Skip to content

Commit c38355f

Browse files
kangyuri1114HI-JIN2PeraSite
authored
[Feat] 서명된 release apk를 추출하도록 CI 코드 수정 (#451)
* feat: 서명된 release apk 파일을 추출할 수 있도록 추가 * feat: 테스트용 주석 추가 * feat: 테스트용 주석 추가 * feat: 테스트용 코드 추가 * feat: 테스트용 코드 추가 * feat: 테스트용 코드 추가 * feat: 카카오 해시 키 추출을 위한 Artifact 다운 로직 추가 * feat: 테스트용으로 기존 조건 삭제 * feat: 테스트용으로 기존 조건 삭제 * feat: 해시키 출력 코드 삭제 * feat: debug apk 추출에 서명 로직 추가 * feat: test * feat: 코드 복구 * feat: 네이버 맵 키 테스트 * feat: test * feat: 네이버 키 확인 로직 추가 * feat: 네이버 키 확인 로직 추가 * feat: 테스트용 코드 삭제 * feat: Debug apk 추출 로직 주석 처리 * fix: 현 develop debug.yml으로 변경 * chore: 현재 yml이랑 포맷 동일하게 수정 * chore: base64 decode -i 플래그 추가 --------- Co-authored-by: Yu Jin <qldls0307@naver.com> Co-authored-by: PeraSite <pretocki3@gmail.com>
1 parent d3eaf90 commit c38355f

2 files changed

Lines changed: 80 additions & 7 deletions

File tree

‎.github/workflows/debug.yml‎

Lines changed: 66 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ jobs:
6262
echo NAVER_MAPS_CLIENT_ID=$NAVER_MAPS_CLIENT_ID >> local.properties
6363
echo POSTHOG_API_KEY=$POSTHOG_API_KEY >> local.properties
6464
echo POSTHOG_HOST=$POSTHOG_HOST >> local.properties
65-
65+
6666
- name: Generate google-services.json
6767
run: |
6868
echo "$GOOGLE_SERVICE" > app/google-services.json.b64
@@ -79,28 +79,75 @@ jobs:
7979
# - name: Assemble Debug APK
8080
# if: >
8181
# github.event_name == 'pull_request' &&
82-
# startsWith(github.event.pull_request.head.ref, 'release/') &&
82+
# startsWith(github.event.pull_request.head.ref, 'release/') &&
8383
# (github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened')
8484
# run: ./gradlew assembleDebug
8585

8686
# - name: Upload Debug APK artifact
8787
# if: >
8888
# github.event_name == 'pull_request' &&
89-
# startsWith(github.event.pull_request.head.ref, 'release/') &&
89+
# startsWith(github.event.pull_request.head.ref, 'release/') &&
9090
# (github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened')
9191
# uses: actions/upload-artifact@v4
9292
# with:
9393
# name: debug-apk
9494
# path: app/build/outputs/apk/debug/*.apk
9595
# retention-days: 1
9696

97+
- name: Decode Keystore for Release Signing
98+
if: >
99+
github.event_name == 'pull_request' &&
100+
startsWith(github.event.pull_request.head.ref, 'release/')
101+
env:
102+
KEYSTORE_CONTENT: ${{ secrets.KEYSTORE_CONTENT }}
103+
KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
104+
KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
105+
KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
106+
run: |
107+
echo "$KEYSTORE_CONTENT" | base64 -d > $GITHUB_WORKSPACE/release.keystore
108+
echo "KEYSTORE_FILE=$GITHUB_WORKSPACE/release.keystore" >> $GITHUB_ENV
109+
echo "KEYSTORE_PASSWORD=$KEYSTORE_PASSWORD" >> $GITHUB_ENV
110+
echo "KEY_ALIAS=$KEY_ALIAS" >> $GITHUB_ENV
111+
echo "KEY_PASSWORD=$KEY_PASSWORD" >> $GITHUB_ENV
112+
97113
- name: Assemble Release APK
98114
if: >
99115
github.event_name == 'pull_request' &&
100116
startsWith(github.event.pull_request.head.ref, 'release/') &&
101117
(github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened')
102118
run: ./gradlew assembleRelease
103119

