Automatically sign app releases

Author: pimterry

.github/workflows/ci.yml

@@ -17,11 +17,13 @@ jobs:
 
       - name: Build release
         run: ./gradlew assembleRelease
+        env:
+          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
 
       - uses: actions/upload-artifact@v2
         with:
           name: app
-          path: app/build/outputs/apk/release/app-release-unsigned.apk
+          path: app/build/outputs/apk/release/app-*.apk
           if-no-files-found: error
 
   deploy:
@@ -41,6 +43,6 @@ jobs:
         with:
           prerelease: true
           asset_name: pinning-demo.apk
-          file: ${{ steps.get_apk.outputs.download-path }}/app-release-unsigned.apk
+          file: ${{ steps.get_apk.outputs.download-path }}/app-release.apk
           tag: ${{ github.ref }}
           repo_token: ${{ secrets.GITHUB_TOKEN }}

app/build.gradle

@@ -3,6 +3,9 @@ plugins {
     id 'kotlin-android'
 }
 
+def keyStorePassword = System.getenv('KEYSTORE_PASSWORD')
+def keyAvailable = !!keyStorePassword
+
 android {
     compileSdkVersion 30
     buildToolsVersion "30.0.2"
@@ -17,9 +20,23 @@ android {
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
     }
 
+    signingConfigs {
+        release {
+            storeFile file("./keystore.jks")
+            storePassword keyStorePassword
+            keyAlias "signing_key"
+            keyPassword keyStorePassword
+        }
+    }
+
     buildTypes {
         release {
             minifyEnabled false
+            if (keyAvailable) {
+                signingConfig signingConfigs.release
+            } else {
+                logger.warn('No signing key available')
+            }
             proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
         }
     }