ci: add GitHub Actions workflow to build and release Android APK via Expo EAS#428
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow that builds an Android APK via Expo EAS (triggered by v* tags or manual dispatch), handles optional local Android signing, caches build artifacts, conditionally runs/uploads the APK, and includes EAS config and documentation. ChangesAndroid APK Build and Release
Sequence DiagramsequenceDiagram
participant GitHub as GitHub
participant Runner as Actions Runner
participant EAS as Expo EAS
participant GHRelease as GitHub Releases
GitHub->>Runner: Trigger on v* tag or workflow_dispatch
Runner->>Runner: Setup Java 17, Node 20, npm cache
alt Keystore secrets present
Runner->>Runner: Decode base64 keystore -> android/keystores/release.jks
Runner->>Runner: Write app/credentials.json
Runner->>Runner: Patch app/eas.json (credentialsSource: local)
else Keystore secrets missing
Runner->>Runner: Log fallback to remote credentials
end
Runner->>EAS: Run eas build --profile preview
EAS->>Runner: Return app-release.apk (if successful)
alt APK exists and ref is v* tag
Runner->>GHRelease: Create Release and upload app-release.apk
else No APK or non-tag run
Runner->>Runner: Skip release (exit success)
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-android-apk.yml:
- Around line 103-105: The workflow currently exits with 0 when neither
EXPO_TOKEN nor credentials.json is present (the `if [ -z "${{ secrets.EXPO_TOKEN
}}" ] && [ ! -f "credentials.json" ]; then` block), which causes tag-triggered
runs to silently succeed without producing an APK; change the behavior to fail
the job (use a non-zero exit such as `exit 1`) and update the warning message to
indicate a hard failure so missing auth/signing on tag pushes fails loudly;
apply the same change to the analogous check later in the file (the similar
block around lines 111-122) so both places abort with an error when credentials
are missing.
- Around line 65-95: The workflow currently only checks ANDROID_KEYSTORE_BASE64
before decoding the keystore, writing credentials.json, and setting
credentialsSource to 'local' in eas.json; update the conditional to require all
four secrets (ANDROID_KEYSTORE_BASE64, ANDROID_KEYSTORE_PASSWORD,
ANDROID_KEY_ALIAS, ANDROID_KEY_PASSWORD) before proceeding so we never generate
credentials.json with empty fields or flip preview/production to local when any
secret is missing; ensure the same variables are validated in the if-statement
that creates android/keystores/release.jks, builds credentials.json
(keystorePassword, keyAlias, keyPassword) and modifies
data['build']['preview']['android']['credentialsSource'] and
data['build']['production']['android']['credentialsSource'].
- Around line 33-39: Replace the dynamic version pins for the Expo GitHub Action
by setting concrete, tested version strings instead of "latest": update the
expo/expo-github-action usage to specify expo-version and eas-version with
specific version numbers (replace expo-version: latest and eas-version: latest)
so builds are reproducible; locate the action block that uses
expo/expo-github-action and change the expo-version and eas-version inputs to
the exact, app-validated tags you want to pin.
- Around line 17-18: Update the checkout step to set persist-credentials: false
on the actions/checkout@v4 invocation to avoid persisting auth in git config;
pin external actions (e.g., Expo/EAS actions) to immutable refs/SHA instead of
floating tags; in the signing setup validate all required keystore secrets (not
just ANDROID_KEYSTORE_BASE64) before creating credentials.json or mutating
eas.json and fail the job with a clear error if any required secret is missing
(do not silently exit 0), and ensure any conditional behavior in the build step
explicitly logs/skips rather than returning success when secrets are absent.
