chore: update all submodule refs + CI/CD workflows + AGENTS.md

2026-07-07 09:28:06 +07:00
parent 2fb3109b9f
commit 59a8436a45
8 changed files with 385 additions and 13 deletions
@@ -0,0 +1,130 @@
+name: Build Android Agent
+
+on:
+  workflow_call:
+    inputs:
+      build_type:
+        description: 'Build type (debug or release)'
+        required: false
+        type: string
+        default: 'release'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    env:
+      RUNNER_TOOL_CACHE: /toolcache
+    steps:
+      - name: Configure git auth for submodules
+        run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
+
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+          fetch-depth: 0
+          token: ${{ secrets.BUILD_TOKEN }}
+          persist-credentials: true
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+          cache: gradle
+
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Check for signing key
+        id: check-signing
+        run: |
+          if [ -n "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" ]; then
+            echo "has_key=true" >> "$GITHUB_OUTPUT"
+            echo "Signing: Using production keystore from secrets"
+          else
+            echo "has_key=false" >> "$GITHUB_OUTPUT"
+            echo "Signing: No keystore found, using debug/self-signed"
+          fi
+
+      - name: Decode keystore
+        if: steps.check-signing.outputs.has_key == 'true'
+        run: |
+          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > /tmp/release.keystore
+
+      - name: Create keystore properties
+        if: steps.check-signing.outputs.has_key == 'true'
+        run: |
+          cat > /tmp/keystore.properties << EOF
+          storePassword=${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          keyPassword=${{ secrets.ANDROID_KEY_PASSWORD }}
+          keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}
+          storeFile=/tmp/release.keystore
+          EOF
+
+      - name: Configure signing (production)
+        if: steps.check-signing.outputs.has_key == 'true'
+        working-directory: apps/android-agent
+        run: |
+          # Inject signing config into build.gradle.kts
+          cat >> app/build.gradle.kts << 'GRADLE_EOF'
+
+          android {
+              signingConfigs {
+                  create("release") {
+                      storeFile = file("/tmp/release.keystore")
+                      storePassword = System.getenv("KEYSTORE_PASSWORD") ?: ""
+                      keyAlias = System.getenv("KEY_ALIAS") ?: ""
+                      keyPassword = System.getenv("KEY_PASSWORD") ?: ""
+                  }
+              }
+              buildTypes {
+                  release {
+                      signingConfig = signingConfigs.getByName("release")
+                  }
+              }
+          }
+          GRADLE_EOF
+        env:
+          KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+
+      - name: Grant execute permission for gradlew
+        working-directory: apps/android-agent
+        run: chmod +x gradlew
+
+      - name: Build debug APK (no signing key)
+        if: steps.check-signing.outputs.has_key == 'false'
+        working-directory: apps/android-agent
+        run: ./gradlew assembleDebug
+
+      - name: Build release APK (with signing key)
+        if: steps.check-signing.outputs.has_key == 'true'
+        working-directory: apps/android-agent
+        run: ./gradlew assembleRelease
+
+      - name: Upload debug APK
+        if: steps.check-signing.outputs.has_key == 'false'
+        uses: actions/upload-artifact@v3
+        with:
+          name: nexusguard-android-debug
+          path: apps/android-agent/app/build/outputs/apk/debug/app-debug.apk
+
+      - name: Upload release APK
+        if: steps.check-signing.outputs.has_key == 'true'
+        uses: actions/upload-artifact@v3
+        with:
+          name: nexusguard-android-release
+          path: apps/android-agent/app/build/outputs/apk/release/app-release.apk
+
+      - name: Upload mapping file (release only)
+        if: steps.check-signing.outputs.has_key == 'true'
+        uses: actions/upload-artifact@v3
+        with:
+          name: nexusguard-android-mapping
+          path: apps/android-agent/app/build/outputs/mapping/release/mapping.txt
+          if-no-files-found: warn
+
+      - name: Cleanup keystore
+        if: always()
+        run: rm -f /tmp/release.keystore /tmp/keystore.properties