CI-sichere Release-Signing-Konfiguration für app und humanoperator

README.md

@@ -66,3 +66,7 @@ Free models accessible via an API can be found [here](https://github.com/cheahjs
 If you in your Google account identified as under 18, you need an adult account because Google is (unreasonably) denying you the API key.
 
 Preview models will eventually be removed by Google and unfortunately won't be redirected to finished equivalents. If this happens, please change the API in the code.
+
+## CI Release Signing
+
+Dokumentation für CI-Secrets und Verhalten bei fehlender Signing-Konfiguration: [docs/ci-signing.md](docs/ci-signing.md)

app/build.gradle.kts

@@ -1,4 +1,3 @@
-
 plugins {
     id("com.android.application")
     id("org.jetbrains.kotlin.android")
@@ -14,6 +13,21 @@ System.getenv("SCREENOPERATOR_BUILD_DIR")?.takeIf { it.isNotBlank() }?.let { cus
     layout.buildDirectory = file(customBuildDir)
 }
 
+val releaseSigningEnv = mapOf(
+    "ANDROID_KEYSTORE_PATH" to System.getenv("ANDROID_KEYSTORE_PATH"),
+    "ANDROID_KEY_ALIAS" to System.getenv("ANDROID_KEY_ALIAS"),
+    "ANDROID_KEYSTORE_PASSWORD" to System.getenv("ANDROID_KEYSTORE_PASSWORD"),
+    "ANDROID_KEY_PASSWORD" to System.getenv("ANDROID_KEY_PASSWORD"),
+)
+
+val missingReleaseSigningEnv = releaseSigningEnv
+    .filterValues { it.isNullOrBlank() }
+    .keys
+
+val isReleaseTaskRequested = gradle.startParameter.taskNames.any { task ->
+    task.contains("release", ignoreCase = true)
+}
+
 android {
     namespace = "com.google.ai.sample"
     compileSdk = 35
@@ -34,12 +48,27 @@ android {
         }
     }
 
+    signingConfigs {
+        create("release") {
+            if (missingReleaseSigningEnv.isEmpty()) {
+                storeFile = file(releaseSigningEnv.getValue("ANDROID_KEYSTORE_PATH")!!)
+                storePassword = releaseSigningEnv.getValue("ANDROID_KEYSTORE_PASSWORD")
+                keyAlias = releaseSigningEnv.getValue("ANDROID_KEY_ALIAS")
+                keyPassword = releaseSigningEnv.getValue("ANDROID_KEY_PASSWORD")
+            }
+        }
+    }
+
     buildTypes {
         getByName("debug") {
             isDebuggable = true
         }
         getByName("release") {
             isDebuggable = false
+            if (missingReleaseSigningEnv.isEmpty()) {
+                signingConfig = signingConfigs.getByName("release")
+            }
+        }
         }
         create("samples") {
             initWith(getByName("debug"))
@@ -67,6 +96,13 @@ android {
     }
 }
 
+if (isReleaseTaskRequested && missingReleaseSigningEnv.isNotEmpty()) {
+    error(
+        "Release signing env vars missing for module :app: ${missingReleaseSigningEnv.joinToString(", ")}. " +
+            "Set ANDROID_KEYSTORE_PATH, ANDROID_KEY_ALIAS, ANDROID_KEYSTORE_PASSWORD and ANDROID_KEY_PASSWORD."
+    )
+}
+
 dependencies {
     constraints {
         implementation("org.jetbrains.kotlin:kotlin-stdlib:1.9.20")

docs/ci-signing.md

@@ -0,0 +1,19 @@
+# CI Signing für Release-Builds
+
+Die Module `app` und `humanoperator` erwarten für Release-Tasks eine Signing-Konfiguration über Umgebungsvariablen.
+
+## Benötigte CI-Secrets
+
+- `ANDROID_KEYSTORE_PATH`: Absoluter oder relativ zum Projekt auflösbarer Pfad zur Keystore-Datei.
+- `ANDROID_KEY_ALIAS`: Alias des Release-Keys.
+- `ANDROID_KEYSTORE_PASSWORD`: Passwort der Keystore-Datei.
+- `ANDROID_KEY_PASSWORD`: Passwort des Keys.
+
+## Verhalten bei fehlenden Variablen
+
+- Für **Release-Tasks** (Taskname enthält `release`) wird der Build mit einer klaren Fehlermeldung abgebrochen, wenn eine der Variablen fehlt.
+- Für Nicht-Release-Tasks bleibt die Signing-Config ungesetzt, damit lokale Debug-Builds weiter funktionieren.
+
+## Wichtiger Hinweis zu Firebase
+
+`google-services.json` bleibt unverändert versioniert und ist **nicht** Teil der Signing-Logik.

humanoperator/build.gradle.kts

@@ -4,6 +4,21 @@ plugins {
     id("com.google.gms.google-services")
 }
 
+val releaseSigningEnv = mapOf(
+    "ANDROID_KEYSTORE_PATH" to System.getenv("ANDROID_KEYSTORE_PATH"),
+    "ANDROID_KEY_ALIAS" to System.getenv("ANDROID_KEY_ALIAS"),
+    "ANDROID_KEYSTORE_PASSWORD" to System.getenv("ANDROID_KEYSTORE_PASSWORD"),
+    "ANDROID_KEY_PASSWORD" to System.getenv("ANDROID_KEY_PASSWORD"),
+)
+
+val missingReleaseSigningEnv = releaseSigningEnv
+    .filterValues { it.isNullOrBlank() }
+    .keys
+
+val isReleaseTaskRequested = gradle.startParameter.taskNames.any { task ->
+    task.contains("release", ignoreCase = true)
+}
+
 android {
     namespace = "com.screenoperator.humanoperator"
     compileSdk = 35
@@ -21,10 +36,25 @@ android {
         }
     }
 
+    signingConfigs {
+        create("release") {
+            if (missingReleaseSigningEnv.isEmpty()) {
+                storeFile = file(releaseSigningEnv.getValue("ANDROID_KEYSTORE_PATH")!!)
+                storePassword = releaseSigningEnv.getValue("ANDROID_KEYSTORE_PASSWORD")
+                keyAlias = releaseSigningEnv.getValue("ANDROID_KEY_ALIAS")
+                keyPassword = releaseSigningEnv.getValue("ANDROID_KEY_PASSWORD")
+            }
+        }
+    }
+
     buildTypes {
         release {
             isMinifyEnabled = false
             proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
+            if (missingReleaseSigningEnv.isEmpty()) {
+                signingConfig = signingConfigs.getByName("release")
+            }
+        }
         }
     }
 
@@ -43,6 +73,13 @@ android {
     }
 }
 
+if (isReleaseTaskRequested && missingReleaseSigningEnv.isNotEmpty()) {
+    error(
+        "Release signing env vars missing for module :humanoperator: ${missingReleaseSigningEnv.joinToString(", ")}. " +
+            "Set ANDROID_KEYSTORE_PATH, ANDROID_KEY_ALIAS, ANDROID_KEYSTORE_PASSWORD and ANDROID_KEY_PASSWORD."
+    )
+}
+
 dependencies {
     implementation("androidx.core:core-ktx:1.9.0")
     implementation("androidx.lifecycle:lifecycle-runtime-ktx:2.6.2")