refactor(ci): extract release manifest logic into shared script

bmc08gt · bmc08gt · commit 6662645de61d · 2026-04-26T21:42:53.000-04:00
Consolidate Play API track fetching, manifest updates, and conditional
patch bumping into scripts/update-release-manifest.sh. Both bump-patch
and build-fcash2-upload-android workflows now call the same script,
with commits handled by the workflows themselves.

Signed-off-by: Brandon McAnsh &lt;git@bmcreations.dev&gt;
diff --git a/.github/workflows/build-fcash2-upload-android.yml b/.github/workflows/build-fcash2-upload-android.yml
@@ -112,6 +112,19 @@ jobs:
           PLAYSTORE_TRACK: ${{ github.event.inputs.track }}
           RELEASE_STATUS: ${{ github.event.inputs.release_status }}
 
+      - name: Update release manifest
+        id: manifest
+        env:
+          SERVICE_ACCOUNT_KEY_JSON: ${{ steps.service_account_json_file.outputs.filePath }}
+        run: bash scripts/update-release-manifest.sh
+
+      - name: Commit & push manifest
+        uses: actions-js/push@master
+        with:
+          message: "build: update release manifest"
+          branch: "code/cash"
+          github_token: ${{ secrets.BOT_GITHUB_TOKEN }}
+
       - name: Upload build artifacts
         uses: actions/upload-artifact@v4
         if: always()
diff --git a/.github/workflows/bump-patch.yml b/.github/workflows/bump-patch.yml
@@ -15,145 +15,25 @@ jobs:
           fetch-depth: 0
           ref: "code/cash"
 
-      - name: Verify Packaging.kt exists
-        run: |
-          if [ ! -f buildSrc/src/main/java/Packaging.kt ]; then
-            echo "Error: Packaging.kt not found"
-            exit 1
-          fi
-
       - name: Decode Service Account Key JSON file
         uses: timheuer/base64-to-file@v1
         id: service_account_json_file
         with:
           fileName: serviceAccount.json
           encodedString: ${{ secrets.FLIPCASH_SERVICE_ACCOUNT_KEY_JSON }}
 
