Harmonize signing workflows with the repo's actual secret names - #35
Merged
Conversation
The four Android signing secrets already exist in this repo under the ANDROID_ prefix (ANDROID_KEYSTORE_BASE64, ANDROID_KEYSTORE_PASSWORD, ANDROID_KEY_ALIAS, ANDROID_KEY_PASSWORD), but build-apk.yml and release.yml still referenced them as secrets.RELEASE_*, a mismatch that would make both workflows read empty secrets and fail signing at build time. Updated only the secrets.RELEASE_* -> secrets.ANDROID_* references (plus one stale comment naming the old secret in prose) in both workflow files. Left the RELEASE_KEYSTORE_PATH/RELEASE_KEYSTORE_PASSWORD/ RELEASE_KEY_ALIAS/RELEASE_KEY_PASSWORD environment variable names untouched: app/build.gradle.kts's signingConfigs block reads those exact names via System.getenv(), an internal contract between the workflows and Gradle that has nothing to do with the GitHub secret name and would gain nothing from renaming. Updated docs/release-signing.md's secret-name table to match and added a note explaining the ANDROID_*/RELEASE_* naming split, so the next person following that doc doesn't recreate the same mismatch. RELEASE_PUSH_TOKEN is untouched (name already matched). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018zXVpxEbSWadqKyntXTXD6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The four Android signing secrets already exist in this repo under the
ANDROID_prefix (ANDROID_KEYSTORE_BASE64,ANDROID_KEYSTORE_PASSWORD,ANDROID_KEY_ALIAS,ANDROID_KEY_PASSWORD), butbuild-apk.ymlandrelease.ymlstill referenced them assecrets.RELEASE_*— a mismatch that would make both workflows read empty secrets and fail signing at build time.Changes
.github/workflows/build-apk.yml,.github/workflows/release.yml: updated only thesecrets.RELEASE_*→secrets.ANDROID_*references (plus one stale comment naming the old secret in prose).docs/release-signing.md: updated the secret-name table to match, and added a note explaining the naming split described below.What was deliberately left alone
The
RELEASE_KEYSTORE_PATH/RELEASE_KEYSTORE_PASSWORD/RELEASE_KEY_ALIAS/RELEASE_KEY_PASSWORDenvironment variable names inside the workflow jobs are untouched:app/build.gradle.kts'ssigningConfigsblock reads those exact names viaSystem.getenv(...), an internal contract between the workflows and Gradle that has nothing to do with the GitHub secret name and would gain nothing from renaming.RELEASE_PUSH_TOKENis untouched too — its name already matched.Test plan
build-apk.ymlmanually (workflow_dispatch) and confirm the release APK builds and is signed (the "Print release keystore SHA-1" step should show a real certificate, not fail on empty secrets).release.yml's next real run decodes the keystore and signs successfully before it touchesmain.🤖 Generated with Claude Code
https://claude.ai/code/session_018zXVpxEbSWadqKyntXTXD6
Generated by Claude Code