gowalk-cicd 1.0.0

package/android-action/scripts/bitrise_deploy.py

@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+"""Deploy Android through Bitrise instead of building locally.
+
+Enabled by dropping a ``creds/bitrise.json`` config in the consumer repo:
+
+    {
+      "enabled": true,
+      "app_slug": "8b2a7a24-....",     // Bitrise app slug
+      "workflow": "android-deploy",     // Bitrise workflow to run
+      "branch": "main",                 // optional; defaults to the pushed ref
+      "api_token": "bitpat_...."        // optional; else env BITRISE_API_TOKEN
+    }
+
+Use this when the Google Play upload key / signing secrets live in Bitrise
+(not in the repo) — the GitHub Actions runner cannot sign the AAB, so it
+triggers the Bitrise ``android-deploy`` workflow (which holds the keystore
+and service-account secrets) and waits for it to finish, mirroring the
+build's success/failure back into the GitHub Actions job.
+
+The Bitrise API token is a repo-scoped secret; committing it to a PRIVATE
+repo's ``creds/`` follows the same trust model as the ASC ``.p8`` key that
+already lives there. Prefer the ``BITRISE_API_TOKEN`` env (from an Actions
+secret) when the repo is not private.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+import time
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+API = "https://api.bitrise.io/v0.1"
+POLL_SECONDS = int(os.getenv("BITRISE_POLL_SECONDS", "20"))
+# Bitrise build status codes: 0 = not finished, 1 = success, 2 = failed,
+# 3 = aborted, 4 = aborted-with-success (skipped).
+STATUS_TEXT = {0: "in-progress", 1: "success", 2: "failed", 3: "aborted",
+               4: "aborted (success)"}
+
+
+def fail(msg: str) -> "None":
+    print(f"::error::{msg}")
+    raise SystemExit(1)
+
+
+def load_config() -> dict:
+    workspace = Path(os.getenv("GITHUB_WORKSPACE", os.getcwd()))
+    cfg_path = workspace / "creds" / "bitrise.json"
+    if not cfg_path.is_file():
+        fail("creds/bitrise.json not found but Bitrise mode was selected")
+    try:
+        cfg = json.loads(cfg_path.read_text())
+    except ValueError as exc:
+        fail(f"creds/bitrise.json is not valid JSON: {exc}")
+    if not cfg.get("app_slug"):
+        fail("creds/bitrise.json missing required 'app_slug'")
+    return cfg
+
+
+def resolve_token(cfg: dict) -> str:
+    token = os.getenv("BITRISE_API_TOKEN") or cfg.get("api_token")
+    if not token:
+        fail("No Bitrise API token: set creds/bitrise.json 'api_token' or "
+             "the BITRISE_API_TOKEN env/secret")
+    return token
+
+
+def resolve_branch(cfg: dict) -> str:
+    if cfg.get("branch"):
+        return cfg["branch"]
+    ref = os.getenv("GITHUB_REF", "")
+    if ref.startswith("refs/heads/"):
+        return ref[len("refs/heads/"):]
+    return "main"
+
+
+def api(method: str, path: str, token: str, body: dict | None = None) -> dict:
+    data = json.dumps(body).encode() if body is not None else None
+    req = urllib.request.Request(
+        API + path, data=data, method=method,
+        headers={"Authorization": token, "Content-Type": "application/json"},
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=60) as resp:
+            return json.loads(resp.read().decode())
+    except urllib.error.HTTPError as exc:
+        detail = exc.read().decode()[:400]
+        fail(f"Bitrise API {method} {path} -> HTTP {exc.code}: {detail}")
+    except urllib.error.URLError as exc:
+        fail(f"Bitrise API {method} {path} unreachable: {exc}")
+    return {}  # unreachable (fail raises)
+
+
+def trigger(cfg: dict, token: str, branch: str) -> tuple[str, int, str]:
+    workflow = cfg.get("workflow", "android-deploy")
+    body = {
+        "hook_info": {"type": "bitrise"},
+        "build_params": {"branch": branch, "workflow_id": workflow},
+    }
+    commit = os.getenv("GITHUB_SHA")
+    if commit:
+        body["build_params"]["commit_hash"] = commit
+    resp = api("POST", f"/apps/{cfg['app_slug']}/builds", token, body)
+    if resp.get("status") != "ok":
+        fail(f"Bitrise refused the build trigger: {resp}")
+    return resp["build_slug"], resp["build_number"], workflow
+
+
+def poll(app_slug: str, build_slug: str, token: str) -> int:
+    last = None
+    while True:
+        data = api("GET", f"/apps/{app_slug}/builds/{build_slug}", token)["data"]
+        status = data.get("status", 0)
+        text = data.get("status_text", STATUS_TEXT.get(status, "?"))
+        if text != last:
+            print(f"  Bitrise build status: {text}")
+            last = text
+        if status != 0:
+            return status
+        time.sleep(POLL_SECONDS)
+
+
+def print_tail_log(app_slug: str, build_slug: str, token: str) -> None:
+    try:
+        data = api("GET", f"/apps/{app_slug}/builds/{build_slug}/log", token)
+    except SystemExit:
+        return
+    chunks = "".join(c.get("chunk", "") for c in data.get("log_chunks", []))
+    if chunks:
+        print("::group::Bitrise build log (tail)")
+        print("\n".join(chunks.splitlines()[-60:]))
+        print("::endgroup::")
+
+
+def main() -> None:
+    cfg = load_config()
+    token = resolve_token(cfg)
+    branch = resolve_branch(cfg)
+    app_slug = cfg["app_slug"]
+
+    build_slug, build_number, workflow = trigger(cfg, token, branch)
+    url = f"https://app.bitrise.io/build/{build_slug}"
+    print(f"Triggered Bitrise workflow '{workflow}' build #{build_number} "
+          f"on branch '{branch}'")
+    print(f"  {url}")
+
+    status = poll(app_slug, build_slug, token)
+    if status == 1:
+        print(f"::notice::Bitrise build #{build_number} succeeded ({url})")
+        return
+    print_tail_log(app_slug, build_slug, token)
+    fail(f"Bitrise build #{build_number} finished with status "
+         f"'{STATUS_TEXT.get(status, status)}' ({url})")
+
+
+if __name__ == "__main__":
+    main()

