From 803018dacff90c568d4cb9bec7842d73520c6926 Mon Sep 17 00:00:00 2001
From: James Magahern <james@magahern.com>
Date: Sun, 12 Apr 2026 16:51:22 -0700
Subject: [PATCH] [android] release: add signing secrets

---
 .gitea/workflows/android-release.yaml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/.gitea/workflows/android-release.yaml b/.gitea/workflows/android-release.yaml
index 37369cc..b751154 100644
--- a/.gitea/workflows/android-release.yaml
+++ b/.gitea/workflows/android-release.yaml
@@ -48,6 +48,29 @@ jobs:
             "build-tools;33.0.1" \
             "platforms;android-33"
 
+      - name: Prepare Android signing config
+        env:
+          ANDROID_RELEASE_KEYSTORE_B64: ${{ secrets.ANDROID_RELEASE_KEYSTORE_B64 }}
+          ORG_GRADLE_PROJECT_RELEASE_STORE_PASSWORD: ${{ secrets.ANDROID_RELEASE_STORE_PASSWORD }}
+          ORG_GRADLE_PROJECT_RELEASE_KEY_ALIAS: ${{ secrets.ANDROID_RELEASE_KEY_ALIAS }}
+          ORG_GRADLE_PROJECT_RELEASE_KEY_PASSWORD: ${{ secrets.ANDROID_RELEASE_KEY_PASSWORD }}
+        run: |
+          set -eu
+
+          : "${ANDROID_RELEASE_KEYSTORE_B64:?Missing secret ANDROID_RELEASE_KEYSTORE_B64}"
+          : "${ORG_GRADLE_PROJECT_RELEASE_STORE_PASSWORD:?Missing secret ANDROID_RELEASE_STORE_PASSWORD}"
+          : "${ORG_GRADLE_PROJECT_RELEASE_KEY_ALIAS:?Missing secret ANDROID_RELEASE_KEY_ALIAS}"
+          : "${ORG_GRADLE_PROJECT_RELEASE_KEY_PASSWORD:?Missing secret ANDROID_RELEASE_KEY_PASSWORD}"
+
+          keystore_path="${{ gitea.workspace }}/android-release.keystore"
+          printf '%s' "$ANDROID_RELEASE_KEYSTORE_B64" | base64 -d > "$keystore_path"
+          chmod 600 "$keystore_path"
+
+          printf 'ORG_GRADLE_PROJECT_RELEASE_STORE_FILE=%s\n' "$keystore_path" >> "$GITHUB_ENV"
+          printf 'ORG_GRADLE_PROJECT_RELEASE_STORE_PASSWORD=%s\n' "$ORG_GRADLE_PROJECT_RELEASE_STORE_PASSWORD" >> "$GITHUB_ENV"
+          printf 'ORG_GRADLE_PROJECT_RELEASE_KEY_ALIAS=%s\n' "$ORG_GRADLE_PROJECT_RELEASE_KEY_ALIAS" >> "$GITHUB_ENV"
+          printf 'ORG_GRADLE_PROJECT_RELEASE_KEY_PASSWORD=%s\n' "$ORG_GRADLE_PROJECT_RELEASE_KEY_PASSWORD" >> "$GITHUB_ENV"
+
       - name: Build Android release APKs
         working-directory: android
         run: ./gradlew assembleRelease
@@ -112,3 +135,7 @@ jobs:
           target_commitish: ${{ github.sha }}
           files: |
             ${{ env.RELEASE_ASSETS_DIR }}/*.apk
+
+      - name: Clean up signing material
+        if: ${{ always() }}
+        run: rm -f "${{ gitea.workspace }}/android-release.keystore"