mirror of
https://github.com/streamyfin/streamyfin.git
synced 2026-06-01 11:38:26 +01:00
217 lines
8.0 KiB
YAML
217 lines
8.0 KiB
YAML
name: 🚀 Release (EAS build + submit)
|
|
|
|
# On merge to main (gated by the `production` GitHub Environment approval),
|
|
# build all targets on EAS in parallel via custom bun build configs:
|
|
# 1. iOS phone → App Store (auto-submit)
|
|
# 2. tvOS → App Store (auto-submit)
|
|
# 3. Android AAB → Google Play (auto-submit)
|
|
# 4. Android phone APK→ downloadable artifact
|
|
# 5. Android TV APK → downloadable artifact
|
|
# Note: EAS queues builds based on your plan's concurrency; parallel jobs
|
|
# here just submit them — EAS may still run them serially.
|
|
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
approve:
|
|
name: 🔐 Approve release
|
|
runs-on: ubuntu-24.04
|
|
environment: production
|
|
steps:
|
|
- name: ✅ Release approved
|
|
run: echo "Release approved for ${{ github.sha }}"
|
|
|
|
build:
|
|
name: 🚀 ${{ matrix.name }}
|
|
needs: approve
|
|
runs-on: ubuntu-24.04
|
|
permissions:
|
|
contents: read
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- name: 🍎 iOS
|
|
platform: ios
|
|
profile: production
|
|
submit: true
|
|
- name: 📺 tvOS
|
|
platform: ios
|
|
profile: production_tv
|
|
submit: true
|
|
- name: 🤖 Android AAB
|
|
platform: android
|
|
profile: production
|
|
submit: true
|
|
- name: 🤖 Android APK
|
|
platform: android
|
|
profile: production-apk
|
|
submit: false
|
|
artifact_name: streamyfin-android-phone-apk
|
|
- name: 📺 Android TV APK
|
|
platform: android
|
|
profile: production-apk-tv
|
|
submit: false
|
|
artifact_name: streamyfin-android-tv-apk
|
|
|
|
steps:
|
|
- name: 📥 Checkout code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
fetch-depth: 0
|
|
submodules: recursive
|
|
show-progress: false
|
|
|
|
- name: 🍞 Setup Bun
|
|
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
|
|
with:
|
|
bun-version: latest
|
|
|
|
- name: 💾 Cache Bun dependencies
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
|
|
with:
|
|
path: ~/.bun/install/cache
|
|
key: ${{ runner.os }}-bun-cache-${{ hashFiles('bun.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-bun-cache
|
|
|
|
- name: 📦 Install dependencies and reload submodules
|
|
run: |
|
|
bun install --frozen-lockfile
|
|
bun run submodule-reload
|
|
|
|
- name: 🏗️ Setup EAS
|
|
uses: expo/expo-github-action@b184ff86a3c926240f1b6db41764c83a01c02eef # main
|
|
with:
|
|
eas-version: latest
|
|
token: ${{ secrets.EXPO_TOKEN }}
|
|
eas-cache: true
|
|
|
|
# tvOS uses credentialsSource: local — restore the gitignored
|
|
# credentials.json + cert + provisioning profiles from secrets.
|
|
- name: 🔐 Restore tvOS signing credentials
|
|
if: matrix.profile == 'production_tv'
|
|
env:
|
|
EAS_CREDENTIALS_JSON: ${{ secrets.EAS_CREDENTIALS_JSON }}
|
|
TVOS_DIST_CERT_P12_BASE64: ${{ secrets.TVOS_DIST_CERT_P12_BASE64 }}
|
|
TVOS_APP_PROFILE_BASE64: ${{ secrets.TVOS_APP_PROFILE_BASE64 }}
|
|
TVOS_TOPSHELF_PROFILE_BASE64: ${{ secrets.TVOS_TOPSHELF_PROFILE_BASE64 }}
|
|
run: |
|
|
mkdir -p certs profiles
|
|
printf '%s' "$EAS_CREDENTIALS_JSON" > credentials.json
|
|
echo "$TVOS_DIST_CERT_P12_BASE64" | base64 -d > certs/distribution.p12
|
|
echo "$TVOS_APP_PROFILE_BASE64" | base64 -d > profiles/Streamyfin_tvOS_App_Store.mobileprovision
|
|
echo "$TVOS_TOPSHELF_PROFILE_BASE64" | base64 -d > profiles/Streamyfin_TopShelf_tvOS_App_Store.mobileprovision
