name: Build ABK App

on:

workflow_dispatch:

push:

paths:

- "app/**"

- "build.gradle.kts"

- "settings.gradle.kts"

- "gradle/**"

- ".github/workflows/build-abk-app.yml"

pull_request:

paths:

- "app/**"

- "build.gradle.kts"

- "settings.gradle.kts"

- "gradle/**"

- ".github/workflows/build-abk-app.yml"

jobs:

build:

runs-on: ubuntu-latest

permissions:

contents: read

env:

HAS_RELEASE_SIGNING: ${{ secrets.ABK_RELEASE_KEYSTORE_BASE64 != '' && secrets.ABK_RELEASE_STORE_PASSWORD != '' && secrets.ABK_RELEASE_KEY_ALIAS != '' && secrets.ABK_RELEASE_KEY_PASSWORD != '' }}

steps:

- name: Checkout

uses: actions/checkout@v6

- name: Set up JDK

uses: actions/setup-java@v5

with:

distribution: temurin

java-version: "17"

- name: Set up Android SDK

uses: android-actions/setup-android@v3

- name: Install Android SDK packages

run: sdkmanager --channel=3 "platforms;android-37.0" "build-tools;37.0.0" "cmake;3.22.1" "ndk;28.2.13676358"

- name: Set up Gradle

uses: gradle/actions/setup-gradle@v4

with:

gradle-version: "9.3.1"

- name: Build debug APK

run: gradle assembleDebug

- name: Decode release keystore

if: ${{ env.HAS_RELEASE_SIGNING == 'true' }}

env:

ABK_RELEASE_KEYSTORE_BASE64: ${{ secrets.ABK_RELEASE_KEYSTORE_BASE64 }}

run: |

mkdir -p app/signing

printf '%s' "$ABK_RELEASE_KEYSTORE_BASE64" | base64 --decode > app/signing/abk-release.jks

- name: Export ABK manager certificate metadata

if: ${{ env.HAS_RELEASE_SIGNING == 'true' }}

env:

ABK_RELEASE_STORE_PASSWORD: ${{ secrets.ABK_RELEASE_STORE_PASSWORD }}

ABK_RELEASE_KEY_ALIAS: ${{ secrets.ABK_RELEASE_KEY_ALIAS }}

ABK_RELEASE_STORE_TYPE: ${{ secrets.ABK_RELEASE_STORE_TYPE }}

run: |

set -euo pipefail

cert="$RUNNER_TEMP/abk-manager-cert.der"

keytool -exportcert \

-keystore app/signing/abk-release.jks \

-storetype "${ABK_RELEASE_STORE_TYPE:-JKS}" \

-storepass "$ABK_RELEASE_STORE_PASSWORD" \

-alias "$ABK_RELEASE_KEY_ALIAS" \

-file "$cert"

size="$(wc -c < "$cert" | tr -d '[:space:]')"

hash="$(sha256sum "$cert" | awk '{print tolower($1)}')"

{

echo "# Official ABK release signing certificate metadata."

echo "# This is public certificate metadata, not a private signing key."

echo "ABK_MANAGER_PACKAGE=com.abk.kernel"

echo "ABK_MANAGER_CERT_SIZE=$size"

echo "ABK_MANAGER_CERT_SHA256=$hash"

} > app/signing/abk-manager-cert.generated.env

{

echo "### ABK manager certificate metadata"

echo

echo '```env'

cat app/signing/abk-manager-cert.generated.env

echo '```'

} >> "$GITHUB_STEP_SUMMARY"

- name: Verify checked-in ABK manager certificate metadata

if: ${{ env.HAS_RELEASE_SIGNING == 'true' }}

run: |

set -euo pipefail

expected="app/signing/abk-manager-cert.env"

actual="app/signing/abk-manager-cert.generated.env"

if [ ! -f "$expected" ]; then

echo "::error::$expected is missing. Commit the public manager certificate metadata so kernel builds can trust the release APK."

exit 1

fi

read_value() {

local file="$1"

local key="$2"

awk -F= -v target="$key" '

/^[[:space:]]*#/ { next }

$1 == target {

value = substr($0, index($0, "=") + 1)

gsub(/^[[:space:]\042\047]+|[[:space:]\042\047]+$/, "", value)

print value

exit

}

' "$file"

}

mismatch=0

for key in ABK_MANAGER_PACKAGE ABK_MANAGER_CERT_SIZE ABK_MANAGER_CERT_SHA256; do

expected_value="$(read_value "$expected" "$key")"

actual_value="$(read_value "$actual" "$key")"

if [ "$expected_value" != "$actual_value" ]; then

echo "::error::$key mismatch: checked-in='$expected_value' generated='$actual_value'"

mismatch=1

fi

done

if [ "$mismatch" -ne 0 ]; then

echo "::error::Update $expected with the generated metadata before building trusted manager kernels."

exit 1

fi

- name: Build release APK

env:

ABK_RELEASE_STORE_FILE: ${{ github.workspace }}/app/signing/abk-release.jks

ABK_RELEASE_STORE_PASSWORD: ${{ secrets.ABK_RELEASE_STORE_PASSWORD }}

ABK_RELEASE_KEY_ALIAS: ${{ secrets.ABK_RELEASE_KEY_ALIAS }}

ABK_RELEASE_KEY_PASSWORD: ${{ secrets.ABK_RELEASE_KEY_PASSWORD }}

run: gradle assembleRelease

- name: Verify signed release APK

if: ${{ env.HAS_RELEASE_SIGNING == 'true' }}

run: |

signed_apk="$(find app/build/outputs/apk/release -type f -name '*-release.apk' ! -name '*unsigned*' | head -n 1)"

if [ -z "$signed_apk" ]; then

echo "No signed release APK found."

find app/build/outputs/apk/release -maxdepth 1 -type f -print

exit 1

fi

"$ANDROID_HOME/build-tools/37.0.0/apksigner" verify --verbose "$signed_apk"

- name: Upload APKs

uses: actions/upload-artifact@v6

with:

name: abk-apks

path: |

app/build/outputs/apk/debug/*.apk

app/build/outputs/apk/release/*.apk

app/signing/abk-manager-cert.generated.env