package/android-action/scripts/find_bundle.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python3
+"""Publish the single generated Android App Bundle as an action output."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+from android_config import ConfigError, detect_bundle
+
+
+def main() -> None:
+    workspace = Path(os.environ.get("GITHUB_WORKSPACE", ".")).resolve()
+    try:
+        bundle = detect_bundle(workspace).resolve()
+    except ConfigError as exc:
+        print(f"::error::{exc}")
+        raise SystemExit(1) from exc
+    with Path(os.environ["GITHUB_OUTPUT"]).open("a") as stream:
+        stream.write(f"bundle_path={bundle}\n")
+    print(f"Built Android App Bundle: {bundle}")
+
+
+if __name__ == "__main__":
+    main()

package/android-action/scripts/play_preflight.py

@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+"""Check whether Google Play accepts API edits for this package."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+
+import google.auth.transport.requests
+import requests
+from google.oauth2 import service_account
+
+
+SCOPE = "https://www.googleapis.com/auth/androidpublisher"
+BASE_URL = "https://androidpublisher.googleapis.com/androidpublisher/v3"
+
+
+def write_ready(value: bool) -> None:
+    with Path(os.environ["GITHUB_OUTPUT"]).open("a") as stream:
+        stream.write(f"ready={'true' if value else 'false'}\n")
+
+
+def response_message(response: requests.Response) -> str:
+    try:
+        payload = response.json()
+        return str(payload.get("error", {}).get("message", "unknown API error"))[:500]
+    except (ValueError, AttributeError):
+        return "unknown API error"
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--package", required=True)
+    parser.add_argument("--service-account", required=True, type=Path)
+    args = parser.parse_args()
+
+    credentials = service_account.Credentials.from_service_account_file(
+        args.service_account, scopes=[SCOPE]
+    )
+    credentials.refresh(google.auth.transport.requests.Request())
+    headers = {"Authorization": f"Bearer {credentials.token}"}
+    url = f"{BASE_URL}/applications/{args.package}/edits"
+    response = requests.post(url, headers=headers, json={}, timeout=30)
+    if response.status_code == 404:
+        write_ready(False)
+        print(
+            "::warning::Google Play package is not API-ready. Download the "
+            "android-first-release artifact and upload it once in Play Console; "
+            "later runs will deploy automatically."
+        )
+        return
+    if response.status_code != 200:
+        message = response_message(response)
+        raise SystemExit(f"Google Play preflight failed ({response.status_code}): {message}")
+
+    edit_id = json.loads(response.text)["id"]
+    delete_url = f"{url}/{edit_id}"
+    deleted = requests.delete(delete_url, headers=headers, timeout=30)
+    if deleted.status_code not in (200, 204):
+        message = response_message(deleted)
+        raise SystemExit(f"cannot close Google Play preflight edit: {message}")
+    write_ready(True)
+    print("Google Play package is ready for automated uploads")
+
+
+if __name__ == "__main__":
+    main()

