[Automatic] Upstream release 3.4.1 #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Verify Dependency Metadata | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| - develop | |
| - release/* | |
| paths: | |
| - 'gradle/libs.versions.toml' | |
| - 'gradle/verification-metadata.xml' | |
| - '**/*.gradle.kts' | |
| - '**/build.gradle' | |
| jobs: | |
| verify-dependency-metadata: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout PR branch | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.head_ref }} | |
| fetch-depth: 0 | |
| token: ${{ secrets.DHIS2_BOT_GITHUB_TOKEN }} | |
| - name: Set Up JDK | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: 'zulu' | |
| java-version: '17' | |
| cache: 'gradle' | |
| - name: Change wrapper permissions | |
| run: chmod +x ./gradlew | |
| - name: Decode Keystore | |
| id: decode_keystore | |
| if: github.event.pull_request.head.repo.full_name == github.repository | |
| uses: timheuer/base64-to-file@784a1a4a994315802b7d8e2084e116e783d157be | |
| with: | |
| fileName: 'dhis_keystore.jks' | |
| encodedString: ${{ secrets.KEYSTORE }} | |
| - name: Decode Training Keystore | |
| id: decode_training_keystore | |
| if: github.event.pull_request.head.repo.full_name == github.repository | |
| uses: timheuer/base64-to-file@784a1a4a994315802b7d8e2084e116e783d157be | |
| with: | |
| fileName: 'dhis_training_keystore.jks' | |
| encodedString: ${{ secrets.TRAINING_KEYSTORE_BASE64 }} | |
| - name: Regenerate verification metadata | |
| env: | |
| SENTRY_DSN: ${{ secrets.SENTRY_DSN }} | |
| SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} | |
| SIGNING_KEY_ALIAS: ${{ secrets.KEY_ALIAS }} | |
| SIGNING_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }} | |
| SIGNING_STORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }} | |
| SIGNING_KEYSTORE_PATH: ${{ steps.decode_keystore.outputs.filePath }} | |
| TRAINING_KEY_ALIAS: ${{ secrets.TRAINING_KEY_ALIAS }} | |
| TRAINING_KEY_PASSWORD: ${{ secrets.TRAINING_KEY_PASSWORD }} | |
| TRAINING_STORE_PASSWORD: ${{ secrets.TRAINING_STORE_PASSWORD }} | |
| TRAINING_STORE_FILE: ${{ steps.decode_training_keystore.outputs.filePath }} | |
| run: | | |
| ./gradlew --write-verification-metadata sha256 --no-daemon \ | |
| help \ | |
| app:assembleDhis2Release \ | |
| app:assembleDhis2PlayServicesRelease \ | |
| app:assembleDhis2TrainingRelease | |
| - name: Check if metadata changed | |
| id: check-diff | |
| run: | | |
| if git diff --quiet gradle/verification-metadata.xml; then | |
| echo "changed=false" >> $GITHUB_OUTPUT | |
| echo "✅ verification-metadata.xml is up to date." | |
| else | |
| echo "changed=true" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Fail for fork PRs with outdated metadata | |
| if: steps.check-diff.outputs.changed == 'true' && github.event.pull_request.head.repo.full_name != github.repository | |
| run: | | |
| echo "⚠️ Fork PR: verification-metadata.xml is out of date but cannot be auto-committed." | |
| echo "Please run './gradlew --write-verification-metadata sha256 help' locally and commit the result." | |
| exit 1 | |
| - name: Commit updated metadata | |
| if: steps.check-diff.outputs.changed == 'true' && github.event.pull_request.head.repo.full_name == github.repository | |
| uses: flex-development/gh-commit@177be4b5bca1b102400ca7220932d9ff7980fddb | |
| with: | |
| message: 'chore: update dependency verification metadata' | |
| ref: ${{ github.head_ref }} | |
| token: ${{ secrets.DHIS2_BOT_GITHUB_TOKEN }} |