|
|
|
|
# Android Play submit needs the Google Play service account JSON.
|
|
- name: 🔐 Restore Google Play service account
|
|
if: matrix.platform == 'android' && matrix.submit
|
|
env:
|
|
GOOGLE_SERVICE_ACCOUNT_KEY: ${{ secrets.GOOGLE_SERVICE_ACCOUNT_KEY }}
|
|
run: printf '%s' "$GOOGLE_SERVICE_ACCOUNT_KEY" > google-service-account.json
|
|
|
|
# App Store Connect API key for iOS/tvOS submit (raw-PEM or base64).
|
|
- name: 🔐 Restore App Store Connect API key
|
|
if: matrix.platform == 'ios'
|
|
env:
|
|
APPLE_KEY_CONTENT: ${{ secrets.APPLE_KEY_CONTENT }}
|
|
run: |
|
|
if printf '%s' "$APPLE_KEY_CONTENT" | grep -q "BEGIN PRIVATE KEY"; then
|
|
printf '%s' "$APPLE_KEY_CONTENT" > "$RUNNER_TEMP/asc_api_key.p8"
|
|
else
|
|
printf '%s' "$APPLE_KEY_CONTENT" | base64 -d > "$RUNNER_TEMP/asc_api_key.p8"
|
|
fi
|
|
|
|
# ── Submit builds: cloud build + auto-submit to the store ──
|
|
- name: 🚀 Build & submit (${{ matrix.name }})
|
|
if: matrix.submit
|
|
env:
|
|
EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
|
|
EXPO_ASC_API_KEY_PATH: ${{ runner.temp }}/asc_api_key.p8
|
|
EXPO_ASC_KEY_ID: ${{ secrets.APPLE_KEY_ID }}
|
|
EXPO_ASC_ISSUER_ID: ${{ secrets.APPLE_KEY_ISSUER_ID }}
|
|
run: |
|
|
eas build \
|
|
--platform ${{ matrix.platform }} \
|
|
--profile ${{ matrix.profile }} \
|
|
--auto-submit \
|
|
--non-interactive \
|
|
--wait
|
|
|
|
# ── Artifact builds: cloud build, then download + upload the APK ──
|
|
- name: 🏗️ Build artifact (${{ matrix.name }})
|
|
if: ${{ !matrix.submit }}
|
|
env:
|
|
EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
|
|
run: |
|
|
eas build \
|
|
--platform ${{ matrix.platform }} \
|
|
--profile ${{ matrix.profile }} \
|
|
--non-interactive \
|
|
--wait \
|
|
--json > build-result.json
|
|
URL=$(node -e "const b=require('./build-result.json'); const x=Array.isArray(b)?b[0]:b; console.log(x.artifacts.applicationArchiveUrl)")
|
|
echo "Downloading artifact: $URL"
|
|
curl -fL "$URL" -o "${{ matrix.artifact_name }}.apk"
|
|
|
|
- name: 📤 Upload APK artifact (${{ matrix.name }})
|
|
if: ${{ !matrix.submit }}
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: ${{ matrix.artifact_name }}
|
|
path: ${{ matrix.artifact_name }}.apk
|
|
retention-days: 14
|
|
|
|
# Draft a GitHub Release with the two APKs attached. The tag comes from the
|
|
# merged-in app version (app.json → expo.version), NOT the auto-incremented
|
|
# build number — so cutting a release is a deliberate version bump via PR.
|
|
github-release:
|
|
name: 📦 Draft GitHub Release
|
|
needs: build
|
|
if: ${{ !cancelled() }}
|
|
runs-on: ubuntu-24.04
|
|
permissions:
|
|
contents: write
|
|
actions: read # required for `gh run download` to list/fetch this run's artifacts
|
|
steps:
|
|
- name: 📥 Checkout code
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
fetch-depth: 0
|
|
show-progress: false
|
|
|
|
- name: 📦 Download APK artifacts from this run
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
mkdir -p apks
|
|
gh run download ${{ github.run_id }} --name streamyfin-android-phone-apk --dir apks
|
|
gh run download ${{ github.run_id }} --name streamyfin-android-tv-apk --dir apks
|
|
ls -la apks
|
|
|
|
- name: 📝 Draft release (tag = app.json version, not auto-bumped)
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
VERSION=$(node -e "console.log(require('./app.json').expo.version)")
|
|
TAG="v$VERSION"
|
|
echo "Release tag from merged app version: $TAG"
|
|
if gh release view "$TAG" >/dev/null 2>&1; then
|
|
echo "Release $TAG exists — updating APK assets"
|
|
gh release upload "$TAG" apks/*.apk --clobber
|
|
else
|
|
echo "Creating draft release $TAG"
|
|
gh release create "$TAG" \
|
|
--draft \
|
|
--generate-notes \
|
|
--title "$TAG" \
|
|
apks/*.apk
|
|
fi
|