diff options
| author | Lena <lena@omega> | 2026-07-01 00:00:00 +0000 |
|---|---|---|
| committer | Lena <lena@omega> | 2026-07-13 22:00:29 +0000 |
| commit | 2aa6920fb1568249d2466fa1b13760d1a51c0e8f (patch) | |
| tree | 5cd196d2017228cac43f2574d559d9a59b123a47 /ci/build.sh | |
| parent | 2593151ca2c67256442ad25b074504e3ecd3371f (diff) | |
| download | rsend-2aa6920fb1568249d2466fa1b13760d1a51c0e8f.tar.gz | |
ci: pin toolchains and verify release artifacts
Checksum-pin every downloaded toolchain archive. Before publishing,
verify the APK was built from HEAD, the tag matches versionName,
apksigner passes, and the tree is clean; publish a sha256 sidecar
and treat published assets as immutable. Compare full unsigned APKs
in verify-repro and run the Android unit tests in CI.
Diffstat (limited to 'ci/build.sh')
| -rwxr-xr-x | ci/build.sh | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ci/build.sh b/ci/build.sh index 5afbfd4..c99ec5f 100755 --- a/ci/build.sh +++ b/ci/build.sh @@ -5,8 +5,8 @@ set -eu root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd) -make -C "$root" native make -C "$root" app +git -C "$root" rev-parse HEAD > "$root/app/build/outputs/apk/release/.source-commit" echo "ci: APK at app/build/outputs/apk/release/" -ls -l "$root"/app/build/outputs/apk/release/*.apk 2>/dev/null || true +ls -l "$root"/app/build/outputs/apk/release/*.apk |