package/android-action/scripts/resolve_android.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""Resolve Android credentials and app metadata without exposing secrets."""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+from android_config import (
+    ConfigError,
+    detect_package_name,
+    find_play_service_account,
+    find_signing_config,
+)
+
+
+def append_value(path: Path, name: str, value: str) -> None:
+    with path.open("a") as stream:
+        stream.write(f"{name}={value}\n")
+
+
+def resolve_build_number(raw: str) -> int:
+    try:
+        number = int(raw)
+    except ValueError as exc:
+        raise ConfigError(f"Android build number must be an integer: {raw!r}") from exc
+    if not 1 <= number <= 2_100_000_000:
+        raise ConfigError("Android build number must be between 1 and 2100000000")
+    return number
+
+
+def main() -> None:
+    workspace = Path(os.environ.get("GITHUB_WORKSPACE", ".")).resolve()
+    env_path = Path(os.environ["GITHUB_ENV"])
+    output_path = Path(os.environ["GITHUB_OUTPUT"])
+    try:
+        if not (workspace / "pubspec.yaml").is_file():
+            raise ConfigError("pubspec.yaml not found; Android action requires Flutter")
+        signing = find_signing_config(workspace)
+        service_account = find_play_service_account(workspace)
+        package_name = os.environ.get("INPUT_PACKAGE_NAME") or detect_package_name(workspace)
+        raw_number = os.environ.get("INPUT_BUILD_NUMBER") or os.environ.get("GITHUB_RUN_NUMBER", "")
+        build_number = resolve_build_number(raw_number)
+    except (ConfigError, KeyError, OSError) as exc:
+        print(f"::error::{exc}")
+        raise SystemExit(1) from exc
+
+    for secret in (signing.store_password, signing.key_password):
+        print(f"::add-mask::{secret}")
+    values = {
+        "ANDROID_PACKAGE_NAME": package_name,
+        "ANDROID_BUILD_NUMBER": str(build_number),
+        "ANDROID_SIGNING_PROPERTIES": str(signing.properties_path),
+        "ANDROID_KEYSTORE_PATH": str(signing.keystore_path),
+        "ANDROID_PLAY_SERVICE_ACCOUNT": str(service_account),
+    }
+    for name, value in values.items():
+        append_value(env_path, name, value)
+    for name, value in (
+        ("package_name", package_name),
+        ("service_account", str(service_account)),
+        ("build_number", str(build_number)),
+    ):
+        append_value(output_path, name, value)
+    print(f"Resolved Android package {package_name}, build {build_number}")
+
+
+if __name__ == "__main__":
+    main()

package/android-action/scripts/sign_bundle.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""Replace any development signature on an AAB with the upload key."""
+
+from __future__ import annotations
+
+import argparse
+import subprocess
+from pathlib import Path
+
+from android_config import ConfigError, parse_properties
+
+
+def run(command: list[str], *, allowed: set[int] | None = None) -> None:
+    completed = subprocess.run(command, check=False)
+    accepted = allowed or {0}
+    if completed.returncode not in accepted:
+        raise ConfigError(f"command failed with exit code {completed.returncode}: {command[0]}")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--bundle", required=True, type=Path)
+    parser.add_argument("--properties", required=True, type=Path)
+    parser.add_argument("--keystore", required=True, type=Path)
+    args = parser.parse_args()
+
+    try:
+        values = parse_properties(args.properties)
+        store_password = values["storePassword"]
+        key_password = values["keyPassword"]
+        key_alias = values["keyAlias"]
+        if not args.bundle.is_file():
+            raise ConfigError(f"bundle does not exist: {args.bundle}")
+        for secret in (store_password, key_password):
+            print(f"::add-mask::{secret}")
+        run(
+            [
+                "zip",
+                "-d",
+                str(args.bundle),
+                "META-INF/*.SF",
+                "META-INF/*.RSA",
+                "META-INF/*.DSA",
+                "META-INF/*.EC",
+                "META-INF/SIG-*",
+            ],
+            allowed={0, 12},
+        )
+        run(
+            [
+                "jarsigner",
+                "-keystore",
+                str(args.keystore),
+                "-storepass",
+                store_password,
+                "-keypass",
+                key_password,
+                str(args.bundle),
+                key_alias,
+            ]
+        )
+        run(["jarsigner", "-verify", str(args.bundle)])
+    except (ConfigError, KeyError, OSError) as exc:
+        print(f"::error::{exc}")
+        raise SystemExit(1) from exc
+    print(f"Signed Android App Bundle: {args.bundle}")
+
+
+if __name__ == "__main__":
+    main()

