ci: Sign releases

Author: abdusco

.github/workflows/build-release.yml

@@ -46,15 +46,24 @@ jobs:
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew
 
+      - name: Decode and setup keystore
+        run: |
+          echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > keystore.jks
+
       - name: Build Release APK
+        env:
+          KEYSTORE_FILE: ${{ github.workspace }}/keystore.jks
+          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
         run: |
           ./gradlew immich:assembleRelease \
             -Pversion.name=${{ steps.version.outputs.version_name }} \
             -Pversion.code=${{ steps.version.outputs.version_code }}
 
       - name: Rename APK
         run: |
-          mv immich/build/outputs/apk/release/immich-release-unsigned.apk \
+          mv immich/build/outputs/apk/release/immich-release.apk \
              immich/build/outputs/apk/release/immich-${{ steps.version.outputs.version_name }}.apk
 
       - name: Upload Release APK

immich/build.gradle

@@ -28,6 +28,21 @@ android {
         buildConfigField 'String', 'IMMICH_AUTHORITY', '"' + authorityValue + '"'
     }
 
+    signingConfigs {
+        release {
+            storeFile file(System.getenv("KEYSTORE_FILE") ?: project.findProperty("KEYSTORE_FILE") ?: "")
+            storePassword System.getenv("KEYSTORE_PASSWORD") ?: project.findProperty("KEYSTORE_PASSWORD")
+            keyAlias System.getenv("KEY_ALIAS") ?: project.findProperty("KEY_ALIAS")
+            keyPassword System.getenv("KEY_PASSWORD") ?: project.findProperty("KEY_PASSWORD")
+        }
+    }
+
+    buildTypes {
+        release {
+            minifyEnabled false
+            signingConfig signingConfigs.release
+        }
+    }
 
     composeOptions {
         kotlinCompilerExtensionVersion libs.versions.compose.get()