In `@docs/ANDROID_BUILD_SETUP.md`:
- Around line 43-46: The macOS-style base64 command in the docs ("base64 -i
my-release-key.keystore -o base64-keystore.txt") is not compatible with GNU
coreutils; update the doc to keep the macOS variant and add a Linux-compatible
instruction: for Linux use "base64 -w 0 my-release-key.keystore >
base64-keystore.txt" and include a fallback "base64 my-release-key.keystore | tr
-d '\n' > base64-keystore.txt" for systems without -w; ensure the text labels
these as "To generate the base64 string on macOS/Linux" and "To generate the
base64 string on Linux" alongside the respective commands so readers pick the
correct one.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 3908649b-5cea-49a3-94f8-6115024deaee
📒 Files selected for processing (4)
.github/workflows/build-android-apk.ymlapp/eas.jsondocs/ANDROID_BUILD_SETUP.mddocs/SETUP.md
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the workflow with line numbers
sed -n '1,200p' .github/workflows/build-android-apk.yml | cat -n
# Search for persist-credentials and checkout usage within the workflow
rg -n "persist-credentials|actions/checkout@" .github/workflows/build-android-apk.yml
# Show any steps that use GITHUB_TOKEN/contents/write or run npm ci/build
rg -n "contents:\s*write|GITHUB_TOKEN|EXPO|EAS|eas\.json|credentials\.json|npm ci|skip on forks|workflow_dispatch|push:\s*tags" .github/workflows/build-android-apk.ymlRepository: roshankumar0036singh/Uni-Event
Length of output: 6302
🌐 Web query:
actions/checkout@v4 default persist-credentials
💡 Result:
For actions/checkout@v4, the persist-credentials input defaults to true (i.e., it persists the auth token/credentials in the local git config unless you set persist-credentials: false). [1][2] In more detail: actions/checkout’s README states that the auth token is persisted in the local git config and removed during post-job cleanup, and that setting persist-credentials: false opts out. [2] The action.yml for v4 defines persist-credentials with default: true. [1] Example (opt out): steps: - uses: actions/checkout@v4 with: persist-credentials: false This will prevent checkout from configuring the token/SSH key in the local git config. [1][2]
Citations:
- 1: https://github.com/actions/checkout/blob/v4/action.yml
- 2: https://github.com/actions/checkout/tree/v4
Disable checkout credential persistence.
The workflow grants contents: write and uses actions/checkout@v4 without disabling credential persistence (default is to persist auth in git config), giving later steps unnecessary repo-write access.
- Set
persist-credentials: falseon the checkout step. - Avoid
latest(Expo/EAS) and consider pinning external actions to immutable references (commit/SHA) for reproducibility/supply-chain hardening. - Signing setup only gates on
ANDROID_KEYSTORE_BASE64; validate the other keystore secrets before writingcredentials.json/ mutatingeas.json. - The build step can
exit 0when secrets are missing, which can silently skip tag releases instead of failing.
Suggested change
- name: Checkout repository
uses: actions/checkout@v4
+ with:
+ persist-credentials: false🧰 Tools
🪛 zizmor (1.25.2)
[warning] 17-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-android-apk.yml around lines 17 - 18, Update the
checkout step to set persist-credentials: false on the actions/checkout@v4
invocation to avoid persisting auth in git config; pin external actions (e.g.,
Expo/EAS actions) to immutable refs/SHA instead of floating tags; in the signing
setup validate all required keystore secrets (not just ANDROID_KEYSTORE_BASE64)
before creating credentials.json or mutating eas.json and fail the job with a
clear error if any required secret is missing (do not silently exit 0), and
ensure any conditional behavior in the build step explicitly logs/skips rather
than returning success when secrets are absent.
|
@Nicks-19 handlke all the issues flagged still 3 open |
|
@Nicks-19 did you try to build the apk file once try it once that it should suceed |
|
|
@Nicks-19 did you try to build the apk file once ? |
roshankumar0036singh
merged commit 462e35a
into
roshankumar0036singh:main
2 participants
Summary
This PR adds a GitHub Actions CI/CD workflow to compile and release the Android APK for the mobile application in
app/using EAS Build. This fully resolves #312.Proposed Changes
app/eas.jsonconfiguration definingpreviewandproductionprofiles to produce Android APKs ("buildType": "apk")..github/workflows/build-android-apk.ymlthat:v*) and manual workflow dispatches.ANDROID_KEYSTORE_BASE64repository secret).docs/ANDROID_BUILD_SETUP.mdexplaining how to configure the required secrets (EXPO_TOKEN, keystore parameters) and trigger the builds.docs/SETUP.md.Verification
eas.json.Summary by CodeRabbit
New Features
Documentation