Publish Compose sample APK as a stable GitHub release asset#6565
Open
aleksandar-apostolov wants to merge 4 commits into
Open
Publish Compose sample APK as a stable GitHub release asset#6565aleksandar-apostolov wants to merge 4 commits into
aleksandar-apostolov wants to merge 4 commits into
Conversation
Publish the compose demo APK as a release asset under a constant filename so the website can link a stable latest/download URL. Triggered by the release published event emitted by the build-conventions release workflow.
Contributor
PR checklist ✅All required conditions are satisfied:
🎉 Great job! This PR is ready for review. |
Contributor
SDK Size Comparison 📏
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
WalkthroughAdds a GitHub Actions workflow that triggers when a release is published, builds the signed Compose demo APK from the release tag, and uploads it to that release. ChangesRelease APK publishing
Estimated code review effort: 1 (Trivial) | ~5 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/attach-release-apk.yml:
- Around line 19-21: Update the actions/checkout step in the release APK
workflow to set persist-credentials: false, preventing the checkout token from
being written to .git/config before executing release-tag build logic. Set
fetch-depth: 0 as well if the Gradle build requires full repository history.
- Around line 36-38: Update the release upload step containing gh release upload
to pass github.event.release.tag_name through an environment variable, then
reference that variable in the shell command instead of interpolating the GitHub
expression directly; preserve the existing APK path and --clobber option.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 281ff857-b8bf-49e1-b3f1-6b6b761eafef
📒 Files selected for processing (1)
.github/workflows/attach-release-apk.yml
Avoids expanding secrets directly in the run block (SonarCloud findings); pass them as step env vars referenced as shell variables.
Set persist-credentials: false so the checkout token is not written to .git/config while building from the release tag, and fetch full history via fetch-depth: 0 instead of an authenticated post-checkout fetch. Pass the release tag through an env var to avoid shell injection from attacker-controllable tag names.
|
gpunto
approved these changes
Jul 10, 2026
| name: Build and attach Compose sample APK | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v6 |
Contributor
There was a problem hiding this comment.
nit: we can use v7, otherwise dependabot will try to bump it later
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Goal
Closes AND-1307 — the website needs a permanent download link that always points to the newest Chat Compose sample APK. GitHub's
releases/latest/download/<file>permalink delivers that, but only if every release carries an asset under a constant filename.Implementation
attach-release-apk.yml, triggered byrelease: published— the event the build-conventions release workflow already emits (it publishes via a bot PAT, so the event fires). No change to the shared build-conventions repo.app-distribute.yml), builds:stream-chat-android-compose-sample:assembleDemoRelease.gh release upload --clobber, renaming the asset tostream-chat-android-sample.apkso the download URL stays constant across releases.https://github.com/GetStream/stream-chat-android/releases/latest/download/stream-chat-android-sample.apk. Prerelease/suffix builds correctly don't movelatest.Testing
Not fully verifiable here — the
release: publishedtrigger and asset path can only be confirmed on the first real published release after merge. Build/sign steps are copied verbatim from the workingapp-distribute.ymlcompose job, and theassembleDemoReleasetask +apk/demo/release/...-demo-release.apkoutput path were confirmed against the module'sdemo/e2eproduct flavors.Summary by CodeRabbit