0 Fork 0

T

sysadminandClaude Opus 5.5 3d3f8360ae fdroid-publish: find_tool must test its result (ls|tail exits 0 on no match)

An empty SDK build-tools glob was reported as found, so the signer check ran
nothing and refused a correctly signed APK with an empty signer. An unreadable
signer now warns and defers to the host's pinned-cert check; only a real
mismatch fails.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-30 21:56:03 +01:00

fdroid-publish

fdroid-publish: find_tool must test its result (ls|tail exits 0 on no match)

2026-09-30 21:56:03 +01:00

README.md

docs: new home SilverLABS/ci-actions (public; why)

2026-09-30 21:27:14 +01:00

README.md

ci-actions

Reusable Gitea Actions for SilverLABS / SilverLined repos. Public on purpose: runners on act_runner v0.2.11 clone actions anonymously, and this repo holds no secrets (callers pass them in).

fdroid-publish

Publishes an already-built, signed APK to a SilverLABS F-Droid channel:

channel	repo	who sees it
`beta`	`https://apps.silverlined.uk/fdroid-test/repo`	devices with SilverSTORE's "Beta channel" on
`stable`	`https://apps.silverlined.uk/fdroid/repo`	the whole fleet (F-Droid auto-updates)

Same method as SilverMetal's Publish-FdroidApp.ps1: scp to <repoRoot>/incoming, run the host's /srv/fdroid/bin/ingest.sh (pinned-cert check, index rebuild under a lock), then read the published index back.

- uses: https://git.silverlabs.uk/SilverLABS/ci-actions/fdroid-publish@v1
  with:
    app: silverchat            # silverchat | silvervpn | silverstore
    apk: path/to/app-release.apk
    channel: beta              # default
    version-code: ${{ github.run_number }}   # optional; read from the APK if omitted
    ssh-key: ${{ secrets.FDROID_SSH_KEY }}

Safety:

The host refuses an APK not signed by the app's pinned cert (the action checks first when apksigner is available).
A channel holds one APK per app (ingest.sh replaces repo/<package>.apk), so the action skips any build whose versionCode is not newer than what the channel already serves — an older, slower run can never roll a channel back.
dry-run: 'true' validates everything and stops before uploading.

FDROID_SSH_KEY is a SilverLined org secret: the fdroid-ci key, authorised on silverlined.uk with restrict,from="82.8.176.11" (the lab's egress IP).

Promotion to stable is manual: each app repo has a Promote to F-Droid stable workflow (dispatch with the tested tag).