120+
- name: Inspect AndroidManifest (NAVER_MAPS_CLIENT_ID injected?)
121+
if: >
122+
github.event_name == 'pull_request' &&
123+
startsWith(github.event.pull_request.head.ref, 'release/') &&
124+
(github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened')
125+
run: |
126+
APK=$(ls app/build/outputs/apk/release/*.apk | head -n 1)
127+
echo "APK=$APK"
128+
129+
BUILD_TOOLS_VERSION=$(ls "$ANDROID_SDK_ROOT/build-tools" | sort -V | tail -n 1)
130+
AAPT2="$ANDROID_SDK_ROOT/build-tools/$BUILD_TOOLS_VERSION/aapt2"
131+
echo "AAPT2=$AAPT2"
132+
133+
# 네이버 meta-data 존재 여부 확인
134+
"$AAPT2" dump xmltree --file AndroidManifest.xml "$APK" \
135+
| sed -n '/com.naver.maps.map.NCP_KEY_ID/,+20p' || true
136+
137+
# placeholder가 그대로 남아있는지 확인(치환 실패 징후)
138+
"$AAPT2" dump xmltree --file AndroidManifest.xml "$APK" \
139+
| grep -n '\${NAVER_MAPS_CLIENT_ID}' || true
140+
141+
# Release APK 서명 여부 검증
142+
- name: Verify Release APK signature
143+
if: >
144+
github.event_name == 'pull_request' &&
145+
startsWith(github.event.pull_request.head.ref, 'release/') &&
146+
(github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened')
147+
run: |
148+
BUILD_TOOLS_VERSION=$(ls "$ANDROID_SDK_ROOT/build-tools" | sort -V | tail -n 1)
149+
"$ANDROID_SDK_ROOT/build-tools/$BUILD_TOOLS_VERSION/apksigner" verify --print-certs app/build/outputs/apk/release/*.apk
150+
104151
- name: Upload Release APK artifact
105152
if: >
106153
github.event_name == 'pull_request' &&
@@ -131,9 +178,17 @@ jobs:
131178

132179
# Release만 Firebase 배포
133180
- name: Install Firebase CLI
181+
if: >
182+
github.event_name == 'pull_request' &&
183+
startsWith(github.event.pull_request.head.ref, 'release/') &&
184+
(github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened')
134185
run: npm i -g firebase-tools
135186

136187
- name: Distribute Release APK to Firebase App Distribution
188+
if: >
189+
github.event_name == 'pull_request' &&
190+
startsWith(github.event.pull_request.head.ref, 'release/') &&
191+
(github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened')
137192
env:
138193
FIREBASE_TOKEN: ${{ secrets.FIREBASE_TOKEN }}
139194
FIREBASE_APP_ID: ${{ secrets.FIREBASE_APP_ID }}
@@ -143,16 +198,20 @@ jobs:
143198
--groups "eat-ssu-android-qa" \
144199
--release-notes "Release | PR #${{ github.event.pull_request.number }}: ${{ github.event.pull_request.title }}" \
145200
--token "$FIREBASE_TOKEN"
146-
201+
147202
# PR 코멘트
148203
- name: Comment PR
204+
if: >
205+
github.event_name == 'pull_request' &&
206+
startsWith(github.event.pull_request.head.ref, 'release/') &&
207+
(github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened')
149208
uses: actions/github-script@v7
150209
with:
151210
script: |
152211
const body =
153-
[
154-
`✅ Firebase App Distribution으로 Release APK 배포됨 (그룹: eat-ssu-android-qa)`,
155-
].join('\n');
212+
[
213+
`✅ Firebase App Distribution으로 Release APK 배포됨 (그룹: eat-ssu-android-qa)`,
214+
].join('\n');
156215
157216
await github.rest.issues.createComment({
158217
owner: context.repo.owner,

‎app/build.gradle.kts‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,17 @@ android {
5353
keyPassword = System.getenv("KEY_PASSWORD")
5454
}
5555
}
56+
57+
// CI 환경에서 사용하는 서명 설정
58+
create("ciRelease") {
59+
val keystoreFile = System.getenv("KEYSTORE_FILE")
60+
if (!keystoreFile.isNullOrBlank()) {
61+
storeFile = file(keystoreFile)
62+
storePassword = System.getenv("KEYSTORE_PASSWORD")
63+
keyAlias = System.getenv("KEY_ALIAS")
64+
keyPassword = System.getenv("KEY_PASSWORD")
65+
}
66+
}
5667
}
5768

5869
buildTypes {
@@ -85,6 +96,9 @@ android {
8596
isMinifyEnabled = true
8697
proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
8798

99+
if (!System.getenv("KEYSTORE_FILE").isNullOrBlank()) {
100+
signingConfig = signingConfigs.getByName("ciRelease")
101+
}
88102
}
89103

90104
getByName("debug") {

0 commit comments

Comments
 (0)