 | ||||||||||||||
| ) | ||||||||||||||
| for abi in arm arm64 x86 x86_64; do | ||||||||||||||
| src="src-tauri/gen/android/app/build/outputs/apk/${abi}/release/app-${abi}-release.apk" | ||||||||||||||
| if [[ ! -f "$src" ]]; then | ||||||||||||||
| echo "::error::Signed Android APK not found: $src" | ||||||||||||||
| find src-tauri/gen/android/app/build/outputs/apk -type f -name '*.apk' -print || true | ||||||||||||||
| exit 1 | ||||||||||||||
| fi | ||||||||||||||
| dest="dist/android/Risuko_${version}_android_${labels[$abi]}.apk" | ||||||||||||||
| cp "$src" "$dest" | ||||||||||||||
| echo "packaged: $dest" | ||||||||||||||
| done | ||||||||||||||
|
|
||||||||||||||
| - name: Upload Android APKs to GitHub Release | ||||||||||||||
| if: startsWith(github.ref, 'refs/tags/') | ||||||||||||||
| uses: softprops/action-gh-release@v2 | ||||||||||||||
| with: | ||||||||||||||
| tag_name: ${{ github.ref_name }} | ||||||||||||||
| files: dist/android/*.apk | ||||||||||||||
| env: | ||||||||||||||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||||||||||||||
|
|
||||||||||||||
| - name: Upload Android APK artifacts (manual builds) | ||||||||||||||
| if: ${{ !startsWith(github.ref, 'refs/tags/') }} | ||||||||||||||
| uses: actions/upload-artifact@v4 | ||||||||||||||
| with: | ||||||||||||||
| name: app-android | ||||||||||||||
| path: dist/android/*.apk | ||||||||||||||
|
|
||||||||||||||
| release: | ||||||||||||||
| name: Release (${{ matrix.platform }}) | ||||||||||||||
| runs-on: ${{ matrix.os }} | ||||||||||||||
|
|
||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -27,6 +27,8 @@ release | |
|
|
||
| # tauri | ||
| src-tauri/target | ||
| src-tauri/gen | ||
| src-tauri/gen/* | ||
| !src-tauri/gen/android/ | ||
| !src-tauri/gen/android/** | ||
|
Comment on lines
+31
to
+32
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Avoid unignoring Android build artifacts wholesale. Line 32 re-includes everything under 🤖 Prompt for AI Agents |
||
|
|
||
| *.node | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: YueMiyuki/Risuko
Length of output: 227
🏁 Script executed:
Repository: YueMiyuki/Risuko
Length of output: 10984
Pin third-party GitHub Actions to commit SHAs.
.github/workflows/release.ymluses mutable action tags (e.g.,actions/checkout@v4,actions/setup-node@v4,android-actions/setup-android@v3,dtolnay/rust-toolchain@stable,softprops/action-gh-release@v2,actions/upload-artifact@v4,tauri-apps/tauri-action@v0), which weakens CI supply-chain guarantees—pin everyuses:to a full commit SHA.Applies to
uses:lines: 21, 24, 29, 35, 41, 53, 104, 113, 152, 155, 160, 166, 196, 277, 286, 317, 326, 367, 376.🧰 Tools
🪛 zizmor (1.25.2)
[warning] 20-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 21-21: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents