Automated signed CI builds - #1769
Draft
UnicornsOnLSD wants to merge 7 commits into
Draft
UnicornsOnLSD wants to merge 7 commits into
UnicornsOnLSD wants to merge 7 commits into
Conversation
UnicornsOnLSD
commented
Sep 13, 2026
| env: | ||
| if_condition: &integration_if github.event_name == 'workflow_dispatch' || | ||
| (github.event_name == 'push' && github.repository == 'finamp-app/finamp' ) | ||
| if_condition: &integration_if false |
Collaborator
Author
There was a problem hiding this comment.
TODO: revert this
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds a new GH Actions step to create signed binaries on a tag. The end goal here is to be able to make Finamp releases autonomously without relying on me to make a signed build manually (to those snooping, this has delayed releases by a staggering amount of time 🫠)
iOS
For iOS, I've mostly copied from the GitHub docs, which conveniently has a section on importing provisioning profiles/certificates for use in runners. I've made a distribution profile for CI, which is all pulled from GH Actions secrets. There were some shenanigans required to use this profile in the build (
flutter build ipa --release --export-method app-storedoesn't work >:( ), but the result is clean enough and allows the Xcode project to stay in "automatic" mode by default (rather than having its signing settings forced to CI all the time (not that it really matters, you have to mess with it anyway unless you're me)).Android
Still TODO, initially I was just going to bother with iOS since it's usually the most painful roadblock in getting releases out but we may as well get it done too. Theoretically this'll involve putting my Android signing key into GH Actions, will have a proper look on how to do it properly. From here we could both upload a bundle to Google Play and have a signed APK for those who get Finamp via GitHub Releases.
Future Scope
I've got this set to run on tags for now, but we might be able to set things up to run on every commit to
redesign(or the main branch in the future). We'll probably run into issues with build numbers there though, so for now it makes sense to only make signed releases when actually making a release.