ci: automate release artifacts and store uploads after release PR merge
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 10/100
调研方向
Start with pubspec.yaml, CHANGELOG.md, docs/AUDIT.md and android/app/build.gradle.kts, which define the version, release notes, audit entry and Android signing. Then read the existing CI workflows that run the tests and builds checks. Done means a merged release PR validates its metadata and publishes the Windows ZIP, Android AAB and iOS IPA with protected secrets, while ordinary merges touch no release secrets. Credential setup, rotation and rerun steps belong in docs/RELEASING.md.
由索引模型根据 Issue 内容生成。
描述
Goal
After a release PR merges into main, build distributable UNIUN artifacts, attach the Windows ZIP to a versioned GitHub Release, upload Android to Google Play, and upload iOS to TestFlight. The maintainer will review and submit the store updates for public release.
Release PR contract
- A release PR updates
pubspec.yaml(MAJOR.MINOR.PATCH+build), adds user-facing notes toCHANGELOG.md, and adds the release audit entry todocs/AUDIT.mdwithout deleting earlier audit history. - Validate that the version is new, the build number exceeds the last store upload, and the changelog/audit entries match the version. Fail before any upload if validation fails.
- Trigger publishing only for a merged release PR, not for ordinary merges, PR builds, or nightly builds. Require the
testsandbuildschecks to pass before publishing.
Artifacts and uploads
- Windows: build in Release mode on Windows, ZIP the complete runnable output directory, create tag
v<version>, and attach the ZIP and checksums to a GitHub Release. - Android: build a Release AAB signed with the existing production upload key, then upload it to a configured Google Play track for maintainer review. Do not use the disposable key from PR build CI.
- iOS: build and sign a Release IPA on macOS for both
in.uniun.appandin.uniun.app.ShareExtension, then upload it to App Store Connect/TestFlight. The maintainer handles App Store submission after processing and review. - Fetch the real Git LFS model asset for distributable builds; the pointer-only checkout used by PR build CI must not be shipped.
- Keep version, tag, release notes, and all three artifacts tied to the same merged commit. Make failed or partial uploads visible and safe to retry without silently incrementing or reusing a store build number.
Credentials and gates
- Store the Android upload keystore/passwords, Google Play service account access, Apple Distribution certificate/profiles, and App Store Connect API key in protected GitHub environment secrets. Never write them to the repo or expose them in logs or PR jobs.
- Limit Play permissions to the selected track. Confirm the target track before enabling upload; keep production rollout/manual submission with the maintainer.
- Document credential setup, rotation, a manual rerun path, and what to do after a partial release in
docs/RELEASING.md.
Google Play credentials
| Needed | How to get it |
|---|---|
Existing Android upload keystore (.jks), alias, store password, and key password |
Use the upload key for the current Play listing; android/app/build.gradle.kts reads it through the gitignored android/key.properties. See docs/RELEASING.md. |
| Google Play service account JSON key | In Google Cloud, enable the Google Play Developer API and create a service account. Invite its email in Play Console → Users and permissions with access to UNIUN, then create its JSON key for CI. Google setup guide. |
| Track permission | Grant Release apps to testing tracks for a test track. Grant Release to production only if automated production submission is later chosen. Play permissions. |
App Store / TestFlight credentials
| Needed | How to get it |
|---|---|
App Store Connect API key (.p8), Key ID, and Issuer ID |
App Store Connect → Users and Access → Integrations → App Store Connect API → Team Keys → Generate. Use an App Manager role for managing the build. Download the .p8 once and store it securely. Apple API key guide. |
Apple Distribution signing identity (.p12) and its password |
Export the existing distribution certificate with its private key from the Mac that holds it. Apple signing guidance. |
| Two App Store Connect provisioning profiles | Create one for in.uniun.app and one for in.uniun.app.ShareExtension, matching the distribution certificate and configured capabilities. Download them from Apple Developer → Certificates, Identifiers & Profiles → Profiles. Apple profile guide. |
Acceptance criteria
- A non-release merge never accesses release secrets or uploads anything.
- A release PR with failing checks or invalid version metadata cannot upload.
- One merged release PR produces a working Windows ZIP/GitHub Release, a Play Console AAB ready for review, and an iOS build visible in TestFlight.
- The maintainer can submit the store releases manually after checking the uploaded builds.
- 主要语言
- Dart
- 星标
- 2
- 派生
- 2
- 平均合并
- 18 小时 53 分钟
- 30 天内合并 PR
- 35
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
basictech01/uniun 的其他 Issue
-
bug good first issue
难度 2/5 1-3 小时 新手友好度 82/100
basictech01/uniun#300 ·
维护者通常 1 天内回复
-
bug good first issue
难度 3/5 1-2 天 新手友好度 52/100
basictech01/uniun#301 ·
维护者通常 1 天内回复
-
enhancement good first issue P2-Medium
难度 5/5 一周以上 新手友好度 25/100
basictech01/uniun#296 ·
维护者通常 1 天内回复
-
bug good first issue P2-Medium
难度 4/5 1-2 天 新手友好度 22/100
basictech01/uniun#293 ·
维护者通常 1 天内回复
-
bug P1-High
难度 4/5 3-5 天 新手友好度 18/100
basictech01/uniun#286 · 2 条评论 ·
维护者通常 1 天内回复
查看 basictech01/uniun 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 85/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 74/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 67/100
PhoebeSoftware/xrooster#41 ·
-
难度 2/5 1-3 小时 新手友好度 83/100
google/skills_lint.dart#118 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 83/100
VeryGoodOpenSource/very_good_templates#665 ·
维护者通常 1 天内回复