GHA build to replace (unused) CircleCI

GHA to build debug APK on branches/main and upload signed artifacts to a
release when creating a release in GHA.  Version number management
remains manual.

The release upload can't really be tested without running a release so
we'll tag a v3.0.8 after merging this to check all's well.

Author: microbit-matt-hillsdon

.circleci/config.yml

@@ -0,0 +1,53 @@
+name: build
+on:
+  release:
+    types: [created]
+  push:
+    branches:
+      - "**"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'release'
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - run: echo "JAVA_HOME=$JAVA_HOME_17_X64" >> $GITHUB_ENV
+      - run: ./gradlew --no-daemon :app:assembleDebug
+      - uses: actions/upload-artifact@v4
+        with:
+          name: build
+          path: ./app/build/outputs/apk/debug/*.apk
+          retention-days: 3
+  release:
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+      - run: echo "JAVA_HOME=$JAVA_HOME_17_X64" >> $GITHUB_ENV
+      - run: echo "SIGNING_STORE_FILE=$RUNNER_TEMP/keystore.jks" >> $GITHUB_ENV
+      - run: printenv SIGNING_STORE_FILE_BASE64 | base64 -d > "$SIGNING_STORE_FILE"
+        env:
+          SIGNING_STORE_FILE_BASE64: ${{ secrets.ANDROID_SIGNING_STORE_FILE_BASE64 }}
+      - run: ./gradlew --no-daemon :app:assembleRelease :app:bundleRelease
+        env:
+          SIGNING_KEY_PASSWORD: ${{ secrets.ANDROID_SIGNING_PASSWORD }}
+          SIGNING_STORE_PASSWORD: ${{ secrets.ANDROID_SIGNING_PASSWORD }}
+          SIGNING_KEY_ALIAS: upload
+      - run: rm "$SIGNING_STORE_FILE"
+      - uses: microbit-foundation/[email protected]
+        with:
+          file: app/build/outputs/apk/bundle/app-bundle.aab
+          asset_name: microbit-bundle-${{ env.TAG }}.aab
+      - uses: microbit-foundation/[email protected]
+        with:
+          file: app/build/outputs/apk/release/app-release.apk
+          asset_name: microbit-release-${{ env.TAG }}.apk

.github/workflows/build.yml

@@ -9,10 +9,19 @@ android {
         // When target SDK version is 30+,
         // requestLegacyExternalStorage will continue to work for 29 Android 10
     }
+    signingConfigs {
+        release {
+            keyAlias=System.getenv('SIGNING_KEY_ALIAS')
+            keyPassword=System.getenv('SIGNING_KEY_PASSWORD')
+            storeFile=System.getenv('SIGNING_STORE_FILE') ? file(System.getenv('SIGNING_STORE_FILE')) : null
+            storePassword=System.getenv('SIGNING_STORE_PASSWORD')
+        }
+    }
     buildTypes {
         release {
             minifyEnabled false
             proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
+            signingConfig signingConfigs.release
         }
     }
     productFlavors {