-      - name: Get Play API access token
-        id: token
-        env:
-          SA_PATH: ${{ steps.service_account_json_file.outputs.filePath }}
-        run: |
-          NOW=$(date +%s); EXP=$((NOW + 3600))
-          CLIENT_EMAIL=$(jq -r .client_email "$SA_PATH")
-          PRIVATE_KEY=$(jq -r .private_key "$SA_PATH")
-
-          HEADER=$(echo -n '{"alg":"RS256","typ":"JWT"}' | base64 -w0 | tr '+/' '-_' | tr -d '=')
-          PAYLOAD=$(jq -nc \
-            --arg iss "$CLIENT_EMAIL" \
-            --arg scope "https://www.googleapis.com/auth/androidpublisher" \
-            --argjson iat $NOW --argjson exp $EXP \
-            '{iss:$iss, scope:$scope, aud:"https://oauth2.googleapis.com/token", iat:$iat, exp:$exp}' \
-            | base64 -w0 | tr '+/' '-_' | tr -d '=')
-
-          SIG=$(printf '%s.%s' "$HEADER" "$PAYLOAD" \
-            | openssl dgst -sha256 -sign <(echo "$PRIVATE_KEY") \
-            | base64 -w0 | tr '+/' '-_' | tr -d '=')
-
-          ACCESS=$(curl -s -X POST https://oauth2.googleapis.com/token \
-            -d "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer" \
-            -d "assertion=$HEADER.$PAYLOAD.$SIG" | jq -r .access_token)
-
-          if [ -z "$ACCESS" ] || [ "$ACCESS" = "null" ]; then
-            echo "Error: Failed to mint Play API access token"
-            exit 1
-          fi
-
-          echo "::add-mask::$ACCESS"
-          echo "access_token=$ACCESS" >> "$GITHUB_OUTPUT"
-
-      - name: Fetch tracks and update manifest
+      - name: Update release manifest
         id: manifest
         env:
-          ACCESS: ${{ steps.token.outputs.access_token }}
-          PKG: com.flipcash.app.android
-          MANIFEST_PATH: .well-known/release-manifest.json
-        run: |
-          AUTH="Authorization: Bearer $ACCESS"
-          BASE="https://androidpublisher.googleapis.com/androidpublisher/v3/applications/$PKG"
-          EDIT_ID=$(curl -s -X POST "$BASE/edits" -H "$AUTH" | jq -r .id)
-
-          if [ -z "$EDIT_ID" ] || [ "$EDIT_ID" = "null" ]; then
-            echo "Error: Failed to create Play API edit"
-            exit 1
-          fi
-
-          fetch_track() {
-            curl -s "$BASE/edits/$EDIT_ID/tracks/$1" -H "$AUTH" \
-              | jq -c '[.releases[]? | select(.status == "completed") | .versionCodes[]?] | map(tonumber) | max // null'
-          }
-
-          PROD=$(fetch_track production)
-          BETA=$(fetch_track beta)
-          ALPHA=$(fetch_track alpha)
-          INTERNAL=$(fetch_track internal)
-
-          curl -s -X DELETE "$BASE/edits/$EDIT_ID" -H "$AUTH" || true
-
-          OLD_PROD=$(jq -r '.tracks.production // empty' "$MANIFEST_PATH" 2>/dev/null || echo "")
-
-          mkdir -p "$(dirname "$MANIFEST_PATH")"
-          jq -n \
-            --argjson production "$PROD" \
-            --argjson beta "$BETA" \
-            --argjson alpha "$ALPHA" \
-            --argjson internal "$INTERNAL" \
-            --arg updated "$(date -u +%FT%TZ)" \
-            '{updated: $updated, tracks: {production:$production, beta:$beta, alpha:$alpha, internal:$internal}}' \
-            > "$MANIFEST_PATH"
-
-          echo "old_prod=$OLD_PROD" >> "$GITHUB_OUTPUT"
-          echo "new_prod=$PROD" >> "$GITHUB_OUTPUT"
-          cat "$MANIFEST_PATH"
-
-      - name: Determine if production changed
-        id: check
-        run: |
-          if [ "${{ steps.manifest.outputs.old_prod }}" = "${{ steps.manifest.outputs.new_prod }}" ]; then
-            echo "Production unchanged (${{ steps.manifest.outputs.new_prod }}) — manifest refreshed, skipping patch bump"
-            echo "prod_changed=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "prod_changed=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Read current patch version and increment
-        if: steps.check.outputs.prod_changed == 'true'
-        id: version
-        run: |
-          CURRENT=$(sed -n '/object Flipcash : Packaging(/,/)/ s/.*patchVersion = \([0-9][0-9]*\).*/\1/p' buildSrc/src/main/java/Packaging.kt)
-          MAJOR=$(sed -n '/object Flipcash : Packaging(/,/)/ s/.*majorVersion = \([0-9][0-9]*\).*/\1/p' buildSrc/src/main/java/Packaging.kt)
-          MINOR=$(sed -n '/object Flipcash : Packaging(/,/)/ s/.*minorVersion = \([0-9][0-9]*\).*/\1/p' buildSrc/src/main/java/Packaging.kt)
-
-          if [ -z "$CURRENT" ] || [ -z "$MAJOR" ] || [ -z "$MINOR" ]; then
-            echo "Error: Failed to parse version fields from Packaging.kt"
-            echo "  major=$MAJOR minor=$MINOR patch=$CURRENT"
-            exit 1
-          fi
-
-          NEXT=$((CURRENT + 1))
-          echo "CURRENT=$CURRENT" >> $GITHUB_OUTPUT
-          echo "NEXT=$NEXT" >> $GITHUB_OUTPUT
-          echo "VERSION=$MAJOR.$MINOR.$NEXT" >> $GITHUB_OUTPUT
-
-      - name: Update patchVersion
-        if: steps.check.outputs.prod_changed == 'true'
-        run: |
-          sed -i '/object Flipcash : Packaging(/,/)/ s/patchVersion = [0-9][0-9]*/patchVersion = ${{ steps.version.outputs.NEXT }}/' buildSrc/src/main/java/Packaging.kt
-
-      - name: Validate updated field
-        if: steps.check.outputs.prod_changed == 'true'
-        run: |
-          if ! grep -A 10 'object Flipcash : Packaging(' buildSrc/src/main/java/Packaging.kt | grep -q "patchVersion = ${{ steps.version.outputs.NEXT }}"; then
-            echo "Error: Failed to update patchVersion to ${{ steps.version.outputs.NEXT }}"
-            exit 1
-          fi
+          SERVICE_ACCOUNT_KEY_JSON: ${{ steps.service_account_json_file.outputs.filePath }}
+        run: bash scripts/update-release-manifest.sh
 
