Obtainium/.github/workflows/release.yml

name: Release (Manual/Draft)

on:
  workflow_dispatch:
    
jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      
      - uses: actions/checkout@v3
        
      - uses: subosito/flutter-action@v2

      - name: Temp
        env:
          PGP_KEY_BASE64: ${{ secrets.PGP_KEY_BASE64 }}
          PGP_KEY_PASSPHRASE: ${{ secrets.PGP_KEY_PASSPHRASE }}
        run: |
          echo "$PGP_KEY_BASE64" | base64 -d | gpg --import --passphrase "$PGP_KEY_PASSPHRASE"
          PGP_KEY_FINGERPRINT="$(gpg --list-keys --with-colon "$(echo "$PGP_KEY_BASE64" | base64 -d | gpg --with-fingerprint --list-packets | grep 'user ID' | awk -F'"' '{print $2}')" | awk -F: '/^pub:/ { print $5 }')"
          gpg --batch --yes --delete-secret-keys "$PGP_KEY_FINGERPRINT"
          gpg --batch --yes --delete-keys "$PGP_KEY_FINGERPRINT"

      - name: Build APKs
        run: |
          sed -i 's/signingConfig signingConfigs.release//g' android/app/build.gradle
          flutter build apk && flutter build apk --split-per-abi
        
      - name: Sign APKs
        env:
          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
          KEYSTORE_PASS: ${{ secrets.KEYSTORE_PASS }}
          PGP_KEY_BASE64: ${{ secrets.PGP_KEY_BASE64 }}
          PGP_KEY_PASSPHRASE: ${{ secrets.PGP_KEY_PASSPHRASE }}
        run: |
          echo "${KEYSTORE_BASE64}" | base64 -d > apksign.keystore
          echo "$PGP_KEY_BASE64" | base64 -d | gpg --import --passphrase "$PGP_KEY_PASSPHRASE"
          PGP_KEY_FINGERPRINT="$(gpg --list-keys --with-colon "$(echo "$PGP_KEY_BASE64" | base64 -d | gpg --with-fingerprint --list-packets | grep 'user ID' | awk -F'"' '{print $2}')" | awk -F: '/^pub:/ { print $5 }')"
          for apk in ./build/app/outputs/flutter-apk/*-release*.apk; do
            unsignedFn=${apk/-release/-unsigned}
            mv "$apk" "$unsignedFn"
            ${ANDROID_HOME}/build-tools/30.0.2/apksigner sign --ks apksign.keystore --ks-pass env:KEYSTORE_PASS --out "${apk}" "${unsignedFn}"
            sha256sum ${apk} | cut -d " " -f 1 > "$apk".sha256
            gpg --sign --detach-sig "$apk".sha256
          done
          rm apksign.keystore
          gpg --batch --yes --delete-secret-keys "$PGP_KEY_FINGERPRINT"
          gpg --batch --yes --delete-keys "$PGP_KEY_FINGERPRINT"
        
      - name: Extract Version
        id: extract_version      
        run: |
           VERSION=$(grep -oP "currentVersion = '\K[^']+" lib/main.dart)
           echo "::set-output name=version::$VERSION"
           TAG=$(grep -oP "'.*\\\$currentVersion.*'" lib/main.dart | head -c -2 | tail -c +2 | sed "s/\$currentVersion/$VERSION/g")
           echo "::set-output name=tag::$TAG"
           if [ -n "$(echo $TAG | grep -oP '\-beta$')" ]; then BETA=true; else BETA=false; fi
           echo "::set-output name=beta::$BETA"
      
      - name: Create Release And Upload APKs
        uses: ncipollo/release-action@v1
        with:
          token: ${{ secrets.GITHUB_ACCESS_TOKEN }}
          tag: "${{ steps.extract_version.outputs.tag }}"
          prerelease: "${{ steps.extract_version.outputs.beta }}"
          artifacts: ./build/app/outputs/flutter-apk/*-release*.apk*
          draft: true
                  
      - name: Archive Reports For Job
        uses: actions/upload-artifact@v3
        with:
          name: reports
          path: '*/build/reports'
        if: ${{ always() }}