Image from pexels

To release an Android app to the public, every Android Developer needs to build and sign their Android build securely to publish it on Play Store or any other store to download. No store allows unsigned builds to be published.

Signing Android build gives developers ownership of the Android app so that no other developer can release the same app with a different sign.

Even if your project is open source and you’re not planning to publish on any store and distribute through the Github Release page or any other tool, you’ll still need to build and sign your Android build. There are several reasons why a release build is necessary:

• Performance: A release build is optimised for performance, with code and resources stripped of unnecessary debug information and libraries.
• Security: Signing the app helps ensure its integrity and authenticity, preventing security issues and harm to users.
• Updates: Signing enables efficient and secure updates to the app, maintaining user trust.

You can easily use the Android Studio’s built-in Generate Signed Bundle/APK function. Still, it is cumbersome to do manually for every release and it is also not secure to share your keystore file and password with other peers to create a release build. As the quote says

Anything that you do more than twice has to be automated.

In this blog, we will explore how you can use GitHub Actions to automate the process of signing Android build and creating release on GitHub. We will cover the basics of GitHub Actions, the steps involved in building and signing your Android app, and best practices to ensure your app is secure and ready for release. So let’s dive in and learn how to build and sign your Android app securely using GitHub Actions.

Setting up Gradle

Before we can start with the actual implementation, we need to set up signingConfigs in our app-level build.gradleto use environment variables from our GitHub secrets, which we will later set up. The following code will use our decoded keystore file and use environment variables to sign the app.

android {
...
    signingConfigs {
        release {
            storeFile file("keystore.jks")
            storePassword System.getenv("SIGNING_STORE_PASSWORD")
            keyAlias System.getenv("SIGNING_KEY_ALIAS")
            keyPassword System.getenv("SIGNING_KEY_PASSWORD")
        }
    }
...
}

Encoding KeyStore

To sign your android build, you need keystore(.jks) a file. If you don’t already have your keystore file then you can follow the process from the official doc here.

Do not add your keystore file in your project and push along with your project file.

For encoding, we will use the popular Base64 encoding scheme. This scheme will allow converting binary data into a text representation

Text representation will allow us to store the file as text in our GitHub Secrets and later on in the GitHub workflow process decode it back to our original KeyStore file.

To encode the file use these commands based on ur machine.

Mac:
 base64 --i [Jks FilePath] --i [EncodeFilePath].txt

Alpine & Ubuntu:
 base64 [Jks FilePath] > [EncodeFilePath].txt

e.g. `base64 — input ~/Document/Project/keystore.jks — output encoded_keystore.b64

You should see a new file named encoded_keystore.txt

GitHub Actions Workflow

GitHub Actions is Github’s tool to automate the software CI/CD workflows.

GitHub Secrets

GitHub Secrets is the feature that allows users to securely store and manage sensitive information that their workflows need to access, such as API keys, tokens, or passwords.

Using GitHub Secrets, you can avoid exposing sensitive information in your code or workflows. Secrets can be used to store encrypted values and only decrypted during runtime, and they are never shown in the logs or exposed to users.

We used in environment variables in out build.gradle in signingConfigs. To access those variables, we need to create GitHub Secrets with the same name.

SIGNING_KEY_STORE_BASE64

To store base64 encoded text we created in previous step. Copy the content from the file and paste it as secret in the GitHub console

SIGNING_STORE_PASSWORD

To store the password which you used while creating the keystore (.jks) file

SIGNING_KEY_ALIAS

To store the key alias

SIGNING_KEY_PASSWORD

To store the key password you used.

SIGNING_KEY_STORE_PATH

In build.gradle you must have noticed storeFile path or file name. This is secret is to store the path and name of the decoded keystore (.jks) file for easily accessible by the workflow for decoding.

Set the value to keytore.jks

Workflow

on:
  push:
    branches: master
    tags:
      - v*

 release_build:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')
 
     steps:
       - uses: actions/checkout@v2.6.0
 
       - name: Setup JAVA 11
         uses: actions/setup-java@v3
         with:
           distribution: 'corretto'
           java-version: 11
 
       - name: Cache Gradle and wrapper
         uses: actions/cache@v2
         with:
           path: |
             ~/.gradle/caches
             ~/.gradle/wrapper
           key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*') }}
      
      #1     
       - name: Decode Keystore
         env:
           ENCODED_STRING: ${{ secrets.SIGNING_KEY_STORE_BASE64 }}
           SIGNING_KEY_STORE_PATH: ${{ secrets.SIGNING_KEY_STORE_PATH }}
 
         run: |
           echo $ENCODED_STRING > keystore-b64.txt
           base64 -d keystore-b64.txt > $SIGNING_KEY_STORE_PATH
           
       #2
       - name: Build Release apk
         env:
           SIGNING_KEY_STORE_PATH: ${{ secrets.SIGNING_KEY_STORE_PATH }}
           SIGNING_KEY_ALIAS: ${{ secrets.SIGNING_KEY_ALIAS }}
           SIGNING_KEY_PASSWORD: ${{ secrets.SIGNING_KEY_PASSWORD }}
           SIGNING_STORE_PASSWORD: ${{ secrets.SIGNING_STORE_PASSWORD }}
         run: ./gradlew assembleRelease
 
       - name: Build Release bundle
         env:
           SIGNING_KEY_STORE_PATH: ${{ secrets.SIGNING_KEY_STORE_PATH }}
           SIGNING_KEY_ALIAS: ${{ secrets.SIGNING_KEY_ALIAS }}
           SIGNING_KEY_PASSWORD: ${{ secrets.SIGNING_KEY_PASSWORD }}
           SIGNING_STORE_PASSWORD: ${{ secrets.SIGNING_STORE_PASSWORD }}
         run: ./gradlew bundleRelease
       #3
       - name: Upload Release Build to Artifacts
         uses: actions/upload-artifact@v3
         with:
           name: release-artifacts
           paths: |
             app/build/outputs/apk/release/
             app/build/outputs/bundle/release/
       #4      
       - name: Create Github Release
         uses: softprops/action-gh-release@v1
         with:
           generate_release_notes: true
           prerelease: true
           files: |
             app/build/outputs/apk/release/app-release.apk
             app/build/outputs/bundle/release/app-release.aab

This is the job to build a release apk and bundle, upload artifacts and finally create a release.

This is the job release_build. This will run on ubuntu-latest and this condition startsWith(github.ref, 'refs/tags/')will make sure that this job will only be triggered when the tag value be pushed in the master branch.

I will directly jump to the Decode keystore step but if you’re unfamiliar with steps before this then you should check my previous article, I have explained this in that.

This article was previously published on proandroiddev.com