From 01c0d170c46c6c2284dd1d84b80fb58bbcb46531 Mon Sep 17 00:00:00 2001
From: Jonas Kalderstam <jonas@cowboyprogrammer.org>
Date: Tue, 11 Feb 2025 21:20:14 +0100
Subject: [PATCH] chore: sign APKs only if not a PR from a fork

Signed-off-by: Jonas Kalderstam <jonas@cowboyprogrammer.org>
---
 .editorconfig                  |  4 ++++
 .github/workflows/ci_build.yml | 32 ++++++++++++++++++++++++++------
 2 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/.editorconfig b/.editorconfig
index a0bb8f1a96..699a0f49b5 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -4,6 +4,7 @@ end_of_line = lf
 indent_size = 4
 indent_style = space
 insert_final_newline = true
+trim_trailing_whitespace = true
 tab_width = 4
 ij_continuation_indent_size = 8
 ij_formatter_off_tag = @formatter:off
@@ -13,6 +14,9 @@ ij_smart_tabs = false
 ij_visual_guides = none
 ij_wrap_on_typing = false
 
+[*.{yml,yaml}]
+indent_size = 2
+
 [*.{kt,kts}]
 max_line_length = 200
 ktlint_code_style = ktlint_official
diff --git a/.github/workflows/ci_build.yml b/.github/workflows/ci_build.yml
index b3d65f36ec..2e0a3b0bcf 100644
--- a/.github/workflows/ci_build.yml
+++ b/.github/workflows/ci_build.yml
@@ -33,7 +33,7 @@ jobs:
       uses: gradle/actions/setup-gradle@v4
       with:
         cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-      
+
     - name: ktlint check
       run: ./gradlew ktlintCheck
 
@@ -65,7 +65,7 @@ jobs:
 
     - name: compile
       run: ./gradlew compileFdroidDebugKotlin
-    
+
     - name: lint
       run: ./gradlew lintFdroidDebug
 
@@ -138,6 +138,18 @@ jobs:
         fetch-depth: 0
         fetch-tags: true
 
+    - name: prepare for build
+      # Do not run for forks
+      if: github.repository == 'spacecowboy/feeder'
+      shell: bash
+      run: ./prepare_for_build.sh
+      env:
+        SERVICEACCOUNTJSON: ${{ secrets.SERVICEACCOUNTJSON }}
+        KEYSTOREPASSWORD: ${{ secrets.KEYSTOREPASSWORD }}
+        KEYSTORE: ${{ secrets.KEYSTORE }}
+        KEYPASSWORD: ${{ secrets.KEYPASSWORD }}
+        KEYALIAS: ${{ secrets.KEYALIAS }}
+
     - name: setup JDK
       uses: actions/setup-java@v4
       with:
@@ -173,6 +185,8 @@ jobs:
         fetch-tags: true
 
     - name: prepare for build
+      # Do not run for forks
+      if: github.repository == 'spacecowboy/feeder'
       shell: bash
       run: ./prepare_for_build.sh
       env:
@@ -195,7 +209,7 @@ jobs:
 
     - name: release apk
       run: ./gradlew assemblePlayRelease
-    
+
     - name: save play apk
       uses: actions/upload-artifact@v4
       with:
@@ -228,6 +242,8 @@ jobs:
         cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
 
     - name: prepare for build
+      # Do not run for forks
+      if: github.repository == 'spacecowboy/feeder'
       shell: bash
       run: ./prepare_for_build.sh
       env:
@@ -264,6 +280,8 @@ jobs:
         fetch-tags: true
 
     - name: prepare for build
+      # Do not run for forks
+      if: github.repository == 'spacecowboy/feeder'
       shell: bash
       run: ./prepare_for_build.sh
       env:
@@ -280,6 +298,8 @@ jobs:
         path: app/build/outputs/
 
     - name: validate deploy
+      # Do not run for forks
+      if: github.repository == 'spacecowboy/feeder'
       run: ./deploy_playstore_fast.sh --dry-run
 
   deploy:
@@ -312,7 +332,7 @@ jobs:
       with:
         name: bundle
         path: app/build/outputs/
-    
+
     - name: deploy beta
       if: github.event_name == 'push' && github.ref == 'refs/heads/master'
       # do not want this to run on master commit which is also a tag
@@ -339,12 +359,12 @@ jobs:
 
       - name: get latest changelog entry
         run: mkdir -p build && ci/latest-changelog.py CHANGELOG.md > build/release_notes.md
-    
+
       - name: copy fdroid apk
         uses: actions/download-artifact@v4
         with:
           name: fdroid-apk
-        
+
       - name: copy play apk
         uses: actions/download-artifact@v4
         with: