CI: android: Sign and publish apk

.ci/android/upload.sh

@@ -11,3 +11,13 @@ cp src/android/app/build/outputs/apk/${BUILD_FLAVOR}/release/app-${BUILD_FLAVOR}
   "artifacts/${REV_NAME}.apk"
 cp src/android/app/build/outputs/bundle/${BUILD_FLAVOR}Release/app-${BUILD_FLAVOR}-release.aab \
   "artifacts/${REV_NAME}.aab"
+
+if [ ! -z "${ANDROID_KEYSTORE_B64}" ]
+then
+  echo "Signing apk..."
+  base64 --decode <<< "${ANDROID_KEYSTORE_B64}" > ks.jks
+
+  java -jar $(which apksigner) sign --ks ks.jks \
+    --ks-key-alias "${ANDROID_KEY_ALIAS}" \
+    --ks-pass env:ANDROID_KEYSTORE_PASS "artifacts/${REV_NAME}.apk"
+fi

.github/workflows/ci.yml

@@ -129,10 +129,14 @@ jobs:
       - name: Deps
         run: |
           sudo apt-get update
-          sudo apt-get install ccache -y
+          sudo apt-get install ccache apksigner -y
       - name: Build
         run: ./.ci/android/build.sh
-      - name: Copy artifacts
+      - name: Copy and sign artifacts
+        env:
+          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEYSTORE_PASS: ${{ secrets.ANDROID_KEYSTORE_PASS }}
         run: ./.ci/android/upload.sh
       - name: Upload
         uses: actions/upload-artifact@v3
@@ -153,7 +157,7 @@ jobs:
           TRANSIFEX_API_TOKEN: ${{ secrets.TRANSIFEX_API_TOKEN }}
   release:
     runs-on: ubuntu-latest
-    needs: [build, macos]
+    needs: [build, macos, android]
     if: ${{ startsWith(github.ref, 'refs/tags/') }}
     steps:
       - uses: actions/download-artifact@v3
@@ -174,4 +178,4 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          asset_paths: '["./**/*.tar.*","./**/*.7z","./**/*.zip"]'
+          asset_paths: '["./**/*.tar.*","./**/*.7z","./**/*.zip","./**/*.apk","./**/*.aab"]'