package/android-action/scripts/test_android_config.py

@@ -0,0 +1,97 @@
+#!/usr/bin/env python3
+
+from __future__ import annotations
+
+import json
+import tempfile
+import unittest
+from pathlib import Path
+
+from android_config import (
+    ConfigError,
+    detect_bundle,
+    detect_package_name,
+    find_play_service_account,
+    find_signing_config,
+)
+
+
+class AndroidConfigTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temp = tempfile.TemporaryDirectory()
+        self.workspace = Path(self.temp.name)
+        (self.workspace / "creds").mkdir()
+
+    def tearDown(self) -> None:
+        self.temp.cleanup()
+
+    def test_finds_arbitrarily_named_service_account(self) -> None:
+        path = self.workspace / "creds" / "Gowalk.json"
+        path.write_text(
+            json.dumps(
+                {
+                    "type": "service_account",
+                    "client_email": "ci@example.invalid",
+                    "private_key": "secret",
+                }
+            )
+        )
+        (self.workspace / "creds" / "metadata.json").write_text("{}")
+
+        self.assertEqual(find_play_service_account(self.workspace), path.resolve())
+
+    def test_rejects_multiple_service_accounts(self) -> None:
+        payload = json.dumps(
+            {
+                "type": "service_account",
+                "client_email": "ci@example.invalid",
+                "private_key": "secret",
+            }
+        )
+        (self.workspace / "creds" / "one.json").write_text(payload)
+        (self.workspace / "creds" / "two.json").write_text(payload)
+
+        with self.assertRaisesRegex(ConfigError, "multiple Google Play"):
+            find_play_service_account(self.workspace)
+
+    def test_loads_signing_config_next_to_keystore(self) -> None:
+        properties = self.workspace / "creds" / "android-signing.properties"
+        properties.write_text(
+            "storeFile=android-upload-key.jks\n"
+            "storePassword=store-secret\n"
+            "keyPassword=key-secret\n"
+            "keyAlias=upload\n"
+        )
+        keystore = self.workspace / "creds" / "android-upload-key.jks"
+        keystore.write_bytes(b"keystore")
+
+        result = find_signing_config(self.workspace)
+
+        self.assertEqual(result.keystore_path, keystore.resolve())
+        self.assertEqual(result.key_alias, "upload")
+
+    def test_detects_kotlin_application_id(self) -> None:
+        gradle = self.workspace / "android" / "app" / "build.gradle.kts"
+        gradle.parent.mkdir(parents=True)
+        gradle.write_text('android { defaultConfig { applicationId = "benz.gowalk.com" } }')
+
+        self.assertEqual(detect_package_name(self.workspace), "benz.gowalk.com")
+
+    def test_detects_only_bundle(self) -> None:
+        bundle = (
+            self.workspace
+            / "build"
+            / "app"
+            / "outputs"
+            / "bundle"
+            / "release"
+            / "app-release.aab"
+        )
+        bundle.parent.mkdir(parents=True)
+        bundle.write_bytes(b"bundle")
+
+        self.assertEqual(detect_bundle(self.workspace), bundle)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_bitrise_deploy.py

