android-beta-release.yml

name: Android Beta Release

run-name: Android Beta ${{ inputs.operation }} ${{ inputs.target_ref }}@${{ inputs.target_sha }}

on:
  workflow_dispatch:
    inputs:
      operation:
        description: Upload and record, or recover recording after a terminal upload run failure
        required: true
        default: upload-and-record
        type: choice
        options:
          - upload-and-record
          - record-only
      target_ref:
        description: Canonical mobile release branch (release/YYYY.M.PATCH-mobile)
        required: true
        type: string
      target_sha:
        description: Exact lowercase commit SHA at the release branch head
        required: true
        type: string
      source_run_id:
        description: Original failed upload run ID; required only for record-only recovery
        required: false
        type: string

permissions: {}

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
  NODE_VERSION: "24.19.0"

jobs:
  authorize:
    name: Authorize exact Android release candidate
    if: inputs.operation == 'upload-and-record'
    permissions:
      actions: read
      attestations: write
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      actor: ${{ steps.authority.outputs.actor }}
      approved: ${{ steps.authority.outputs.approved }}
      build_timestamp: ${{ steps.authority.outputs.build-timestamp }}
      receipt_digest: ${{ steps.authority.outputs.receipt-digest }}
      run_id: ${{ steps.authority.outputs.run-id }}
      target_ref: ${{ steps.authority.outputs.target-ref }}
      target_sha: ${{ steps.authority.outputs.target-sha }}
      triggering_actor: ${{ steps.authority.outputs.triggering-actor }}
    steps:
      - name: Checkout trusted mobile release authority
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.workflow_sha }}
          persist-credentials: false
          fetch-depth: 0
          sparse-checkout: |
            .github/actions/mobile-release-authority
            scripts
            apps/mobile/version.json
            apps/android/version.json
            apps/android/Config/Version.properties
            apps/android/fastlane/metadata/android/en-US/release_notes.txt
            apps/ios/CHANGELOG.md

      - name: Setup trusted Node runtime
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Authorize Android beta release
        id: authority
        uses: ./.github/actions/mobile-release-authority
        with:
          operation: authorize
          platform: android
          workflow-path: .github/workflows/android-beta-release.yml
          workflow-full-ref: ${{ github.workflow_ref }}
          workflow-sha: ${{ github.workflow_sha }}
          target-ref: ${{ inputs.target_ref }}
          target-sha: ${{ inputs.target_sha }}
          authority-run-id: ${{ github.run_id }}
          actor: ${{ github.actor }}
          triggering-actor: ${{ github.triggering_actor }}

  release:
    name: Upload and record Android beta
    needs: authorize
    if: inputs.operation == 'upload-and-record' && needs.authorize.outputs.approved == 'true'
    permissions:
      actions: read
      attestations: read
      contents: read
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    environment: android-beta-release
    concurrency:
      group: android-beta-release-ai.openclaw.app
      cancel-in-progress: false
    env:
      BUILD_TIMESTAMP: ${{ needs.authorize.outputs.build_timestamp }}
      RELEASE_TARGET_SHA: ${{ needs.authorize.outputs.target_sha }}
    steps:
      - name: Checkout approved release target
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ env.RELEASE_TARGET_SHA }}
          fetch-depth: 0
          persist-credentials: false

      - name: Checkout trusted mobile release authority
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.workflow_sha }}
          path: apps/android/build/mobile-release-ci/authority
          persist-credentials: false
          fetch-depth: 0
          sparse-checkout: |
            .github/actions/mobile-release-authority
            scripts
            apps/mobile/version.json
            apps/android/version.json
            apps/android/Config/Version.properties
            apps/android/fastlane/metadata/android/en-US/release_notes.txt
            apps/ios/CHANGELOG.md

