Merge pull request #55951 from software-mansion-labs/war-in/create-key-in-compare-workflow

[No QA] Fix profiling workflow by generating signing keys

Author: mountiny

.github/workflows/compareNDandODbuilds.yml

@@ -6,7 +6,7 @@ on:
 jobs:
   buildHybridAppAndroid:
     name: Build HybridApp Android
-    runs-on: macos-15-xlarge
+    runs-on: ubuntu-latest-xl
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -30,23 +30,65 @@ jobs:
         with:
           IS_HYBRID_BUILD: 'true'
 
+      - name: Run grunt build
+        run: |
+          cd Mobile-Expensify
+          npm run grunt:build:shared
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'oracle'
+          java-version: '17'
+
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1.190.0
+        with:
+          bundler-cache: true
+
+      - name: Install New Expensify Gems
+        run: bundle install
+
+      - name: Install 1Password CLI
+        uses: 1password/install-cli-action@v1
+
+      - name: Load files from 1Password
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+        run: |
+          op document get --output ./upload-key.keystore upload-key.keystore 
+          op document get --output ./android-fastlane-json-key.json android-fastlane-json-key.json
+          # Copy the keystore to the Android directory for Fullstory
+          cp ./upload-key.keystore Mobile-Expensify/Android 
+
+      - name: Load Android upload keystore credentials from 1Password
+        id: load-credentials
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          ANDROID_UPLOAD_KEYSTORE_PASSWORD: op://Mobile-Deploy-CI/Repository-Secrets/ANDROID_UPLOAD_KEYSTORE_PASSWORD
+          ANDROID_UPLOAD_KEYSTORE_ALIAS: op://Mobile-Deploy-CI/Repository-Secrets/ANDROID_UPLOAD_KEYSTORE_ALIAS
+          ANDROID_UPLOAD_KEY_PASSWORD: op://Mobile-Deploy-CI/Repository-Secrets/ANDROID_UPLOAD_KEY_PASSWORD
+
       - name: Build Android Release
         working-directory: Mobile-Expensify/Android
         run: |
-          if ! ./gradlew --profile assembleRelease
-          then
-            echo "❌ Android HybridApp failed to build: Please reach out to Contributor+ and/or Expensify engineers for help in #expensify-open-source to resolve."
-            exit 1
-          else
-            echo "✅ Build succeeded. Printing Gradle profile report:"
-            # Print the latest generated profile report
-            PROFILE_REPORT=$(find build/reports/profile -maxdepth 1 -type f)
-            cat "$PROFILE_REPORT"
-          fi
+          ./gradlew --profile assembleRelease \
+            -Pandroid.injected.signing.store.file="./upload-key.keystore" \
+            -Pandroid.injected.signing.store.password=${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEYSTORE_PASSWORD }} \
+            -Pandroid.injected.signing.key.alias=${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEYSTORE_ALIAS }} \
+            -Pandroid.injected.signing.key.password=${{ steps.load-credentials.outputs.ANDROID_UPLOAD_KEY_PASSWORD }}
+          
+          echo "Printing Gradle profile report:"
+          # Print the latest generated profile report
+          PROFILE_REPORT=$(find build/reports/profile -maxdepth 1 -type f)
+          cat "$PROFILE_REPORT"
 
   buildStandaloneAndroid:
     name: Build Standalone Android
-    runs-on: macos-15-xlarge
+    runs-on: ubuntu-latest-xl
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -62,16 +104,19 @@ jobs:
         with:
           IS_HYBRID_BUILD: 'false'
 
+      - name: Decrypt keystore to sign the APK/AAB
+        run: gpg --batch --yes --decrypt --passphrase="${{ secrets.LARGE_SECRET_PASSPHRASE }}" --output my-upload-key.keystore my-upload-key.keystore.gpg
+        working-directory: android/app
+
       - name: Build Android Release
         working-directory: android
+        env:
+          MYAPP_UPLOAD_STORE_PASSWORD: ${{ secrets.MYAPP_UPLOAD_STORE_PASSWORD }}
+          MYAPP_UPLOAD_KEY_PASSWORD: ${{ secrets.MYAPP_UPLOAD_KEY_PASSWORD }}
         run: |
-          if ! ./gradlew --profile assembleProductionRelease
-          then
-            echo "❌ Android Standalone failed to build: Please reach out to Contributor+ and/or Expensify engineers for help in #expensify-open-source to resolve."
-            exit 1
-          else
-            echo "✅ Build succeeded. Printing Gradle profile report:"
-            # Print the latest generated profile report
-            PROFILE_REPORT=$(find build/reports/profile -maxdepth 1 -type f)
-            cat "$PROFILE_REPORT"
-          fi
+          ./gradlew --profile assembleProductionRelease
+
+          echo "Printing Gradle profile report:"
+          # Print the latest generated profile report
+          PROFILE_REPORT=$(find build/reports/profile -maxdepth 1 -type f)
+          cat "$PROFILE_REPORT"