       - name: Commit & Push changes
         uses: actions-js/push@master
         with:
           message: >-
-            ${{ steps.check.outputs.prod_changed == 'true'
-              && format('build: release versionCode {0}, bump Flipcash to {1}', steps.manifest.outputs.new_prod, steps.version.outputs.VERSION)
-              || 'chore: refresh release manifest' }}
+            ${{ steps.manifest.outputs.prod_changed == 'true'
+              && format('build: release versionCode {0}, bump Flipcash to {1}', steps.manifest.outputs.new_prod, steps.manifest.outputs.version)
+              || 'build: refresh release manifest' }}
           branch: "code/cash"
-          github_token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          github_token: ${{ secrets.BOT_GITHUB_TOKEN }}
diff --git a/scripts/update-release-manifest.sh b/scripts/update-release-manifest.sh
@@ -1,10 +1,26 @@
 #!/usr/bin/env bash
-# scripts/dry-run-release.sh
+# scripts/update-release-manifest.sh
+#
+# Fetches current track versionCodes from the Play Developer API,
+# updates .well-known/release-manifest.json in place, and bumps
+# Flipcash.patchVersion in Packaging.kt when production changes.
+#
+# Env:
+#   SERVICE_ACCOUNT_KEY_JSON  — path to the Google service account JSON file
+#   PKG                       — package name (default: com.flipcash.app.android)
+#   MANIFEST_PATH             — manifest location (default: .well-known/release-manifest.json)
+#
+# Outputs (written to $GITHUB_OUTPUT when running in CI):
+#   old_prod / new_prod       — previous and current production versionCode
+#   prod_changed              — "true" | "false"
+#   version                   — new versionName (only when prod_changed=true)
+
 set -euo pipefail
 
-set -a
-source .env.local
-set +a
+# Source .env.local for local development if present
+if [ -f .env.local ]; then
+  set -a; source .env.local; set +a
+fi
 
 : "${SERVICE_ACCOUNT_KEY_JSON:?SERVICE_ACCOUNT_KEY_JSON not set}"
 [ -f "$SERVICE_ACCOUNT_KEY_JSON" ] || { echo "SA file not found at $SERVICE_ACCOUNT_KEY_JSON"; exit 1; }
@@ -13,6 +29,12 @@ SA_PATH="$SERVICE_ACCOUNT_KEY_JSON"
 PKG="${PKG:-com.flipcash.app.android}"
 MANIFEST_PATH="${MANIFEST_PATH:-.well-known/release-manifest.json}"
 
+# --- helper: write to $GITHUB_OUTPUT when in CI, otherwise just print ---
+emit() {
+  echo "$1=$2"
+  [ -n "${GITHUB_OUTPUT:-}" ] && echo "$1=$2" >> "$GITHUB_OUTPUT"
+}
+
 # --- mint access token ---
 NOW=$(date +%s); EXP=$((NOW + 3600))
 CLIENT_EMAIL=$(jq -r .client_email "$SA_PATH")
@@ -33,13 +55,13 @@ ACCESS=$(curl -s -X POST https://oauth2.googleapis.com/token \
   -d "assertion=$HEADER.$PAYLOAD.$SIG" | jq -r .access_token)
 
 [ "$ACCESS" = "null" ] && { echo "Token request failed"; exit 1; }
-echo "✓ Got access token"
+echo "Got access token"
 
 # --- fetch tracks ---
 AUTH="Authorization: Bearer $ACCESS"
 BASE="https://androidpublisher.googleapis.com/androidpublisher/v3/applications/$PKG"
 EDIT_ID=$(curl -s -X POST "$BASE/edits" -H "$AUTH" | jq -r .id)
-echo "✓ Created edit $EDIT_ID"
+echo "Created edit $EDIT_ID"
 
 fetch_track() {
   curl -s "$BASE/edits/$EDIT_ID/tracks/$1" -H "$AUTH" \
@@ -50,48 +72,57 @@ PROD=$(fetch_track production)
 BETA=$(fetch_track beta)
 ALPHA=$(fetch_track alpha)
 INTERNAL=$(fetch_track internal)
-echo "✓ Tracks: prod=$PROD beta=$BETA alpha=$ALPHA internal=$INTERNAL"
+echo "Tracks: prod=$PROD beta=$BETA alpha=$ALPHA internal=$INTERNAL"
 
 curl -s -X DELETE "$BASE/edits/$EDIT_ID" -H "$AUTH" >/dev/null || true
 
-# --- read previous prod from committed manifest (not /tmp) ---
+# --- read previous prod ---
 OLD_PROD=$(jq -r '.tracks.production // empty' "$MANIFEST_PATH" 2>/dev/null || echo "")
-echo "✓ Previous prod: ${OLD_PROD:-<none>} | New prod: $PROD"
+echo "Previous prod: ${OLD_PROD:-<none>} | New prod: $PROD"
 
-# --- write manifest to /tmp (not the real path) ---
-OUT=.well-known/release-manifest.json
+# --- write manifest ---
+mkdir -p "$(dirname "$MANIFEST_PATH")"
 jq -n \
   --argjson production "$PROD" \
   --argjson beta "$BETA" \
   --argjson alpha "$ALPHA" \
   --argjson internal "$INTERNAL" \
   --arg updated "$(date -u +%FT%TZ)" \
   '{updated: $updated, tracks: {production:$production, beta:$beta, alpha:$alpha, internal:$internal}}' \
-  > "$OUT"
+  > "$MANIFEST_PATH"
+
+echo "Manifest written:"
+cat "$MANIFEST_PATH"
 
-echo "✓ Manifest written to $OUT"
-cat "$OUT"
+emit "old_prod" "${OLD_PROD:-null}"
+emit "new_prod" "$PROD"
 
 # --- decide whether prod changed ---
 if [ "$OLD_PROD" = "$PROD" ]; then
-  echo "→ Production unchanged, skipping patch bump"
+  echo "Production unchanged, skipping patch bump"
+  emit "prod_changed" "false"
   exit 0
 fi
 
-echo "→ Production changed ($OLD_PROD → $PROD), prepping development"
+emit "prod_changed" "true"
+echo "Production changed ($OLD_PROD -> $PROD), bumping patch version"
 
-# --- test the sed against a copy of Packaging.kt ---
+# --- bump patch version ---
 KOTLIN_FILE=buildSrc/src/main/java/Packaging.kt
 [ -f "$KOTLIN_FILE" ] || { echo "Skipping patch bump — not in repo root"; exit 0; }
 
-CURRENT=$(sed -n '/object Flipcash : Packaging(/,/)/ s/.*patchVersion = \([0-9][0-9]*\).*/\1/p' $KOTLIN_FILE)
+CURRENT=$(sed -n '/object Flipcash : Packaging(/,/)/ s/.*patchVersion = \([0-9][0-9]*\).*/\1/p' "$KOTLIN_FILE")
+MAJOR=$(sed -n '/object Flipcash : Packaging(/,/)/ s/.*majorVersion = \([0-9][0-9]*\).*/\1/p' "$KOTLIN_FILE")
+MINOR=$(sed -n '/object Flipcash : Packaging(/,/)/ s/.*minorVersion = \([0-9][0-9]*\).*/\1/p' "$KOTLIN_FILE")
+
 [ -z "$CURRENT" ] && { echo "Failed to parse current patchVersion"; exit 1; }
 NEXT=$((CURRENT + 1))
 
 if sed --version >/dev/null 2>&1; then
-  sed -i "/object Flipcash : Packaging(/,/)/ s/patchVersion = [0-9][0-9]*/patchVersion = $NEXT/" $KOTLIN_FILE
+  sed -i "/object Flipcash : Packaging(/,/)/ s/patchVersion = [0-9][0-9]*/patchVersion = $NEXT/" "$KOTLIN_FILE"
 else
-  sed -i '' "/object Flipcash : Packaging(/,/)/ s/patchVersion = [0-9][0-9]*/patchVersion = $NEXT/" $KOTLIN_FILE
+  sed -i '' "/object Flipcash : Packaging(/,/)/ s/patchVersion = [0-9][0-9]*/patchVersion = $NEXT/" "$KOTLIN_FILE"
 fi
 
-echo "✓ Patch bump: $CURRENT → $NEXT"
+emit "version" "$MAJOR.$MINOR.$NEXT"
+echo "Patch bump: $CURRENT -> $NEXT ($MAJOR.$MINOR.$NEXT)"
