Harden wake word, fix Brave search, remove YouTube/GrayJay feature #14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Release | |
| on: | |
| push: | |
| branches: | |
| - master | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| env: | |
| # Opt into Node.js 24 for all actions before the June 2026 forced cutover. | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| jobs: | |
| build: | |
| name: Build & Release APK | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| - name: Set up Java 17 | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: '17' | |
| # Install the exact NDK the project declares (ndkVersion in build.gradle). | |
| # ubuntu-latest ships the Android SDK with sdkmanager at $ANDROID_HOME. | |
| - name: Install NDK 28.2.13676358 | |
| run: | | |
| echo "y" | ${ANDROID_HOME}/cmdline-tools/latest/bin/sdkmanager \ | |
| "ndk;28.2.13676358" --channel=0 | |
| - name: Cache Gradle packages | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.gradle/caches | |
| ~/.gradle/wrapper | |
| key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }} | |
| restore-keys: gradle-${{ runner.os }}- | |
| - name: Make gradlew executable | |
| run: chmod +x ./gradlew | |
| - name: Build debug APK | |
| run: ./gradlew :presentation:assembleNoAnalyticsDebug | |
| # Ensure the Android debug keystore exists at ~/.android/debug.keystore | |
| # before the release build. The debug APK step creates it automatically, | |
| # but an explicit keytool call makes the path predictable and avoids | |
| # the failure mode where ANDROID_HOME/debug.keystore (wrong path) is used. | |
| - name: Ensure debug keystore exists | |
| run: | | |
| mkdir -p ~/.android | |
| if [ ! -f ~/.android/debug.keystore ]; then | |
| keytool -genkeypair -v \ | |
| -keystore ~/.android/debug.keystore \ | |
| -alias androiddebugkey \ | |
| -keyalg RSA -keysize 2048 \ | |
| -validity 10000 \ | |
| -storepass android -keypass android \ | |
| -dname "CN=Android Debug,O=Android,C=US" | |
| fi | |
| - name: Build release APK | |
| run: | | |
| if [ -n "${{ secrets.KEYSTORE_BASE64 }}" ]; then | |
| echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 --decode > /tmp/release.jks | |
| ./gradlew :presentation:assembleNoAnalyticsRelease \ | |
| -Pandroid.injected.signing.store.file=/tmp/release.jks \ | |
| -Pandroid.injected.signing.store.password="${{ secrets.KEYSTORE_PASSWORD }}" \ | |
| -Pandroid.injected.signing.key.alias="${{ secrets.KEY_ALIAS }}" \ | |
| -Pandroid.injected.signing.key.password="${{ secrets.KEY_PASSWORD }}" | |
| else | |
| # No production keystore configured — sign with the debug key. | |
| # The keystore was guaranteed to exist by the step above. | |
| ./gradlew :presentation:assembleNoAnalyticsRelease \ | |
| -Pandroid.injected.signing.store.file="${HOME}/.android/debug.keystore" \ | |
| -Pandroid.injected.signing.store.password=android \ | |
| -Pandroid.injected.signing.key.alias=androiddebugkey \ | |
| -Pandroid.injected.signing.key.password=android | |
| fi | |
| - name: Publish GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: v1.0.${{ github.run_number }} | |
| name: v1.0.${{ github.run_number }} | |
| draft: false | |
| prerelease: true | |
| generate_release_notes: false | |
| body: | | |
| Automated build from `${{ github.sha }}` | |
| | Variant | Notes | | |
| |---|---| | |
| | noAnalytics-debug | Debuggable, sideload via adb | | |
| | noAnalytics-release | Optimised + minified | | |
| Zero telemetry. No Firebase. No cloud STT. | |
| files: | | |
| presentation/build/outputs/apk/noAnalytics/debug/*.apk | |
| presentation/build/outputs/apk/noAnalytics/release/*.apk | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |