From c61e2e84ed25944a2fb9b1fddf2e7d4901d804f6 Mon Sep 17 00:00:00 2001
From: Dark-Avery <ingv0rr@yandex.ru>
Date: Mon, 16 Mar 2026 23:48:29 +0300
Subject: [PATCH] feat(ci): build and publish signed Android release APK

---
 .github/workflows/build.yml | 41 ++++++++++++++++++++++++++++++-------
 .gitignore                  |  2 +-
 2 files changed, 35 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7c7f113..225018f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -43,6 +43,8 @@ jobs:
   build-android:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    env:
+      ANDROID_APK_NAME: tg-ws-proxy-android-${{ github.event.inputs.version }}.apk
     defaults:
       run:
         working-directory: android
@@ -50,6 +52,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Validate Android release signing secrets
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          test -n "$ANDROID_KEYSTORE_BASE64" || { echo "Missing secret: ANDROID_KEYSTORE_BASE64"; exit 1; }
+          test -n "$ANDROID_KEYSTORE_PASSWORD" || { echo "Missing secret: ANDROID_KEYSTORE_PASSWORD"; exit 1; }
+          test -n "$ANDROID_KEY_ALIAS" || { echo "Missing secret: ANDROID_KEY_ALIAS"; exit 1; }
+          test -n "$ANDROID_KEY_PASSWORD" || { echo "Missing secret: ANDROID_KEY_PASSWORD"; exit 1; }
+
       - name: Set up JDK 17
         uses: actions/setup-java@v5
         with:
@@ -71,19 +85,32 @@ jobs:
       - name: Install Android SDK packages
         run: sdkmanager "platforms;android-34" "build-tools;34.0.0"
 
-      - name: Build Android debug APK
+      - name: Prepare Android release keystore
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+        run: |
+          printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 --decode > "$RUNNER_TEMP/android-release.keystore"
+          test -s "$RUNNER_TEMP/android-release.keystore"
+
+      - name: Build Android release APK
+        env:
+          LOCAL_CHAQUOPY_REPO: ${{ github.workspace }}/android/.m2-chaquopy-ci
+          ANDROID_KEYSTORE_FILE: ${{ runner.temp }}/android-release.keystore
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
         run: |
           chmod +x gradlew build-local-debug.sh
-          LOCAL_CHAQUOPY_REPO="$GITHUB_WORKSPACE/android/.m2-chaquopy-ci" ./build-local-debug.sh
+          ./build-local-debug.sh assembleRelease
 
       - name: Rename APK
-        run: cp app/build/outputs/apk/debug/app-debug.apk app/build/outputs/apk/debug/tg-ws-proxy-android-debug.apk
+        run: cp app/build/outputs/apk/release/app-release.apk "app/build/outputs/apk/release/$ANDROID_APK_NAME"
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
-          name: TgWsProxy-android-debug
-          path: android/app/build/outputs/apk/debug/tg-ws-proxy-android-debug.apk
+          name: TgWsProxy-android-release
+          path: android/app/build/outputs/apk/release/${{ env.ANDROID_APK_NAME }}
 
   build-win7:
     runs-on: windows-latest
@@ -134,7 +161,7 @@ jobs:
       - name: Download Android build
         uses: actions/download-artifact@v4
         with:
-          name: TgWsProxy-android-debug
+          name: TgWsProxy-android-release
           path: dist
 
       - name: Create GitHub Release
@@ -147,7 +174,7 @@ jobs:
           files: |
             dist/TgWsProxy.exe
             dist/TgWsProxy-win7.exe
-            dist/tg-ws-proxy-android-debug.apk
+            dist/tg-ws-proxy-android-${{ github.event.inputs.version }}.apk
           draft: false
           prerelease: false
         env:
diff --git a/.gitignore b/.gitignore
index d523b6d..f083934 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,7 +25,7 @@ android/.idea/
 android/build/
 android/app/build/
 android/*.jks
-android/*.keystore
+*.keystore
 android/*.keystore.properties
 
 # OS