Release nightly app #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release nightly app | |
| # Everything specific to nightly builds lives here. The build and distribution itself is delegated | |
| # to release_acceptance_app.yml, which is shared with manually dispatched releases. | |
| on: | |
| schedule: | |
| # Every work day (Mon-Fri) at 00:00 UTC | |
| - cron: '0 0 * * 1-5' | |
| workflow_dispatch: | |
| jobs: | |
| # The version name and the release notes are resolved here rather than at each point of use. The | |
| # build and the cleanup at the end both depend on the version name, and a nightly release that no | |
| # longer matches would silently stop being cleaned up. | |
| nightly_config: | |
| name: Resolve nightly configuration | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| outputs: | |
| version_name: ${{ steps.resolve.outputs.version_name }} | |
| release_notes: ${{ steps.resolve.outputs.release_notes }} | |
| steps: | |
| # Nightly releases all carry the same version name and version code, so the commit is the only | |
| # thing that tells them apart. Expressions cannot take a substring, hence a step for this. | |
| - name: Resolve nightly configuration | |
| id: resolve | |
| run: | | |
| { | |
| echo "version_name=nightly" | |
| echo "release_notes=Latest SDK build (${GITHUB_SHA::7})" | |
| } >> "$GITHUB_OUTPUT" | |
| build_and_release: | |
| name: Build and release | |
| needs: nightly_config | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/release_acceptance_app.yml | |
| with: | |
| version_name: ${{ needs.nightly_config.outputs.version_name }} | |
| release_notes: ${{ needs.nightly_config.outputs.release_notes }} | |
| secrets: | |
| GRADLE_ENCRYPTION_KEY: ${{ secrets.GRADLE_ENCRYPTION_KEY }} | |
| ADYEN_ANDROID_ACCEPTANCE_SIGNING_KEY_STORE_B64: ${{ secrets.ADYEN_ANDROID_ACCEPTANCE_SIGNING_KEY_STORE_B64 }} | |
| ADYEN_ANDROID_ACCEPTANCE_MERCHANT_SERVER_URL: ${{ secrets.ADYEN_ANDROID_ACCEPTANCE_MERCHANT_SERVER_URL }} | |
| ADYEN_ANDROID_ACCEPTANCE_CLIENT_KEY: ${{ secrets.ADYEN_ANDROID_ACCEPTANCE_CLIENT_KEY }} | |
| ADYEN_ANDROID_ACCEPTANCE_SIGNING_PASSWORD: ${{ secrets.ADYEN_ANDROID_ACCEPTANCE_SIGNING_PASSWORD }} | |
| ADYEN_ANDROID_ACCEPTANCE_SIGNING_KEY_ALIAS: ${{ secrets.ADYEN_ANDROID_ACCEPTANCE_SIGNING_KEY_ALIAS }} | |
| ADYEN_ANDROID_FIREBASE_APP_ID: ${{ secrets.ADYEN_ANDROID_FIREBASE_APP_ID }} | |
| ADYEN_ANDROID_FIREBASE_SERVICE_ACCOUNT_FILE: ${{ secrets.ADYEN_ANDROID_FIREBASE_SERVICE_ACCOUNT_FILE }} | |
| # Only a single nightly release should be available to testers at a time. App Distribution always | |
| # creates a new release instead of replacing an existing one, so the superseded releases are | |
| # removed here. This needs a successful release, so a failed one leaves the previous nightly | |
| # release untouched. | |
| remove_superseded_releases: | |
| name: Remove superseded releases | |
| needs: [nightly_config, build_and_release] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| # Mints a short lived access token from the service account, to authenticate the App | |
| # Distribution REST API calls below. The token is only valid for one hour and is never stored. | |
| - name: Authenticate to Google Cloud | |
| id: auth | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 | |
| with: | |
| credentials_json: ${{ secrets.ADYEN_ANDROID_FIREBASE_SERVICE_ACCOUNT_FILE }} | |
| token_format: access_token | |
| access_token_scopes: https://www.googleapis.com/auth/cloud-platform | |
| - name: Remove superseded nightly releases | |
| env: | |
| ACCESS_TOKEN: ${{ steps.auth.outputs.access_token }} | |
| APP_ID: ${{ secrets.ADYEN_ANDROID_FIREBASE_APP_ID }} | |
| VERSION_NAME: ${{ needs.nightly_config.outputs.version_name }} | |
| run: | | |
| # The project number is the second segment of the app id. | |
| project_number=$(echo "$APP_ID" | cut -d: -f2) | |
| api="https://firebaseappdistribution.googleapis.com/v1/projects/$project_number/apps/$APP_ID/releases" | |
| # Releases are returned newest first, so everything after the newest nightly release is | |
| # superseded. Matching on displayVersion (the version name) means that releases with an | |
| # actual version name can never be removed here. | |
| names=$(curl --silent --show-error --fail --get "$api" \ | |
| --header "Authorization: Bearer $ACCESS_TOKEN" \ | |
| --data-urlencode 'pageSize=100' \ | |
| | jq --compact-output --arg version "$VERSION_NAME" \ | |
| '[(.releases // [])[] | select(.displayVersion == $version) | .name] | .[1:]') | |
| if [ "$names" = "[]" ]; then | |
| echo "No superseded nightly releases to remove." | |
| exit 0 | |
| fi | |
| echo "Removing superseded nightly releases: $names" | |
| curl --silent --show-error --fail --request POST "${api}:batchDelete" \ | |
| --header "Authorization: Bearer $ACCESS_TOKEN" \ | |
| --header "Content-Type: application/json" \ | |
| --data "{\"names\": $names}" |