Validate Android engine release readiness #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Android engine | |
| # Track 3 (docs/mobile-architecture.md): native de-googled Chromium APK. | |
| # The `validate` job proves the build scaffold is internally consistent. The real | |
| # compile needs 100GB+ free disk and a large/self-hosted Linux runner, so | |
| # it is manual (workflow_dispatch) and opt-in. | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'apps/android-engine/**' | |
| - '.github/workflows/android-engine.yml' | |
| pull_request: | |
| paths: | |
| - 'apps/android-engine/**' | |
| - '.github/workflows/android-engine.yml' | |
| workflow_dispatch: | |
| inputs: | |
| real_build: | |
| description: 'Run the REAL Chromium build (needs a large/self-hosted Linux runner)' | |
| type: boolean | |
| default: false | |
| runner: | |
| description: 'Runner label for the real build' | |
| type: string | |
| default: ubuntu-latest | |
| target_cpu: | |
| description: 'Target CPU' | |
| type: choice | |
| options: [arm64, arm] | |
| default: arm64 | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| working-directory: apps/android-engine/chromium | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version-file: .nvmrc | |
| package-manager-cache: false | |
| - name: Install workspace dependencies | |
| working-directory: . | |
| run: | | |
| corepack enable | |
| pnpm install --frozen-lockfile | |
| - name: Validate scaffold and report release blockers | |
| run: node scripts/preflight.mjs --mode scaffold | |
| - name: Android engine checks | |
| working-directory: . | |
| run: | | |
| pnpm --filter @tronbrowser/android-engine lint | |
| pnpm --filter @tronbrowser/android-engine typecheck | |
| pnpm --filter @tronbrowser/android-engine test | |
| - name: GN arg files present | |
| run: test -f config/gn-args/common.gni && test -f config/gn-args/android.gni | |
| - name: Shell scripts parse (bash -n) | |
| run: | | |
| for s in scripts/*.sh; do bash -n "$s" && echo "ok $s"; done | |
| - name: Scripts dry-run without TB_RUN (guard works) | |
| run: | | |
| for s in fetch sync apply-patches build package tor sign; do | |
| out="$(./scripts/$s.sh)" | |
| echo "$out" | grep -q 'dry-run' || { echo "guard failed: $s did not dry-run"; exit 1; } | |
| echo "guard ok: $s" | |
| done | |
| build-apk: | |
| # Real, heavy build — opt-in via workflow_dispatch with real_build=true. | |
| if: github.event_name == 'workflow_dispatch' && inputs.real_build | |
| runs-on: ${{ inputs.runner }} | |
| timeout-minutes: 720 | |
| env: | |
| TB_WORKDIR: ${{ github.workspace }}/.cache/tronbrowser-android-chromium | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version-file: .nvmrc | |
| package-manager-cache: false | |
| - name: Release preflight | |
| env: { TB_TARGET_CPU: '${{ inputs.target_cpu }}' } | |
| run: node scripts/preflight.mjs --mode release | |
| - name: Toolchain note | |
| run: | | |
| echo "Building native Android Chromium (cpu=${{ inputs.target_cpu }})." | |
| echo "Requires 100GB+ free disk, 16GB+ RAM recommended, and hours. GitHub-hosted runners" | |
| echo "will run out of disk — use a large self-hosted Linux runner." | |
| - name: fetch | |
| env: { TB_RUN: '1', TB_TARGET_CPU: '${{ inputs.target_cpu }}' } | |
| run: ./scripts/fetch.sh | |
| - name: sync | |
| env: { TB_RUN: '1', TB_TARGET_CPU: '${{ inputs.target_cpu }}' } | |
| run: ./scripts/sync.sh | |
| - name: apply-patches | |
| env: { TB_RUN: '1', TB_TARGET_CPU: '${{ inputs.target_cpu }}' } | |
| run: ./scripts/apply-patches.sh | |
| - name: stage Tor assets | |
| env: { TB_RUN: '1', TB_TARGET_CPU: '${{ inputs.target_cpu }}' } | |
| run: ./scripts/tor.sh | |
| - name: build | |
| env: { TB_RUN: '1', TB_TARGET_CPU: '${{ inputs.target_cpu }}' } | |
| run: ./scripts/build.sh | |
| - name: package | |
| env: { TB_RUN: '1', TB_TARGET_CPU: '${{ inputs.target_cpu }}' } | |
| run: ./scripts/package.sh | |
| - name: Prepare release keystore | |
| env: | |
| TB_KEYSTORE_BASE64: '${{ secrets.TRONBROWSER_ANDROID_KEYSTORE_BASE64 }}' | |
| run: | | |
| test -n "$TB_KEYSTORE_BASE64" || { echo "TRONBROWSER_ANDROID_KEYSTORE_BASE64 is required"; exit 1; } | |
| printf '%s' "$TB_KEYSTORE_BASE64" | base64 --decode > "$RUNNER_TEMP/tronbrowser-release.keystore" | |
| chmod 600 "$RUNNER_TEMP/tronbrowser-release.keystore" | |
| echo "TB_KEYSTORE=$RUNNER_TEMP/tronbrowser-release.keystore" >> "$GITHUB_ENV" | |
| - name: sign | |
| env: | |
| TB_RUN: '1' | |
| TB_TARGET_CPU: '${{ inputs.target_cpu }}' | |
| TB_KEYSTORE_PASS: '${{ secrets.TRONBROWSER_ANDROID_KEYSTORE_PASSWORD }}' | |
| TB_KEY_ALIAS: '${{ secrets.TRONBROWSER_ANDROID_KEY_ALIAS }}' | |
| TB_KEY_PASS: '${{ secrets.TRONBROWSER_ANDROID_KEY_PASSWORD }}' | |
| run: ./scripts/sign.sh | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: tronbrowser-android-${{ inputs.target_cpu }} | |
| path: ${{ env.TB_WORKDIR }}/dist/* | |
| if-no-files-found: error |