From 2aaa58af0bbbd576a4d0bfde668fd703a81356e6 Mon Sep 17 00:00:00 2001 From: "Timur Kh." Date: Thu, 22 Oct 2026 19:25:44 +0300 Subject: [PATCH] include glyph sdk to release build --- .gitea/workflows/android-release.yml | 15 ++++++++++---- .gitea/workflows/docker.yml | 30 +++++++++++++++++----------- README.md | 13 +++++++----- 3 files changed, 37 insertions(+), 21 deletions(-) diff --git a/.gitea/workflows/android-release.yml b/.gitea/workflows/android-release.yml index 6120bf4..4fbc08a 100644 --- a/.gitea/workflows/android-release.yml +++ b/.gitea/workflows/android-release.yml @@ -4,10 +4,10 @@ # unit tests run — `:core`'s suite is in `tests.yml`, where no SDK is needed # because `settings.gradle.kts` leaves `:app` out when there is none. # -# The Glyph Matrix AAR is deliberately *not* fetched: its licence forbids -# redistribution, and `app/build.gradle.kts` compiles the `noglyph` source set -# without it. A CI APK therefore has an inert rear display, which is also exactly -# right for any phone that is not a Nothing. +# The Glyph Matrix AAR is not committed (its licence forbids redistribution), so +# the job runs `android/fetch-glyph-sdk.sh` to download it from Nothing before +# Gradle configures the app. That means the APK this produces really has the +# rear-display implementation compiled in, rather than the no-op fallback. name: android on: @@ -32,6 +32,13 @@ jobs: apt-get install -y --no-install-recommends \ openjdk-21-jdk-headless curl unzip >/dev/null + # The AAR is git-ignored but required for a Glyph-enabled build. The + # script exits non-zero if the download is not a real archive, so a vendor + # URL that moves fails the job instead of quietly producing a no-op APK. + - name: Fetch the Glyph Matrix SDK + working-directory: android + run: ./fetch-glyph-sdk.sh + # Keyed on the pinned SDK versions, so this is a download once and a # restore every time after. - uses: actions/cache@v4 diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml index a1291be..31032b3 100644 --- a/.gitea/workflows/docker.yml +++ b/.gitea/workflows/docker.yml @@ -15,13 +15,14 @@ on: branches: [master] tags: ["v*"] -# The built-in job token is enough to push to this instance's own registry; a -# REGISTRY_TOKEN secret is only needed when it is not (an older Gitea, or a -# restricted default permission mode). Ask for packages: write explicitly so the -# token is not silently read-only on instances that default to restricted. +# The built-in job token (`secrets.GITEA_TOKEN`) **cannot** publish packages on +# Gitea — `permissions:` has no effect on container pushes, and the job token is +# read-only there by design. Publishing therefore needs a personal access token +# with `package:write`, stored as REGISTRY_TOKEN. Without it the image is still +# built and smoke-tested, but not pushed; that keeps the build honest without +# failing every push on a repository that has not minted a token yet. permissions: contents: read - packages: write env: REGISTRY: git.timka.su @@ -37,23 +38,27 @@ jobs: run: docker version - name: Log in to the Gitea registry + id: login env: # The username is only needed to pair with the token. Default it to the # repository owner — the same account the image namespace belongs to — # so a missing REGISTRY_USER secret does not fail the job with docker's # unhelpful "username is empty". REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.repository_owner }} - # Gitea gives every job a built-in token (secrets.GITEA_TOKEN). Prefer - # an explicit secret, but fall back to that token so a fresh repository - # publishes without anyone having to mint one by hand. - REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || secrets.GITEA_TOKEN }} + # A personal access token with `package:write`. The built-in job token + # is not usable here: Gitea's job token is read-only for packages (its + # `permissions:` support does not cover the container registry yet), + # so falling back to it only produces a confusing 401. + REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }} run: | if [ -z "$REGISTRY_USER" ] || [ -z "$REGISTRY_TOKEN" ]; then - echo "::error::Container registry credentials are missing. Set REGISTRY_TOKEN (a token with package:write) under Settings → Actions → Secrets; REGISTRY_USER is optional and defaults to the repository owner." - exit 1 + echo "::warning::No REGISTRY_TOKEN (a personal access token with package:write) — the image will be built and smoke-tested but not pushed. Add it under Settings → Actions → Secrets to publish." + echo "push=false" >> "$GITHUB_OUTPUT" + exit 0 fi printf '%s' "$REGISTRY_TOKEN" \ | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin + echo "push=true" >> "$GITHUB_OUTPUT" - name: Build run: | @@ -80,12 +85,13 @@ jobs: docker rm -f kadence-smoke - name: Push + if: steps.login.outputs.push == 'true' run: | docker push "$IMAGE:$SHORT" docker push "$IMAGE:latest" - name: Push the tag, when there is one - if: startsWith(github.ref, 'refs/tags/v') + if: steps.login.outputs.push == 'true' && startsWith(github.ref, 'refs/tags/v') run: | VERSION="${GITHUB_REF#refs/tags/}" docker tag "$IMAGE:$SHORT" "$IMAGE:$VERSION" diff --git a/README.md b/README.md index 42b8ad0..b38fcae 100644 --- a/README.md +++ b/README.md @@ -299,7 +299,7 @@ Secrets, all under *Repository → Settings → Actions → Secrets*: | Secret | For | | --- | --- | -| `REGISTRY_TOKEN` | only when the built-in `GITEA_TOKEN` cannot push to the Gitea registry (older Gitea, or restricted token permissions); `package:write` is needed. `REGISTRY_USER` is optional and defaults to the repository owner | +| `REGISTRY_TOKEN` | publishing the image: **a personal access token with `package:write`**. Gitea's built-in `GITEA_TOKEN` is read-only for packages, so it cannot be used here. `REGISTRY_USER` is optional and defaults to the repository owner. Without this secret the `docker` workflow still builds and smoke-tests the image, but skips the push | | `KADENCE_KEYSTORE_BASE64` | `base64 -w0 your.keystore` | | `KADENCE_KEYSTORE_PASSWORD`, `KADENCE_KEY_ALIAS`, `KADENCE_KEY_PASSWORD` | the key inside it | @@ -310,10 +310,13 @@ secret **fail the build**: the Gradle config otherwise falls back to the debug k without a word, and a debug-signed "release" installs happily and can then never be upgraded by a properly signed one. -The Glyph Matrix AAR is deliberately not fetched in CI — its licence forbids -redistribution, and the build compiles the `noglyph` source set without it, so a -CI APK has an inert rear display. That is also the correct behaviour on any phone -that is not a Nothing. +The Glyph Matrix AAR is not committed — its licence forbids redistribution — so +the APK job runs `android/fetch-glyph-sdk.sh` before Gradle configures the app, +downloading it from Nothing's developer kit. The resulting CI APK therefore +contains the real rear-display implementation; the `noglyph` no-op fallback is +only used for local builds where the AAR has not been fetched. Because the +licence forbids redistribution, the downloaded AAR stays out of the artifacts: +only the finished APK is uploaded. ---