Jenkins CI

Jenkinsfile

@@ -0,0 +1,113 @@
+pipeline {
+    agent { label 'linux' }
+
+    options {
+        buildDiscarder(logRotator(artifactDaysToKeepStr: '30', artifactNumToKeepStr: '10'))
+    }
+
+    stages {
+        stage('Android build APK') {
+            when {
+                branch 'main'; 
+            }
+
+            environment {
+                PSIPHON_CONFIG = 'op://Jenkins/Conduit Psiphon Config/android_psiphon_config'
+                EMBEDDED_SERVER_ENTRIES = 'op://Jenkins/Conduit Psiphon Config/android_embedded_server_entries'
+                ANDROID_UPLOAD_KEYSTORE = 'op://Jenkins/Conduit Upload Signing Key/upload-keystore.jks.base64'
+                ANDROID_UPLOAD_KEYSTORE_PROPERTIES = 'op://Jenkins/Conduit Upload Signing Key/keystore.properties'
+            }
+
+            steps {
+
+                sh 'npm ci'
+
+                writeFile file: 'src/git-hash.js', text: "export const GIT_HASH = '${env.GIT_COMMIT}';"
+
+                dir('android') {
+                    withSecrets() {
+                        writeFile file: 'app/src/main/res/raw/psiphon_config', text: env.PSIPHON_CONFIG
+                        writeFile file: 'app/src/main/res/raw/embedded_server_entries', text: env.EMBEDDED_SERVER_ENTRIES
+                        writeFile file: 'app/upload-keystore.jks', text: env.ANDROID_UPLOAD_KEYSTORE, encoding: "Base64"
+                        writeFile file: 'keystore.properties', text: env.ANDROID_UPLOAD_KEYSTORE_PROPERTIES
+                    }
+
+                    sh './gradlew clean assembleRelease'
+
+                    sh "mv app/build/outputs/apk/release/app-release.apk app/build/outputs/apk/release/conduit-${env.GIT_COMMIT}.apk"
+                }
+
+                archiveArtifacts artifacts: 'android/app/build/outputs/apk/release/*.apk', fingerprint: true, onlyIfSuccessful: true
+
+            }
+        }
+
+        stage('Android bundle release') {
+            when {
+                tag "release-*";
+            }
+
+            environment {
+                PSIPHON_CONFIG = 'op://Jenkins/Conduit Psiphon Config/android_psiphon_config'
+                EMBEDDED_SERVER_ENTRIES = 'op://Jenkins/Conduit Psiphon Config/android_embedded_server_entries'
+                ANDROID_UPLOAD_KEYSTORE = 'op://Jenkins/Conduit Upload Signing Key/upload-keystore.jks.base64'
+                ANDROID_UPLOAD_KEYSTORE_PROPERTIES = 'op://Jenkins/Conduit Upload Signing Key/keystore.properties'
+            }
+
+            steps {
+
+                sh 'npm ci'
+
+                writeFile file: 'src/git-hash.js', text: "export const GIT_HASH = '${TAG_NAME}';"
+
+                dir('android') {
+
+                    withSecrets() {
+                        writeFile file: 'app/src/main/res/raw/psiphon_config', text: env.PSIPHON_CONFIG
+                        writeFile file: 'app/src/main/res/raw/embedded_server_entries', text: env.EMBEDDED_SERVER_ENTRIES
+                        writeFile file: 'app/upload-keystore.jks', text: env.ANDROID_UPLOAD_KEYSTORE, encoding: "Base64"
+                        writeFile file: 'keystore.properties', text: env.ANDROID_UPLOAD_KEYSTORE_PROPERTIES
+                    }
+
+                    sh './gradlew clean bundleRelease'
+
+                    sh "mv app/build/outputs/bundle/release/app-release.aab app/build/outputs/bundle/release/conduit-${TAG_NAME}.aab"
+                }
+
+                archiveArtifacts artifacts: 'android/app/build/outputs/bundle/release/*.aab', fingerprint: true, onlyIfSuccessful: true
+
+            }
+        }
+    }
+
+    post {
+        always {
+            dir('client') {
+                // This is very large, save space on jenkins
+                sh 'rm -rf node_modules'
+            }
+        }
+        failure {
+            script {
+                changes = getChangeList()
+            }
+            slackSend message:"${env.JOB_NAME} - Build #${env.BUILD_NUMBER} failed (<${env.BUILD_URL}|Open>)\nChanges:\n${changes}",
+                      color: "danger"
+        }
+    }
+}
+
+String getChangeList() {
+    if (currentBuild.changeSets.size() == 0) {
+        return "No changes"
+    }
+
+    def changeList = ""
+    for (changeSet in currentBuild.changeSets) {
+        for (entry in changeSet.items) {
+            changeList += "- ${entry.msg} [${entry.authorName}]\n"
+        }
+    }
+
+    return changeList
+}