      - name: Setup trusted Node runtime
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Prepare trusted Linux Android tooling
        shell: bash
        run: |
          set -euo pipefail
          test "$RUNNER_OS/$RUNNER_ARCH" = "Linux/X64"
          for executable in /usr/bin/apt-get /usr/bin/sudo /usr/bin/timeout; do
            test -x "$executable"
          done
          apt_source="/etc/apt/sources.list.d/ubuntu.sources"
          apt_source_parts="$RUNNER_TEMP/openclaw-android-apt-sourceparts-disabled"
          test -s "$apt_source"
          if [[ -e "$apt_source_parts" || -L "$apt_source_parts" ]]; then
            echo "::error::Task-private APT source-parts path must remain absent"
            exit 1
          fi
          apt_options=(
            -o "Dir::Etc::sourcelist=$apt_source"
            -o "Dir::Etc::sourceparts=$apt_source_parts"
          )
          /usr/bin/timeout --signal=TERM --kill-after=10s 300s \
            /usr/bin/sudo env DEBIAN_FRONTEND=noninteractive \
            /usr/bin/apt-get "${apt_options[@]}" update
          /usr/bin/timeout --signal=TERM --kill-after=10s 300s \
            /usr/bin/sudo env DEBIAN_FRONTEND=noninteractive \
            /usr/bin/apt-get "${apt_options[@]}" install \
            -y --no-install-recommends acl imagemagick
          test -x /usr/bin/convert
          test -x /usr/bin/identify

          trusted_root="apps/android/build/mobile-release-ci/authority"
          adapter_path="scripts/android-sips-linux.sh"
          test "$(git -C "$trusted_root" rev-parse HEAD)" = "$GITHUB_WORKFLOW_SHA"
          read -r adapter_mode adapter_type adapter_oid adapter_name < <(
            git -C "$trusted_root" ls-tree HEAD -- "$adapter_path"
          )
          if [[ "$adapter_mode" != "100755" || "$adapter_type" != "blob" ||
            "$adapter_name" != "$adapter_path" ]]; then
            echo "::error::Trusted Linux screenshot adapter is not a committed executable file"
            exit 1
          fi
          tool_dir="$RUNNER_TEMP/openclaw-android-tools"
          adapter="$tool_dir/android-sips-linux.sh"
          mkdir -p "$tool_dir"
          git -C "$trusted_root" cat-file blob "$adapter_oid" >"$adapter"
          chmod 700 "$adapter"
          cmp -s "$trusted_root/$adapter_path" "$adapter"

      - name: Setup Node environment
        uses: ./.github/actions/setup-node-env
        with:
          cache-mode: off
          install-bun: "true"
          node-version: ${{ env.NODE_VERSION }}

      - name: Setup Android toolchain
        uses: ./.github/actions/setup-android-toolchain
        with:
          cache-mode: off
          install-screenshot-emulators: "true"

      - name: Verify Linux KVM acceleration
        shell: bash
        run: |
          set -euo pipefail
          verify_kvm_acceleration() {
            local output_file="$1"
            local raw_output="${output_file}.raw"
            local accel_status
            local accel_timed_out=false

            if /usr/bin/timeout --signal=TERM --kill-after=2s 15s \
              emulator -accel-check >"$raw_output" 2>&1; then
              accel_status=0
            else
              accel_status=$?
            fi
            if [[ "$accel_status" == "124" || "$accel_status" == "137" ]]; then
              accel_timed_out=true
            fi
            head -c 16384 "$raw_output" >"$output_file"
            rm -f "$raw_output"
            {
              printf '\nexit_status=%s\n' "$accel_status"
              printf 'timed_out=%s\n' "$accel_timed_out"
            } >>"$output_file"
            cat "$output_file"
            if [[ "$accel_status" -ne 0 || "$accel_timed_out" != "false" ]]; then
              echo "::error::Android emulator acceleration check failed"
              return 1
            fi
            if ! grep -Eiq '\bKVM\b.*\b(available|usable)\b' "$output_file"; then
              echo "::error::Android emulator did not confirm usable KVM acceleration"
              return 1
            fi
          }

          test "$RUNNER_OS/$RUNNER_ARCH" = "Linux/X64"
          test -c /dev/kvm
          current_user="$(id -un)"
          /usr/bin/sudo /usr/bin/setfacl -m "u:${current_user}:rw" /dev/kvm
          /usr/bin/getfacl -cp /dev/kvm | grep -Fqx "user:${current_user}:rw-"
          KVM_DEVICE=/dev/kvm /bin/bash -c \
            'test -c "$KVM_DEVICE" && test -r "$KVM_DEVICE" && test -w "$KVM_DEVICE"'
          verify_kvm_acceleration "$RUNNER_TEMP/android-emulator-kvm-check.txt"

