Skip to content

Attach only the APK to GitHub Releases #126

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Slacker-LLC merged 1 commit into from
Oct 4, 2026
Merged

Attach only the APK to GitHub Releases #126

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,10 +241,10 @@ jobs:
channel_flags=(--prerelease)
latest_flag=--latest=false
fi
# The APK is the only asset; its SHA-256 and the signing certificate
# are in the release notes, and the licenses ship inside the APK.
gh release create "$GITHUB_REF_NAME" \
release-files/openIME-*-arm64-release.apk \
release-files/SHA256SUMS.txt \
release-files/THIRD_PARTY_NOTICES.release.md \
--repo "$GITHUB_REPOSITORY" \
--verify-tag \
--draft \
Expand All @@ -253,8 +253,8 @@ jobs:
--notes-file release-files/RELEASE_NOTES.md

count="$(gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --json assets --jq '.assets | length')"
if [[ "$count" -ne 3 ]]; then
echo "::error::Expected 3 release assets, found $count; the draft was left unpublished."
if [[ "$count" -ne 1 ]]; then
echo "::error::Expected exactly the APK as release asset, found $count; the draft was left unpublished."
exit 1
fi
gh release edit "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --draft=false "$latest_flag"
4 changes: 2 additions & 2 deletions docs/RELEASE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ Rime 共享数据以 `versionCode` 作为部署标记：每次升级后首次启
openIME-v{VERSION}-arm64-release.apk
```

同一个 GitHub Release 还有 `SHA256SUMS.txt` 和 `THIRD_PARTY_NOTICES.release.md`。
GitHub Release 只附这一个 APK。它的 SHA-256 和签名证书指纹写在发布说明正文里；第三方许可证随 APK 打包（`assets/licenses/`），清单见仓库的 `THIRD_PARTY_NOTICES.md`。流水线内部仍生成 `SHA256SUMS.txt` 用于自检，但不上传。
Debug 构建保留 `arm64-v8a + x86_64`，只用于真机和模拟器回归，不发布。

## 签名密钥
Expand Down Expand Up @@ -110,7 +110,7 @@ bash scripts/setup_release_signing.sh
签名证书与 `release-cert.sha256` 一致；
- 生成 SHA-256 和发布说明（测试版带 Beta 提示）；
- 另一个只有写权限、不接触密钥的 job 先建**草稿** Release，确认三个附件齐全后才公开（测试版标为 pre-release，不是 latest）。
5. 发布后核对：下载 APK，`sha256sum -c SHA256SUMS.txt`，`apksigner verify --print-certs`，
5. 发布后核对：下载 APK，`sha256sum` 与发布说明里的值对比，`apksigner verify --print-certs`，
在真机上安装、启用、试打。

### 演练
Expand Down
17 changes: 9 additions & 8 deletions scripts/release_build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,9 @@
# OPENIME_GRADLE_ARGS extra Gradle arguments, e.g. --offline
# ANDROID_HOME SDK containing build-tools/35.0.0 (apksigner, aapt2)
#
# Writes to OPENIME_OUT_DIR: openIME-v<VERSION>-arm64-release.apk, SHA256SUMS.txt,
# THIRD_PARTY_NOTICES.release.md, RELEASE_NOTES.md, apksigner.txt.
# Writes to OPENIME_OUT_DIR: openIME-v<VERSION>-arm64-release.apk, RELEASE_NOTES.md,
# apksigner.txt, and SHA256SUMS.txt for the workflow's own check. Only the APK
# is attached to the GitHub Release; its checksum is printed in the notes.
# Also appends apk=, version= and cert_sha256= to $GITHUB_OUTPUT when it is set.
set -euo pipefail
export PYTHONUTF8=1
Expand Down Expand Up @@ -91,8 +92,9 @@ fi
# 7. Release files.
NAME="openIME-v${VERSION}-arm64-release.apk"
cp "$APK" "$OUT/$NAME"
cp THIRD_PARTY_NOTICES.md "$OUT/THIRD_PARTY_NOTICES.release.md"
(cd "$OUT" && sha256sum "$NAME" > SHA256SUMS.txt)
APK_SHA256="$(cut -d' ' -f1 "$OUT/SHA256SUMS.txt")"
REPO_URL="${GITHUB_SERVER_URL:-https://github.com}/${GITHUB_REPOSITORY:-Slacker-LLC/openIME}"

CHANNEL="$(python3 scripts/release_check.py channel)"
if [[ "$CHANNEL" == "beta" ]]; then
Expand All @@ -112,10 +114,9 @@ fi

### 下载与校验

- \`$NAME\`：$PACKAGE_NOTE。
- \`SHA256SUMS.txt\`：校验和。\`THIRD_PARTY_NOTICES.release.md\`：第三方许可清单。

下载后在同一目录执行 \`sha256sum -c SHA256SUMS.txt\`，校验通过再安装。
- \`$NAME\`：$PACKAGE_NOTE。这是本次发布唯一的附件。
- APK SHA-256：\`$APK_SHA256\`。下载后执行 \`sha256sum $NAME\`，结果一致再安装。
- 第三方组件的许可证随 APK 一起打包；清单见仓库中的 [THIRD_PARTY_NOTICES.md]($REPO_URL/blob/v$VERSION/THIRD_PARTY_NOTICES.md)。

签名证书 SHA-256：\`$(printf '%s' "$CERT_SHA256" | tr -d ':' | tr 'A-F' 'a-f')\`。每个版本都应一致，可用 \`apksigner verify --print-certs\` 核对。

Expand All @@ -124,7 +125,7 @@ fi
- 手写输入尚未接入识别引擎，入口默认隐藏；九键暂不支持与外接键盘同时使用。
- 首次安装后需要完成完整词典部署，期间候选质量略低。
- 发布包只含 arm64-v8a；模拟器请使用 Debug 构建。
- 系统不允许降级或换签名覆盖安装：安装此前版本号更高的包或 Debug 包时，需要先卸载（卸载前可在「设置 → 关于与数据」导出用户数据）。
- 系统不允许降级或换签名覆盖安装：安装此前版本号更高的包或 Debug 包时，需要先卸载（卸载前可在「设置 → 关于与数据 → 数据管理」导出用户数据）。
EOF
} > "$OUT/RELEASE_NOTES.md"

Expand Down
Loading