android/app/build.gradle

@@ -103,6 +103,11 @@ def enableProguardInReleaseBuilds = (findProperty('android.enableProguardInRelea
  */
 def jscFlavor = 'org.webkit:android-jsc:+'
 
+
+def keystorePropertiesFile = rootProject.file("keystore.properties")
+def keystoreProperties = new Properties()
+keystoreProperties.load(new FileInputStream(keystorePropertiesFile))
+
 android {
     ndkVersion rootProject.ext.ndkVersion
 
@@ -114,29 +119,30 @@ android {
         applicationId 'ca.psiphon.conduit'
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 1
-        versionName "1.0.0"
+        versionCode 3
+        versionName "1.0.0-RC.3"
     }
     signingConfigs {
-        debug {
-            storeFile file('debug.keystore')
-            storePassword 'android'
-            keyAlias 'androiddebugkey'
-            keyPassword 'android'
+        config {
+            keyAlias keystoreProperties['keyAlias']
+            keyPassword keystoreProperties['keyPassword']
+            storeFile file(keystoreProperties['storeFile'])
+            storePassword keystoreProperties['storePassword']
         }
     }
     buildTypes {
         debug {
-            signingConfig signingConfigs.debug
+            signingConfig signingConfigs.config
+            shrinkResources false
+            minifyEnabled false
+            crunchPngs false
         }
         release {
-            // Caution! In production, you need to generate your own keystore file.
-            // see https://reactnative.dev/docs/signed-apk-android.
-            signingConfig signingConfigs.debug
-            shrinkResources (findProperty('android.enableShrinkResourcesInReleaseBuilds')?.toBoolean() ?: false)
+            signingConfig signingConfigs.config
+            shrinkResources enableProguardInReleaseBuilds
             minifyEnabled enableProguardInReleaseBuilds
             proguardFiles getDefaultProguardFile("proguard-android.txt"), "proguard-rules.pro"
-            crunchPngs (findProperty('android.enablePngCrunchInReleaseBuilds')?.toBoolean() ?: true)
+            crunchPngs true
         }
     }
     packagingOptions {

android/app/proguard-rules.pro

@@ -11,4 +11,5 @@
 -keep class com.swmansion.reanimated.** { *; }
 -keep class com.facebook.react.turbomodule.** { *; }
 
-# Add any project specific keep options here:
+# react-native-skia
+-keep public class com.shopify.reactnative.skia.* {*;}

android/gradle.properties

@@ -28,6 +28,9 @@ android.enableJetifier=true
 # Enable AAPT2 PNG crunching
 android.enablePngCrunchInReleaseBuilds=true
 
+# Enable Proguard for release builds
+android.enableProguardInReleaseBuilds=true
+
 # Use this property to specify which architecture you want to build.
 # You can also override it from the CLI using
 # ./gradlew <task> -PreactNativeArchitectures=x86_64

android/keystore.properties

@@ -0,0 +1,5 @@
+# CI will overwrite this file with the upload keystore
+storeFile=debug.keystore
+storePassword=android
+keyAlias=androiddebugkey
+keyPassword=android