61 lines
3.0 KiB
Markdown
61 lines
3.0 KiB
Markdown
# ci-actions
|
|
|
|
Reusable Gitea Actions for SilverLABS / SilverLined repos. Public on purpose: runners on act_runner v0.2.11 clone actions anonymously, and this repo holds no secrets (callers pass them in).
|
|
|
|
## fdroid-publish
|
|
|
|
Publishes an already-built, signed APK to a SilverLABS F-Droid channel:
|
|
|
|
| channel | repo | who sees it |
|
|
|---|---|---|
|
|
| `beta` | `https://apps.silverlined.uk/fdroid-test/repo` | devices with SilverSTORE's "Beta channel" on |
|
|
| `stable` | `https://apps.silverlined.uk/fdroid/repo` | the whole fleet (F-Droid auto-updates) |
|
|
|
|
Same method as SilverMetal's `Publish-FdroidApp.ps1`: `scp` to `<repoRoot>/incoming`,
|
|
run the host's `/srv/fdroid/bin/ingest.sh` (pinned-cert check, index rebuild under a
|
|
lock), then read the published index back.
|
|
|
|
```yaml
|
|
- uses: https://git.silverlabs.uk/SilverLABS/ci-actions/fdroid-publish@v1
|
|
with:
|
|
app: silverchat # silverchat | silvervpn | silverstore | silvermail | silverbeats
|
|
apk: path/to/app-release.apk
|
|
channel: beta # default
|
|
version-code: ${{ github.run_number }} # optional; read from the APK if omitted
|
|
ssh-key: ${{ secrets.FDROID_SSH_KEY }}
|
|
```
|
|
|
|
Safety:
|
|
- The host refuses an APK not signed by the app's pinned cert (the action checks
|
|
first when `apksigner` is available).
|
|
- A channel holds one APK per app (`ingest.sh` replaces `repo/<package>.apk`), so the
|
|
action **skips** any build whose versionCode is not newer than what the channel
|
|
already serves — an older, slower run can never roll a channel back.
|
|
- `dry-run: 'true'` validates everything and stops before uploading.
|
|
|
|
`FDROID_SSH_KEY` is a SilverLined org secret: the `fdroid-ci` key, authorised on
|
|
`silverlined.uk` with `restrict,from="82.8.176.11"` (the lab's egress IP).
|
|
|
|
Promotion to `stable` is manual: each app repo has a `Promote to F-Droid stable`
|
|
workflow (dispatch with the tested tag).
|
|
|
|
## catalogue-publish
|
|
|
|
Publishes a built artifact to the SilverDESK App Catalogue (`desk.silverlined.uk/api/catalogue/publish`). Works on Linux and Windows runners (Git Bash, `shell: bash`). "Already published" (HTTP 409) is treated as success.
|
|
|
|
```yaml
|
|
- uses: https://git.silverlabs.uk/SilverLABS/ci-actions/catalogue-publish@v1
|
|
with:
|
|
app: silvermail
|
|
file: dist/SilverMAIL-0.1.5-x64.nupkg
|
|
platform: windows # android | macos | linux | windows
|
|
arch: x64
|
|
format: nupkg # apk|dmg|zip|deb|appimage|msi|exe|msix|pwa|nupkg
|
|
version: 0.1.5
|
|
channel: beta # alpha | beta | rc | stable
|
|
publish-key: ${{ secrets.CATALOGUE_PUBLISH_KEY }}
|
|
# optional: version-code, notes-file (<=500 chars), signer-identity, catalogue-url, dry-run
|
|
```
|
|
|
|
`version-code` defaults to `MAJOR*1000000 + MINOR*1000 + PATCH` (strict `x.y.z`, each below 1000; anything else fails the step, so pass `version-code` explicitly, e.g. `${{ github.run_number }}`). The key is passed through the environment only and never printed. `publish-to-catalogue.sh` is a copy of silverdesk's `tools/catalogue/publish-to-catalogue.sh`; keep them in step. Run `bash catalogue-publish/test.sh` for the offline tests.
|