• # Accessing an Android app secret from GitHub Actions using Gradle

1. 需求场景

gralde 的一些 task 中涉及一些 密钥信息不想放到 git 记录中去

所以我写了一个脚本 create_gradle_properties.sh

#!/usr/bin/env bash

# Script used for CI that reads environment variables and writes to
# local.properties file.

#echo "bash here"
echo -e "storePassword=${ANDROID_STOREPASSWORD}\nkeyPassword=${ANDROID_KEYPASSWORD}\nkeyAlias=${ANDROID_KEYALIAS}" > ./local.properties

执行后会在 local.properties 文件中添加以下属性：

storePassword=xxx
keyPassword=xxx
keyAlias=xxx

然后在 gradle 中读取就好了

def keystorePropertiesFile = rootProject.file("local.properties")
def keystoreProperties = new Properties()
keystoreProperties.load(new FileInputStream(keystorePropertiesFile))

...


signingConfigs {
    release {
        v1SigningEnabled true
        v2SigningEnabled true
        storeFile file('../xxx.jks')
        storePassword keystoreProperties['storePassword']
        keyAlias keystoreProperties['keyAlias']
        keyPassword keystoreProperties['keyPassword']
    }
}

2. 遇到的问题

• bash 文件在 mac 上执行之后保存路径与 scripts/create_gradle_properties.sh 在同级目录，但用GitHub Action跑之后 local.properties 路径是在项目根目录下...
• bash 命令注意换行，注意输出的内容是否有问题...

3. CI 文件

name: Android CI

on:
  push:
    branches: 
      - stage
      - master
      - develop

  pull_request:
    branches: 
      - stage
      - master
      - develop


jobs:
  build:

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3
      - name: set up JDK 11
        uses: actions/setup-java@v3
        with:
          java-version: '11'
          distribution: 'adopt'
          cache: gradle

      - name: Prepare properties
        env:
          POLESTAR_ANDROID_STOREPASSWORD: ${{ secrets.ANDROID_STOREPASSWORD }}
          POLESTAR_ANDROID_KEYPASSWORD: ${{ secrets.ANDROID_KEYPASSWORD }}
          POLESTAR_ANDROID_KEYALIAS: ${{ secrets.ANDROID_KEYALIAS }}
        run: bash scripts/create_gradle_properties.sh

      - name: Buidl Action
        run: xxx