Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Introduce the Android Alpha track 🎉 #235

Merged
merged 24 commits into from
May 18, 2022
Merged

Introduce the Android Alpha track 🎉 #235

Changes from 21 commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
53aca36
Add `deploy-alpha-android-app` workflow
nilsreichardt May 17, 2022
0daf053
Add missing `secrets.`
nilsreichardt May 17, 2022
cb19f4b
Fix
nilsreichardt May 17, 2022
d22dadc
Merge branch 'main' into android-alpha
nilsreichardt May 17, 2022
f11ac80
Use `subosito/flutter-action@main`
nilsreichardt May 18, 2022
2a00d02
Use `flutter-action@main` in correct workflow
nilsreichardt May 18, 2022
9c9b244
Use `'com.android.tools.build:gradle:4.1.0'`
nilsreichardt May 18, 2022
348b766
Add `compileOptions`, `kotlinOptions` and `sourceSets` from Flutter t…
nilsreichardt May 18, 2022
537cb14
Move installation of Firebase Tools after the build
nilsreichardt May 18, 2022
51596a1
Use `checkReleaseBuilds false`
nilsreichardt May 18, 2022
db3cffd
Add `url 'https://google.bintray.com/exoplayer/'`
nilsreichardt May 18, 2022
c5c65b6
Revert `exoplayer`
nilsreichardt May 18, 2022
028a14e
Remove dependency overwrite for `video_player`
nilsreichardt May 18, 2022
b47b5b9
Refactor `alpha.yml`
nilsreichardt May 18, 2022
126ffcc
Fix typo
nilsreichardt May 18, 2022
ef93b85
Better texting
nilsreichardt May 18, 2022
6419f87
Fix upload to Firebase Distribution
nilsreichardt May 18, 2022
0b018c9
Revert `subosito/flutter-action@v2`
nilsreichardt May 18, 2022
87aa38c
Use `subosito/flutter-action@v2`
nilsreichardt May 18, 2022
c15b051
Revert push triggers
nilsreichardt May 18, 2022
6cd1e43
Merge branch 'main' into android-alpha
nilsreichardt May 18, 2022
f034026
Update .github/workflows/alpha.yml
nilsreichardt May 18, 2022
e91b52b
Remove "Remove credentials" step
nilsreichardt May 18, 2022
5244ffe
Merge branch 'android-alpha' of https://github.com/SharezoneApp/share…
nilsreichardt May 18, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 72 additions & 1 deletion .github/workflows/alpha.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,4 +60,75 @@ jobs:
SHAREZONE_PROD_KEY: ${{ secrets.FIREBASE_HOSTING_PROD_KEY }}
run: |
echo $SHAREZONE_PROD_KEY > sharezone-prod-key.json
sz deploy web-app --stage alpha --message "Workflow $GITHUB_JOB, commit $GITHUB_SHA" --credentials sharezone-prod-key.json
sz deploy web-app --stage alpha --message "Workflow $GITHUB_JOB, commit $GITHUB_SHA" --credentials sharezone-prod-key.json

deploy-alpha-android-app:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3

- name: Set Flutter version from FVM config file to environment variables
uses: kuhnroyal/flutter-fvm-config-action@v1

- name: Install Flutter
uses: subosito/flutter-action@v2
with:
flutter-version: ${{ env.FLUTTER_VERSION }}
channel: ${{ env.FLUTTER_CHANNEL }}

- name: Setup signing
working-directory: app/android
env:
KEYSTORE_STRING: ${{ secrets.SHAREZONE_ANDROID_APP_KEYSTORE_STRING }}
KEY_PASSWORD: ${{ secrets.SHAREZONE_ANDROID_APP_KEY_PASSWORD }}
KEY_ALIAS: ${{ secrets.SHAREZONE_ANDROID_APP_KEY_ALIAS }}
STORE_PASSWORD: ${{ secrets.SHAREZONE_ANDROID_APP_STORE_PASSWORD }}
run: |
echo $KEYSTORE_STRING | base64 -di > app/key.jks
echo "storePassword=$STORE_PASSWORD" >> key.properties
echo "keyPassword=$KEY_PASSWORD" >> key.properties
echo "keyAlias=$KEY_ALIAS" >> key.properties
echo "storeFile=key.jks" >> key.properties

- name: Build Android
working-directory: app
run: |
# We are publishing APKs instead of App Bundles to Firebase Distribution
# because they easier to install. App Bundles are installed via the
# PlayStore which resulted to problems in the fast.
nilsreichardt marked this conversation as resolved.
Show resolved Hide resolved

flutter build apk \
--release \
--flavor prod \
--dart-define DEVELOPMENT_STAGE=ALPHA

- name: Install Firebase CLI
run: sudo npm i -g firebase-tools

- name: Publish to Firebase Distribution
working-directory: app
env:
FIREBASE_DISTRIBUTION_KEY: ${{ secrets.GCP_SA_FIREBASE_DISTRIBUTION_PROD_KEY }}
run: |
# Set up credentials for Firebase Distribution
echo $FIREBASE_DISTRIBUTION_KEY > sharezone-prod-key.json
export GOOGLE_APPLICATION_CREDENTIALS=sharezone-prod-key.json

# Because we are publishing every commit a new alpha version, we are
# able to use the last commit message (title and description) as release
# note for the alpha builds. This is not the most user friendly note but
# it's better than nothing.
export LAST_COMMIT_MESSAGE=$(git log -1 --pretty=%B)

firebase appdistribution:distribute build/app/outputs/flutter-apk/app-prod-release.apk \
--app 1:730263787697:android:f0a3b3b856fd1383 \
--groups "alpha" \
--release-notes "$LAST_COMMIT_MESSAGE"

- name: Remove credentials
if: always()
run: |
rm app/sharezone-prod-key.json
rm app/android/key.properties
rm app/android/app/key.jks
nilsreichardt marked this conversation as resolved.
Show resolved Hide resolved
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it's not mentioned here than I wouldn't bother: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

But if you look here under "Register all secrets used within workflows" then we should maybe register these files as secrets?

Anyways if you leave this code then at least write via documentation that you're not fully sure yourself if that step is necessary. I personally don't think so.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now, I just removed step. Just in case we should remove the files or mark them as secret, we need to do this in other workflows as well. Therefore, I would do this in a different PR.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm, okay. Can you create an issue for marking them as secrets? (I'm currently on mobile) Just so that we don't forget:)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I opened #245 but I think the in the section "Register all secrets used within workflows" they are talking about something different. I understand that if we create a new secret within a workflow (like generating a JWT), you can mark this as secret so that this secret with not shown in the logs. But all the files that we created like sharzeone-prod-key.json, key.properties, etc. are just already registered secrets (just written in a file). So they should already be masked in the logs.

My concern was a different one. I was more thinking about that the company GitHub is compromised and someone got access to the GitHub Actions containers and is able to read all the files. Or we say that we don't trust GitHub that they really delete all files after finishing a workflow. I know that are rare cases but my idea was to just decrease the risk where we have the impact to do it (especially when it's so easy like here we just execute 3 commands).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was more thinking about that the company GitHub is compromised and someone got access to the GitHub Actions containers and is able to read all the files. Or we say that we don't trust GitHub that they really delete all files after finishing a workflow. I know that are rare cases but my idea was to just decrease the risk where we have the impact to do it (especially when it's so easy like here we just execute 3 commands).

I thought a bit about that doesn't make sense (except you don't trust GitHub that they do not delete the VMs immediately)