@@ -0,0 +1,124 @@
+#!/usr/bin/env python3
+"""Tests for bitrise_deploy.py config/token/branch resolution."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import bitrise_deploy as bd  # noqa: E402
+
+
+class _Env:
+    def __init__(self, mapping):
+        self._mapping = mapping
+        self._prev = {}
+
+    def __enter__(self):
+        for k, v in self._mapping.items():
+            self._prev[k] = os.environ.get(k)
+            if v is None:
+                os.environ.pop(k, None)
+            else:
+                os.environ[k] = v
+        return self
+
+    def __exit__(self, *_exc):
+        for k, prev in self._prev.items():
+            if prev is None:
+                os.environ.pop(k, None)
+            else:
+                os.environ[k] = prev
+
+
+class LoadConfigTests(unittest.TestCase):
+    def test_loads_valid_config(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            creds = Path(tmp) / "creds"
+            creds.mkdir()
+            (creds / "bitrise.json").write_text(json.dumps(
+                {"enabled": True, "app_slug": "abc123", "workflow": "android-deploy"}))
+            with _Env({"GITHUB_WORKSPACE": tmp}):
+                cfg = bd.load_config()
+            self.assertEqual(cfg["app_slug"], "abc123")
+
+    def test_missing_file_exits(self):
+        with tempfile.TemporaryDirectory() as tmp, _Env({"GITHUB_WORKSPACE": tmp}):
+            with self.assertRaises(SystemExit):
+                bd.load_config()
+
+    def test_missing_app_slug_exits(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            creds = Path(tmp) / "creds"
+            creds.mkdir()
+            (creds / "bitrise.json").write_text(json.dumps({"enabled": True}))
+            with _Env({"GITHUB_WORKSPACE": tmp}):
+                with self.assertRaises(SystemExit):
+                    bd.load_config()
+
+
+class ResolveTokenTests(unittest.TestCase):
+    def test_env_token_wins(self):
+        with _Env({"BITRISE_API_TOKEN": "env-tok"}):
+            self.assertEqual(bd.resolve_token({"api_token": "cfg-tok"}), "env-tok")
+
+    def test_falls_back_to_config_token(self):
+        with _Env({"BITRISE_API_TOKEN": None}):
+            self.assertEqual(bd.resolve_token({"api_token": "cfg-tok"}), "cfg-tok")
+
+    def test_no_token_exits(self):
+        with _Env({"BITRISE_API_TOKEN": None}):
+            with self.assertRaises(SystemExit):
+                bd.resolve_token({})
+
+
+class ResolveBranchTests(unittest.TestCase):
+    def test_config_branch_wins(self):
+        with _Env({"GITHUB_REF": "refs/heads/feature"}):
+            self.assertEqual(bd.resolve_branch({"branch": "release"}), "release")
+
+    def test_derives_from_github_ref(self):
+        with _Env({"GITHUB_REF": "refs/heads/main"}):
+            self.assertEqual(bd.resolve_branch({}), "main")
+
+    def test_defaults_to_main(self):
+        with _Env({"GITHUB_REF": None}):
+            self.assertEqual(bd.resolve_branch({}), "main")
+
+
+class TriggerTests(unittest.TestCase):
+    def test_trigger_posts_expected_body(self):
+        captured = {}
+
+        def fake_api(method, path, token, body=None):
+            captured["method"] = method
+            captured["path"] = path
+            captured["body"] = body
+            return {"status": "ok", "build_slug": "bs1", "build_number": 7}
+
+        with _Env({"GITHUB_SHA": "deadbeef"}), \
+                mock.patch.object(bd, "api", side_effect=fake_api):
+            slug, num, wf = bd.trigger(
+                {"app_slug": "abc", "workflow": "android-deploy"}, "tok", "main")
+        self.assertEqual((slug, num, wf), ("bs1", 7, "android-deploy"))
+        self.assertEqual(captured["method"], "POST")
+        self.assertEqual(captured["path"], "/apps/abc/builds")
+        self.assertEqual(captured["body"]["build_params"]["branch"], "main")
+        self.assertEqual(captured["body"]["build_params"]["workflow_id"], "android-deploy")
+        self.assertEqual(captured["body"]["build_params"]["commit_hash"], "deadbeef")
+
+    def test_trigger_rejects_non_ok(self):
+        with mock.patch.object(bd, "api", return_value={"status": "error", "message": "bad"}):
+            with self.assertRaises(SystemExit):
+                bd.trigger({"app_slug": "abc"}, "tok", "main")
+
+
+if __name__ == "__main__":
+    unittest.main()