      - name: Setup Ruby
        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
        with:
          ruby-version: "3.4.10"
          bundler: "2.6.9"
          bundler-cache: false
          working-directory: apps/android

      - name: Install locked Fastlane bundle
        working-directory: apps/android
        run: |
          set -euo pipefail
          bundle _2.6.9_ install --jobs 4 --retry 3
          bundle _2.6.9_ check
          test "$(bundle _2.6.9_ exec ruby -e 'require "fastlane"; print Fastlane::VERSION')" = "2.239.0"

      - name: Revalidate release authority immediately before signing access
        uses: ./apps/android/build/mobile-release-ci/authority/.github/actions/mobile-release-authority
        with:
          operation: revalidate
          platform: android
          workflow-path: .github/workflows/android-beta-release.yml
          workflow-full-ref: ${{ github.workflow_ref }}
          workflow-sha: ${{ github.workflow_sha }}
          target-ref: ${{ needs.authorize.outputs.target_ref }}
          target-sha: ${{ env.RELEASE_TARGET_SHA }}
          authority-run-id: ${{ needs.authorize.outputs.run_id }}

      - name: Create apps-signing read token
        id: apps-signing-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: "2729701"
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
          owner: openclaw
          repositories: apps-signing
          permission-contents: read

      - name: Revalidate release authority immediately before Android signing checkout
        uses: ./apps/android/build/mobile-release-ci/authority/.github/actions/mobile-release-authority
        with:
          operation: revalidate
          platform: android
          workflow-path: .github/workflows/android-beta-release.yml
          workflow-full-ref: ${{ github.workflow_ref }}
          workflow-sha: ${{ github.workflow_sha }}
          target-ref: ${{ needs.authorize.outputs.target_ref }}
          target-sha: ${{ env.RELEASE_TARGET_SHA }}
          authority-run-id: ${{ needs.authorize.outputs.run_id }}

      - name: Checkout encrypted Android signing assets
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: openclaw/apps-signing
          ref: main
          path: apps/android/build/release-signing/apps-signing
          token: ${{ steps.apps-signing-token.outputs.token }}
          persist-credentials: false

      - name: Revalidate release authority immediately before Android signing materialization
        uses: ./apps/android/build/mobile-release-ci/authority/.github/actions/mobile-release-authority
        with:
          operation: revalidate
          platform: android
          workflow-path: .github/workflows/android-beta-release.yml
          workflow-full-ref: ${{ github.workflow_ref }}
          workflow-sha: ${{ github.workflow_sha }}
          target-ref: ${{ needs.authorize.outputs.target_ref }}
          target-sha: ${{ env.RELEASE_TARGET_SHA }}
          authority-run-id: ${{ needs.authorize.outputs.run_id }}

      - name: Materialize Android release signing
        env:
          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
        run: node scripts/android-release-signing.mjs --mode materialize

      - name: Refresh trusted authority before store access
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.workflow_sha }}
          path: apps/android/build/mobile-release-ci/sink
          persist-credentials: false
          fetch-depth: 0
          sparse-checkout: |
            .github/actions/mobile-release-authority
            scripts
            apps/mobile/version.json
            apps/android/version.json
            apps/android/Config/Version.properties
            apps/android/fastlane/metadata/android/en-US/release_notes.txt
            apps/ios/CHANGELOG.md

      - name: Revalidate release authority immediately before upload
        uses: ./apps/android/build/mobile-release-ci/sink/.github/actions/mobile-release-authority
        with:
          operation: revalidate
          platform: android
          workflow-path: .github/workflows/android-beta-release.yml
          workflow-full-ref: ${{ github.workflow_ref }}
          workflow-sha: ${{ github.workflow_sha }}
          target-ref: ${{ needs.authorize.outputs.target_ref }}
          target-sha: ${{ env.RELEASE_TARGET_SHA }}
          authority-run-id: ${{ needs.authorize.outputs.run_id }}

