From f1c75a631b9f45285ff0e26af0b8651cd2d5df3e Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 20 Aug 2026 08:30:43 +0000 Subject: [PATCH 1/2] fix(ci): make release workflow tag-only safe Co-authored-by: Cea --- .github/workflows/release.yml | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cd8f82a..b1a154c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,6 +14,7 @@ concurrency: jobs: release: + if: startsWith(github.ref, 'refs/tags/v') runs-on: ubuntu-latest steps: - name: Checkout @@ -47,13 +48,22 @@ jobs: uses: android-actions/setup-android@v3 - name: Decode release keystore - if: ${{ secrets.SIGNING_KEYSTORE_BASE64 != '' }} + env: + SIGNING_KEYSTORE_BASE64: ${{ secrets.SIGNING_KEYSTORE_BASE64 }} + SIGNING_STORE_PASSWORD: ${{ secrets.SIGNING_STORE_PASSWORD }} + SIGNING_KEY_ALIAS: ${{ secrets.SIGNING_KEY_ALIAS }} + SIGNING_KEY_PASSWORD: ${{ secrets.SIGNING_KEY_PASSWORD }} run: | - echo "${{ secrets.SIGNING_KEYSTORE_BASE64 }}" | base64 -d > "${RUNNER_TEMP}/timesense.jks" + if [[ -z "${SIGNING_KEYSTORE_BASE64}" ]]; then + echo "No release keystore configured; Gradle will use the debug signing fallback." + exit 0 + fi + + echo "${SIGNING_KEYSTORE_BASE64}" | base64 -d > "${RUNNER_TEMP}/timesense.jks" echo "TIMESENSE_KEYSTORE=${RUNNER_TEMP}/timesense.jks" >> "$GITHUB_ENV" - echo "TIMESENSE_STORE_PASSWORD=${{ secrets.SIGNING_STORE_PASSWORD }}" >> "$GITHUB_ENV" - echo "TIMESENSE_KEY_ALIAS=${{ secrets.SIGNING_KEY_ALIAS }}" >> "$GITHUB_ENV" - echo "TIMESENSE_KEY_PASSWORD=${{ secrets.SIGNING_KEY_PASSWORD }}" >> "$GITHUB_ENV" + echo "TIMESENSE_STORE_PASSWORD=${SIGNING_STORE_PASSWORD}" >> "$GITHUB_ENV" + echo "TIMESENSE_KEY_ALIAS=${SIGNING_KEY_ALIAS}" >> "$GITHUB_ENV" + echo "TIMESENSE_KEY_PASSWORD=${SIGNING_KEY_PASSWORD}" >> "$GITHUB_ENV" - name: Assemble release run: | From 1188081543b697a96cb43b8a24e4e0de399bc2d0 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 20 Aug 2026 08:33:51 +0000 Subject: [PATCH 2/2] fix(app): harden release signing fallback Co-authored-by: Cea --- app/build.gradle.kts | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/app/build.gradle.kts b/app/build.gradle.kts index ee84047..00ca087 100644 --- a/app/build.gradle.kts +++ b/app/build.gradle.kts @@ -6,7 +6,9 @@ plugins { val ciVersionName = (findProperty("versionName") as String?)?.takeIf { it.isNotBlank() } val ciVersionCode = (findProperty("versionCode") as String?)?.toIntOrNull() -val keystorePath = System.getenv("TIMESENSE_KEYSTORE").orEmpty() +fun nonBlankEnv(name: String): String? = System.getenv(name)?.takeIf { it.isNotBlank() } + +val keystorePath = nonBlankEnv("TIMESENSE_KEYSTORE").orEmpty() val releaseKeystore = keystorePath.takeIf { it.isNotBlank() }?.let { file(it) }?.takeIf { it.isFile } android { @@ -25,10 +27,10 @@ android { if (releaseKeystore != null) { create("release") { storeFile = releaseKeystore - storePassword = System.getenv("TIMESENSE_STORE_PASSWORD") ?: "" - keyAlias = System.getenv("TIMESENSE_KEY_ALIAS") ?: "upload" - keyPassword = System.getenv("TIMESENSE_KEY_PASSWORD") - ?: System.getenv("TIMESENSE_STORE_PASSWORD") + storePassword = nonBlankEnv("TIMESENSE_STORE_PASSWORD") ?: "" + keyAlias = nonBlankEnv("TIMESENSE_KEY_ALIAS") ?: "upload" + keyPassword = nonBlankEnv("TIMESENSE_KEY_PASSWORD") + ?: nonBlankEnv("TIMESENSE_STORE_PASSWORD") ?: "" } }