Skip to content

Harden wake word, fix Brave search, remove YouTube/GrayJay feature #14

Harden wake word, fix Brave search, remove YouTube/GrayJay feature

Harden wake word, fix Brave search, remove YouTube/GrayJay feature #14

Workflow file for this run

name: Build and Release
on:
push:
branches:
- master
workflow_dispatch:
permissions:
contents: write
env:
# Opt into Node.js 24 for all actions before the June 2026 forced cutover.
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
jobs:
build:
name: Build & Release APK
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
submodules: recursive
- name: Set up Java 17
uses: actions/setup-java@v4
with:
distribution: temurin
java-version: '17'
# Install the exact NDK the project declares (ndkVersion in build.gradle).
# ubuntu-latest ships the Android SDK with sdkmanager at $ANDROID_HOME.
- name: Install NDK 28.2.13676358
run: |
echo "y" | ${ANDROID_HOME}/cmdline-tools/latest/bin/sdkmanager \
"ndk;28.2.13676358" --channel=0
- name: Cache Gradle packages
uses: actions/cache@v4
with:
path: |
~/.gradle/caches
~/.gradle/wrapper
key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
restore-keys: gradle-${{ runner.os }}-
- name: Make gradlew executable
run: chmod +x ./gradlew
- name: Build debug APK
run: ./gradlew :presentation:assembleNoAnalyticsDebug
# Ensure the Android debug keystore exists at ~/.android/debug.keystore
# before the release build. The debug APK step creates it automatically,
# but an explicit keytool call makes the path predictable and avoids
# the failure mode where ANDROID_HOME/debug.keystore (wrong path) is used.
- name: Ensure debug keystore exists
run: |
mkdir -p ~/.android
if [ ! -f ~/.android/debug.keystore ]; then
keytool -genkeypair -v \
-keystore ~/.android/debug.keystore \
-alias androiddebugkey \
-keyalg RSA -keysize 2048 \
-validity 10000 \
-storepass android -keypass android \
-dname "CN=Android Debug,O=Android,C=US"
fi
- name: Build release APK
run: |
if [ -n "${{ secrets.KEYSTORE_BASE64 }}" ]; then
echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 --decode > /tmp/release.jks
./gradlew :presentation:assembleNoAnalyticsRelease \
-Pandroid.injected.signing.store.file=/tmp/release.jks \
-Pandroid.injected.signing.store.password="${{ secrets.KEYSTORE_PASSWORD }}" \
-Pandroid.injected.signing.key.alias="${{ secrets.KEY_ALIAS }}" \
-Pandroid.injected.signing.key.password="${{ secrets.KEY_PASSWORD }}"
else
# No production keystore configured — sign with the debug key.
# The keystore was guaranteed to exist by the step above.
./gradlew :presentation:assembleNoAnalyticsRelease \
-Pandroid.injected.signing.store.file="${HOME}/.android/debug.keystore" \
-Pandroid.injected.signing.store.password=android \
-Pandroid.injected.signing.key.alias=androiddebugkey \
-Pandroid.injected.signing.key.password=android
fi
- name: Publish GitHub Release
uses: softprops/action-gh-release@v2
with:
tag_name: v1.0.${{ github.run_number }}
name: v1.0.${{ github.run_number }}
draft: false
prerelease: true
generate_release_notes: false
body: |
Automated build from `${{ github.sha }}`
| Variant | Notes |
|---|---|
| noAnalytics-debug | Debuggable, sideload via adb |
| noAnalytics-release | Optimised + minified |
Zero telemetry. No Firebase. No cloud STT.
files: |
presentation/build/outputs/apk/noAnalytics/debug/*.apk
presentation/build/outputs/apk/noAnalytics/release/*.apk
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}