Skip to content

ci: Flutter CI gate + signed release (APK / TestFlight) workflows - #1

Open
shroominic wants to merge 1 commit into
mainfrom
ci/github-actions
Open

ci: Flutter CI gate + signed release (APK / TestFlight) workflows#1
shroominic wants to merge 1 commit into
mainfrom
ci/github-actions

Conversation

@shroominic

Copy link
Copy Markdown
Owner

What

Adds GitHub Actions for the Flutter app in openhealth/. Touches only .github/workflows/ and docs/RELEASING.md — no app code.

.github/workflows/ci.yml — PR quality gate

Runs on every pull request and push to main:

  • flutter pub get
  • dart format --output=none --set-exit-if-changed .
  • flutter analyze
  • flutter test --coverage (uploads lcov.info artifact)
  • build sanity: flutter build apk --debug (Ubuntu) and flutter build ios --no-codesign (macOS)

Flutter + Gradle caching enabled; concurrency cancels superseded runs. Mirrors the commands developers run locally.

.github/workflows/release.yml — signed releases

Triggers on v* tags (or manual workflow_dispatch):

  • Android — signed release APK + AAB, attached to the GitHub Release.
  • iOS — signed IPA uploaded to TestFlight via the App Store Connect API key (exports with the committed ios/ExportOptions.plist, team YLK778Z528).

Each release job skips gracefully with a ::warning:: if its secrets are missing, so the workflows merge now and activate automatically once secrets are added — no hard failure on a fresh repo.

docs/RELEASING.md

Exact secret list, how to generate each (keystore + App Store Connect API key), and how to cut a release (tag → workflow).

Secrets the founder must add (Settings → Secrets and variables → Actions)

Android (signed APK/AAB):

  • ANDROID_KEYSTORE_BASE64 — base64 of the release keystore (.jks)
  • ANDROID_KEYSTORE_PASSWORD
  • ANDROID_KEY_ALIAS
  • ANDROID_KEY_PASSWORD

iOS (TestFlight):

  • APPSTORE_API_KEY_ID
  • APPSTORE_API_ISSUER_ID
  • APPSTORE_API_KEY_BASE64 — base64 of the AuthKey_XXXX.p8

One-time follow-up (app-code, not in this PR)

openhealth/android/app/build.gradle.kts still signs release with the debug keystore (its TODO). To get a Play-uploadable signed build, it must load android/key.properties (which the workflow writes) into a release signing config. The exact Kotlin block is documented in docs/RELEASING.md. Left to the app-code owner to avoid conflicts.

Verification

  • Both workflows pass actionlint clean (0 issues).
  • CI commands verified locally against openhealth/: flutter pub get, flutter analyze, and dart format all run. (dart format currently flags lib/main.dart — an app-code formatting fix owned by another agent; CI will correctly gate on it.)
  • macOS/signed jobs can't be run locally; commands mirror the standard Flutter + xcrun altool release flow.

🤖 Generated with Claude Code

Add GitHub Actions for the openhealth/ Flutter app:

- ci.yml: PR/main quality gate — pub get, dart format check,
  flutter analyze, flutter test --coverage, plus Android debug
  and iOS no-codesign build sanity checks (Flutter/Gradle cached).
- release.yml: on v* tags / manual dispatch — signed Android
  APK+AAB attached to the GitHub Release, and signed iOS IPA
  uploaded to TestFlight via App Store Connect API key. Each job
  skips gracefully with a warning when its secrets are absent.
- docs/RELEASING.md: required secrets, how to generate them
  (keystore, App Store Connect API key), and how to cut a release.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant