This repository was archived by the owner on Mar 26, 2026. It is now read-only.
Repository navigation
Verify APK #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Verify APK | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: Git tag or branch to rebuild | |
| required: true | |
| type: string | |
| official_apk_url: | |
| description: URL to the official APK (public or accessible with default token) | |
| required: true | |
| type: string | |
| stage: | |
| description: Stage to run (all, build, diff) | |
| required: false | |
| default: all | |
| type: choice | |
| options: | |
| - all | |
| - build | |
| - diff | |
| base_image_tag: | |
| description: gem-android-base tag in GHCR | |
| required: false | |
| default: "" | |
| type: string | |
| concurrency: | |
| group: verify-apk-${{ github.event.inputs.tag || github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| verify: | |
| name: Verify APK | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 360 | |
| permissions: | |
| contents: read | |
| packages: read | |
| env: | |
| DOCKER_BUILDKIT: 1 | |
| VERIFY_BASE_IMAGE: ghcr.io/${{ github.repository_owner }}/gem-android-base | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| - name: Read base image tag (default) | |
| id: base_tag | |
| run: | | |
| DEFAULT_TAG=$(cat reproducible/base_image_tag.txt) | |
| echo "tag=${DEFAULT_TAG}" >> "$GITHUB_OUTPUT" | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@v3 | |
| - name: Install apksigcopier and diffoscope | |
| run: | | |
| echo "Initial GITHUB_PATH:" | |
| cat "$GITHUB_PATH" | |
| uv tool install apksigcopier diffoscope | |
| echo "$HOME/.local/bin" >> "$GITHUB_PATH" | |
| - name: Create local.properties for CI | |
| run: | | |
| echo "gpr.username=${{ github.actor }}" > local.properties | |
| echo "gpr.token=${{ secrets.GITHUB_TOKEN }}" >> local.properties | |
| echo "# Automatically generated for verify-apk workflow" >> local.properties | |
| - name: Download official APK | |
| run: | | |
| curl -L --fail --retry 3 --retry-delay 5 "${{ inputs.official_apk_url }}" -o official.apk | |
| - name: Run verify_apk.py | |
| env: | |
| VERIFY_BASE_TAG: ${{ inputs.base_image_tag != '' && inputs.base_image_tag || steps.base_tag.outputs.tag }} | |
| run: | | |
| python3 reproducible/verify_apk.py "${{ inputs.tag }}" official.apk --stage "${{ inputs.stage }}" | |
| - name: Upload artifacts | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: verify-apk-${{ inputs.tag }} | |
| path: | | |
| artifacts/reproducible/${{ inputs.tag }}/*.apk | |
| artifacts/reproducible/${{ inputs.tag }}/*.html | |
| retention-days: 7 |