      - name: Upload Android beta
        env:
          GOOGLE_PLAY_JSON_KEY_DATA: ${{ secrets.GOOGLE_PLAY_JSON_KEY_DATA }}
          GOOGLE_PLAY_PACKAGE_NAME: ai.openclaw.app
          GOOGLE_PLAY_RELEASE_STATUS: completed
          GOOGLE_PLAY_TRACK: internal
          GOOGLE_PLAY_VALIDATE_ONLY: "0"
          OPENCLAW_BUILD_TIMESTAMP: ${{ env.BUILD_TIMESTAMP }}
          OPENCLAW_MOBILE_RELEASE_AUTHORITY_RECEIPT_DIGEST: ${{ needs.authorize.outputs.receipt_digest }}
          OPENCLAW_MOBILE_RELEASE_INTENT_PATH: ${{ runner.temp }}/mobile-release-intent-android/intent.json
          OPENCLAW_MOBILE_RELEASE_REF_MODE: intent
          OPENCLAW_MOBILE_RELEASE_TARGET_REF: ${{ needs.authorize.outputs.target_ref }}
          SIPS: ${{ runner.temp }}/openclaw-android-tools/android-sips-linux.sh
          SUPPLY_CHANGES_NOT_SENT_FOR_REVIEW: "true"
          SUPPLY_RESCUE_CHANGES_NOT_SENT_FOR_REVIEW: "false"
        run: |
          set -euo pipefail
          rm -rf "$RUNNER_TEMP/mobile-release-intent-android"
          pnpm android:release:upload
          test -f "$RUNNER_TEMP/mobile-release-intent-android/intent.json"
          test "$(wc -c < "$RUNNER_TEMP/mobile-release-intent-android/intent.json")" -le 4096

      - name: Upload exact Android release intent
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: mobile-release-intent-android-${{ github.run_id }}-1
          path: ${{ runner.temp }}/mobile-release-intent-android/intent.json
          if-no-files-found: error
          retention-days: 30

      - name: Checkout trusted mobile release recorder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.workflow_sha }}
          path: .mobile-release-recorder
          persist-credentials: false
          fetch-depth: 0
          sparse-checkout: |
            .github/actions/mobile-release-authority
            scripts
            apps/mobile/version.json
            apps/android/version.json
            apps/android/Config/Version.properties
            apps/android/fastlane/metadata/android/en-US/release_notes.txt
            apps/ios/CHANGELOG.md

      - name: Validate and record immutable Android release ref
        uses: ./.mobile-release-recorder/.github/actions/mobile-release-authority
        with:
          operation: record
          platform: android
          workflow-path: .github/workflows/android-beta-release.yml
          workflow-full-ref: ${{ github.workflow_ref }}
          workflow-sha: ${{ github.workflow_sha }}
          target-ref: ${{ needs.authorize.outputs.target_ref }}
          target-sha: ${{ env.RELEASE_TARGET_SHA }}
          authority-run-id: ${{ needs.authorize.outputs.run_id }}
          release-ref-private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

  recover-record:
    name: Recover immutable Android release ref
    if: inputs.operation == 'record-only'
    permissions:
      actions: read
      attestations: read
      contents: read
    runs-on: ubuntu-latest
    timeout-minutes: 20
    environment: android-beta-release
    concurrency:
      group: android-beta-release-ai.openclaw.app
      cancel-in-progress: false
    steps:
      - name: Checkout trusted mobile release recorder
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.workflow_sha }}
          persist-credentials: false
          fetch-depth: 0
          sparse-checkout: |
            .github/actions/mobile-release-authority
            scripts
            apps/mobile/version.json
            apps/android/version.json
            apps/android/Config/Version.properties
            apps/android/fastlane/metadata/android/en-US/release_notes.txt
            apps/ios/CHANGELOG.md

      - name: Setup trusted Node runtime
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Validate and recover immutable Android release ref
        uses: ./.github/actions/mobile-release-authority
        with:
          operation: record
          platform: android
          workflow-path: .github/workflows/android-beta-release.yml
          workflow-full-ref: ${{ github.workflow_ref }}
          workflow-sha: ${{ github.workflow_sha }}
          target-ref: ${{ inputs.target_ref }}
          target-sha: ${{ inputs.target_sha }}
          authority-run-id: ${{ inputs.source_run_id }}
          recovery: "true"
          release-ref-private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}