1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
#!/bin/sh
# Publish a signed release APK to a Codeberg (Forgejo) release. Run on a tag,
# after ci/build.sh has produced a signed app-release.apk (signing happens when
# keystore.properties is present).
#
# Environment:
# CODEBERG_TOKEN Forgejo API token (secret)
# CODEBERG_REPO owner/name, e.g. lena/rsend
# TAG release tag (defaults to CI_COMMIT_TAG)
# CODEBERG_URL base URL (defaults to https://codeberg.org)
set -eu
: "${CODEBERG_TOKEN:?set CODEBERG_TOKEN}"
: "${CODEBERG_REPO:?set CODEBERG_REPO as owner/name}"
tag=${TAG:-${CI_COMMIT_TAG:?set TAG or CI_COMMIT_TAG}}
base=${CODEBERG_URL:-https://codeberg.org}
base=${base%/}
root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
apk="$root/app/build/outputs/apk/release/app-release.apk"
source_commit="$root/app/build/outputs/apk/release/.source-commit"
[ -f "$apk" ] || { echo "release: $apk not found; run ci/build.sh first" >&2; exit 1; }
[ -f "$source_commit" ] || { echo "release: build provenance not found; run ci/build.sh first" >&2; exit 1; }
command -v apksigner >/dev/null 2>&1 || { echo "release: apksigner is required" >&2; exit 1; }
apksigner verify --verbose --print-certs "$apk"
[ -z "$(git -C "$root" status --porcelain --untracked-files=normal)" ] || {
echo "release: working tree is not clean" >&2
exit 1
}
case $CODEBERG_REPO in
*[!A-Za-z0-9._/-]*|*/*/*|/*|*/)
echo "release: invalid CODEBERG_REPO" >&2
exit 1
;;
*/*) ;;
*)
echo "release: CODEBERG_REPO must be owner/name" >&2
exit 1
;;
esac
head=$(git -C "$root" rev-parse HEAD)
IFS= read -r built_commit < "$source_commit"
[ "$built_commit" = "$head" ] || { echo "release: APK was not built from HEAD" >&2; exit 1; }
git check-ref-format "refs/tags/$tag" >/dev/null 2>&1 || { echo "release: invalid tag $tag" >&2; exit 1; }
tag_head=$(git -C "$root" rev-parse --verify "$tag^{commit}")
[ "$head" = "$tag_head" ] || { echo "release: $tag does not point to HEAD" >&2; exit 1; }
version=$(python3 -c 'import re,sys
s=open(sys.argv[1]).read()
m=re.search(r"^\s*versionName [\x27\x22]([^\x27\x22]+)", s, re.M)
print(m.group(1) if m else "")' "$root/app/build.gradle")
[ "$tag" = "$version" ] || { echo "release: tag $tag does not match app version $version" >&2; exit 1; }
quote() {
python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$1"
}
api="$base/api/v1/repos/$CODEBERG_REPO"
auth="Authorization: token $CODEBERG_TOKEN"
name="rsend-$tag.apk"
sum_name="$name.sha256"
tag_url=$(quote "$tag")
name_url=$(quote "$name")
sum_name_url=$(quote "$sum_name")
sum=$(mktemp)
trap 'rm -f "$sum"' 0
sha256sum "$apk" | { read -r hash _; printf '%s %s\n' "$hash" "$name"; } > "$sum"
# Reuse the tag's release if it exists, else create it. Published assets are
# immutable: a rerun uploads only missing assets and never replaces one.
id=$(curl -fsS -H "$auth" "$api/releases/tags/$tag_url" 2>/dev/null \
| python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])' 2>/dev/null) || id=
if [ -n "$id" ]; then
assets=$(curl -fsS -H "$auth" "$api/releases/$id/assets")
else
payload=$(python3 -c 'import json,sys; print(json.dumps({"tag_name":sys.argv[1],"name":sys.argv[1]}))' "$tag")
id=$(curl -fsS -X POST "$api/releases" \
-H "$auth" -H "Content-Type: application/json" \
-d "$payload" \
| python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])')
fi
[ -n "$id" ] || { echo "release: could not create release for $tag" >&2; exit 1; }
has_asset() {
printf '%s' "${assets:-[]}" | python3 -c 'import json,sys
name=sys.argv[1]
raise SystemExit(0 if any(a["name"] == name for a in json.load(sys.stdin)) else 1)' "$1"
}
if ! has_asset "$name"; then
curl -fsS -X POST "$api/releases/$id/assets?name=$name_url" \
-H "$auth" \
-F "attachment=@$apk" >/dev/null
fi
if ! has_asset "$sum_name"; then
curl -fsS -X POST "$api/releases/$id/assets?name=$sum_name_url" \
-H "$auth" \
-F "attachment=@$sum" >/dev/null
fi
echo "release: $name and $sum_name are present on $CODEBERG_REPO ($tag)"
|