ci(android): sign with ephemeral keystore when secret is absent - #114
Open
DonLakeFlyer wants to merge 1 commit into
Open
ci(android): sign with ephemeral keystore when secret is absent#114DonLakeFlyer wants to merge 1 commit into
DonLakeFlyer wants to merge 1 commit into
Conversation
Dependabot and fork pull requests run without repository Actions secrets, so QT_ANDROID_KEYSTORE_STORE_PASS resolved to an empty string and apksigner fell back to prompting for the password on a closed stdin, failing the build. Generate a throwaway debug keystore and override the keystore environment variables when the secret is unavailable, matching the upstream workflow. Signed builds on master and tags are unaffected.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new keystore fallback can also activate on push/tag runs if the signing secret is absent, which risks producing artifacts signed with an ephemeral debug key instead of failing fast.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR adjusts the Android GitHub Actions workflow to avoid CI failures on fork/Dependabot pull requests by generating an ephemeral keystore when repository secrets are unavailable, preventing apksigner from prompting on closed stdin.
Changes:
- Add a conditional “Create Debug Keystore” step that generates a temporary keystore in
$RUNNER_TEMPwhen the signing password env var is empty. - Override
QT_ANDROID_KEYSTORE_*variables via$GITHUB_ENVso downstream CMake/Gradle signing proceeds non-interactively.
File summaries
| File | Description |
|---|---|
| .github/workflows/android.yml | Adds an ephemeral-keystore fallback for PR contexts without secrets to keep Android CI builds from failing at the signing step. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+62
to
+77
| # Dependabot and fork PRs get no repo secrets, leaving apksigner prompting on closed stdin. | ||
| - name: Create Debug Keystore | ||
| if: ${{ env.QT_ANDROID_KEYSTORE_STORE_PASS == '' }} | ||
| run: | | ||
| keytool -genkey -v \ | ||
| -keystore "${RUNNER_TEMP}/debug.keystore" \ | ||
| -storepass android -alias androiddebugkey -keypass android \ | ||
| -keyalg RSA -keysize 2048 -validity 10000 \ | ||
| -dname "CN=Android Debug,O=Android,C=US" | ||
| { | ||
| echo "QT_ANDROID_KEYSTORE_PATH=${RUNNER_TEMP}/debug.keystore" | ||
| echo "QT_ANDROID_KEYSTORE_ALIAS=androiddebugkey" | ||
| echo "QT_ANDROID_KEYSTORE_STORE_PASS=android" | ||
| echo "QT_ANDROID_KEYSTORE_KEY_PASS=android" | ||
| } >> "$GITHUB_ENV" | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Android CI job fails on Dependabot and fork pull requests (e.g. #113):
These runs have no access to repository Actions secrets, so
QT_ANDROID_KEYSTORE_STORE_PASSresolves to an empty string.apksignerthenfalls back to prompting for the password interactively, and stdin is closed on
the runner, so the build dies at the signing step after a full ~18 minute compile.
Fix
Port the
Create Debug Keystoreguard from the upstreammavlink/qgroundcontrolAndroid workflow. When the signing secret is empty, generate a throwaway keystore
into
$RUNNER_TEMPwithkeytooland override the fourQT_ANDROID_KEYSTORE_*variables via
$GITHUB_ENV.master/ tag pushes: secret present, step skipped, APK signed with thecommitted keystore exactly as before.
runner. No credential literal is attached to a committed private key.
Testing
pre-commitpasses on the changed file (actionlint, zizmor, yamllint, TruffleHog).