Skip to content

K2GO-564 feat(ci): send Play release candidates to review, publish the approved build - #769

Open
luisguzman-adfa wants to merge 3 commits into
mainfrom
chore/K2GO-564-play-publish-workflow
Open

luisguzman-adfa wants to merge 3 commits into
mainfrom
chore/K2GO-564-play-publish-workflow

Conversation

@luisguzman-adfa

Copy link
Copy Markdown
Collaborator

What changes

  • New play-candidate.yml (manual, main only): builds the Play AAB, takes the next versionCode from Play, sends it to review on the beta track, then tags the commit vX.Y.Z-rc.N and archives the AAB to R2. An internal run gets no rc tag.
  • New play-release.yml (manual): accepts only the newest rc of a version. It tags that commit vX.Y.Z and runs the release build (GitHub Release, website APKs, R2, update.json).
  • android-release-build.yml: runs only when play-release.yml calls it. No v* tag push trigger, no Play AAB build.
  • tools/play-publish/play_publish.py (stdlib + openssl) with unit tests: version and rc rules, release notes, Play versionCode, Play API upload.
  • build.gradle: the play flavor takes -PplayVersionCode when it is set. Other flavors do not change.
  • android-r2-republish.yml: optional play_version_code input for the manual fallback.
  • ADR controller/docs/ADR-K2GO-564-play-release-candidates.md; R2_LAYOUT.md updated.

Why

  • Google can reject an update even when the code did not change. The release must be the exact build that Google approved, never a rebuild.
  • A rejected candidate was never released, so it gets rc.N+1 of the same version, not a new version.

Verifications

  • 20 unit tests pass (python -m unittest test_play_publish).
  • Bundle manifest: play AAB with -PplayVersionCode=723 has versionCode 723. Without the property it has 710. The standard flavor does not change.
  • JWT signature checked with a throwaway key (openssl dgst -verify).
  • plan refuses v1.1.0 (already released). final-tag refuses an older rc and a malformed tag.
  • Workflows parse as YAML.
  • Coordination: before the first run, a repo admin creates the GitHub environment google-play with required reviewers and the secret PLAY_SERVICE_ACCOUNT_JSON, and turns on managed publishing in Play Console.
  • Deferred: remove the Play AAB part of android-r2-republish.yml after the first candidate run works.

Notes

  • The Play API cannot read the review result or press "Publish changes". A person reads Google's verdict and presses "Publish changes" after play-release.yml.
  • Workflows with only workflow_dispatch show "Run workflow" only after they are on main.
  • Suggested first run: internal track, to check the credentials end to end.

…e approved build

play-candidate.yml uploads the Play AAB with the next Play versionCode and tags vX.Y.Z-rc.N;
play-release.yml tags the approved rc commit vX.Y.Z and runs the release build. Google can
reject an unchanged build, so the release is the build it approved, never a rebuild.
play-release refuses an older rc (Play holds the newest); candidates build only from main; an
internal-track run gets no rc tag. The manual fallback takes the Play versionCode as an input.
Remove the v* tag push trigger, so a hand-pushed tag cannot ship GitHub, R2 and OTA without a
Google-approved Play build.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant