Android CI/deploy support: JDK 17 + SDK 35 on runner, keystore secrets layout #9

New Issue

2026-07-29T04:07:23-07:00

westfarn commented

2026-07-29 04:07:23 -07:00

Summary

Self-hosted Gitea runner needs Android build toolchain so chat_web_app can:

Build Android on merge to master (debug APK — verify Capacitor/Gradle still works) — chat_web_app#57
Manual "Deploy Android" button (signed AAB, like Deploy Prod) — chat_web_app#58

Today deploy.sh / app-deploy / web-static are web-only (node-static → nginx). Android does not go through Ansible web deploy. This ticket is runner + secrets + docs only — do not add a new host_apps type or extend deploy.sh for APK/AAB delivery.

Current state

Runner already runs Node 20 + npm ci for chat web workflows
No ANDROID_HOME / SDK Platform 35 / build-tools documented or Ansible-managed
Upload keystore documented in chat_web_app llm-fe/ANDROID.md as e.g. ~/Documents/secrets/aiml-chat-upload.jks — not standardized under secrets/<app>/…
secrets_dir pattern today is Django .env files; no Android layout

Work

1. Runner toolchain (control / Act host)

Ensure the self-hosted runner can build Capacitor Android (AGP 8.7 / compileSdk 35):

JDK 17+ (OpenJDK fine)
Android SDK with Platform 35, build-tools, platform-tools
ANDROID_HOME (and PATH for sdkmanager / platform-tools) available to the Gitea Act runner user
Prefer documented install or a small Ansible/runbook role — whatever matches how other runner deps are managed

Smoke from runner shell:

java -version   # 17+
echo "$ANDROID_HOME"
sdkmanager --list_installed | grep -E 'platforms;android-35|build-tools'

2. Secrets layout (signing — for Deploy Android)

Standardize outside git (never commit):

~/Documents/secrets/chat_web_app/android/
  aiml-chat-upload.jks          # upload keystore
  keystore.properties           # storeFile (absolute), passwords, keyAlias
  # optional later:
  play-service-account.json     # Play Console upload API

Mode 600 / owned by runner user. Document copy/symlink strategy so the workflow can point Gradle at keystore.properties without writing secrets into the checkout permanently.

If the existing ~/Documents/secrets/aiml-chat-upload.jks already exists, migrate or document the canonical path above.

3. Docs

Update IMPLEMENTATION.md (or equivalent): Android builds are workflow-only, not deploy.sh
Note runner JDK/SDK requirements next to other CI prerequisites
Note secrets path for chat Android signing

4. Out of scope

Extending scripts/deploy.sh / roles/app-deploy / web-static / host_apps ports for APK hosting
Play Store listing / privacy policy (app-side / ops out-of-band)
Auto-upload to Play (optional follow-up once service account JSON exists)

Acceptance criteria

Self-hosted runner has JDK 17+ and Android SDK Platform 35 + build-tools; ANDROID_HOME set for Act jobs
Debug Gradle build can succeed when invoked from a chat_web_app workflow (assembleDebug)
Canonical keystore + keystore.properties under ~/Documents/secrets/chat_web_app/android/ (or documented equivalent), readable by runner
IMPLEMENTATION.md documents Android CI vs web deploy.sh
Prod/beta web deploys unchanged

References

chat_web_app Capacitor stack: llm-fe/ANDROID.md, llm-fe/android/README.md
Web deploy pattern: scripts/deploy.sh, deploy-prod.yml / deploy-beta.yml in chat_web_app
App CI: chat_web_app#57
App Deploy Android: chat_web_app#58
Prior beta infra: Enable beta deploys for chat_backend + chat_web_app (#7)

## Summary Self-hosted Gitea runner needs Android build toolchain so `chat_web_app` can: 1. **Build Android on merge to `master`** (debug APK — verify Capacitor/Gradle still works) — [chat_web_app#57](https://git.aimloperations.com/ai_ml_operations/chat_web_app/issues/57) 2. **Manual "Deploy Android" button** (signed AAB, like Deploy Prod) — [chat_web_app#58](https://git.aimloperations.com/ai_ml_operations/chat_web_app/issues/58) Today `deploy.sh` / `app-deploy` / `web-static` are **web-only** (`node-static` → nginx). Android does **not** go through Ansible web deploy. This ticket is **runner + secrets + docs** only — do **not** add a new `host_apps` type or extend `deploy.sh` for APK/AAB delivery. --- ## Current state - Runner already runs Node 20 + `npm ci` for chat web workflows - No `ANDROID_HOME` / SDK Platform 35 / build-tools documented or Ansible-managed - Upload keystore documented in `chat_web_app` `llm-fe/ANDROID.md` as e.g. `~/Documents/secrets/aiml-chat-upload.jks` — not standardized under `secrets/<app>/…` - `secrets_dir` pattern today is Django `.env` files; no Android layout --- ## Work ### 1. Runner toolchain (control / Act host) Ensure the self-hosted runner can build Capacitor Android (AGP 8.7 / compileSdk **35**): - **JDK 17+** (OpenJDK fine) - **Android SDK** with Platform **35**, build-tools, platform-tools - `ANDROID_HOME` (and `PATH` for `sdkmanager` / platform-tools) available to the Gitea Act runner user - Prefer documented install or a small Ansible/runbook role — whatever matches how other runner deps are managed Smoke from runner shell: ```bash java -version # 17+ echo "$ANDROID_HOME" sdkmanager --list_installed | grep -E 'platforms;android-35|build-tools' ``` ### 2. Secrets layout (signing — for Deploy Android) Standardize outside git (never commit): ```text ~/Documents/secrets/chat_web_app/android/ aiml-chat-upload.jks # upload keystore keystore.properties # storeFile (absolute), passwords, keyAlias # optional later: play-service-account.json # Play Console upload API ``` Mode `600` / owned by runner user. Document copy/symlink strategy so the workflow can point Gradle at `keystore.properties` without writing secrets into the checkout permanently. If the existing `~/Documents/secrets/aiml-chat-upload.jks` already exists, migrate or document the canonical path above. ### 3. Docs - Update `IMPLEMENTATION.md` (or equivalent): Android builds are **workflow-only**, not `deploy.sh` - Note runner JDK/SDK requirements next to other CI prerequisites - Note secrets path for chat Android signing ### 4. Out of scope - Extending `scripts/deploy.sh` / `roles/app-deploy` / `web-static` / `host_apps` ports for APK hosting - Play Store listing / privacy policy (app-side / ops out-of-band) - Auto-upload to Play (optional follow-up once service account JSON exists) --- ## Acceptance criteria - [ ] Self-hosted runner has JDK 17+ and Android SDK Platform 35 + build-tools; `ANDROID_HOME` set for Act jobs - [ ] Debug Gradle build can succeed when invoked from a `chat_web_app` workflow (`assembleDebug`) - [ ] Canonical keystore + `keystore.properties` under `~/Documents/secrets/chat_web_app/android/` (or documented equivalent), readable by runner - [ ] `IMPLEMENTATION.md` documents Android CI vs web `deploy.sh` - [ ] Prod/beta **web** deploys unchanged ## References - `chat_web_app` Capacitor stack: `llm-fe/ANDROID.md`, `llm-fe/android/README.md` - Web deploy pattern: `scripts/deploy.sh`, `deploy-prod.yml` / `deploy-beta.yml` in chat_web_app - App CI: chat_web_app#57 - App Deploy Android: chat_web_app#58 - Prior beta infra: #7

westfarn referenced this issue from ai_ml_operations/chat_web_app

2026-07-29 04:09:14 -07:00

CI: build Android (assembleDebug) on merge to master #57

westfarn referenced this issue from ai_ml_operations/chat_web_app

2026-07-29 04:09:29 -07:00

Add Deploy Android workflow_dispatch button (signed AAB) #58

westfarn added a new dependency 2026-07-29 04:15:51 -07:00

ai_ml_operations/chat_web_app#57 - CI: build Android (assembleDebug) on merge to master

Sign in to join this conversation.