ci: fix YAML (sort le patch Android dans un script, plus de heredoc)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -24,72 +24,25 @@ jobs:
             -e KSPW="${{ secrets.ANDROID_KEYSTORE_PASSWORD }}" \
             -e ALIAS="${{ secrets.ANDROID_KEY_ALIAS }}" \
             -e BUILD_NAME="${NAME}" -e BUILD_NUMBER="${RUN}" \
-            "${FLUTTER_IMAGE}" bash -euxc '
-              git config --global --add safe.directory /app
-              flutter create --platforms=android --org nfteam --project-name gamemanager .
-              # Permissions Android (internet + auto-install APK)
-              MAN=android/app/src/main/AndroidManifest.xml
-              sed -i "s#<application#<uses-permission android:name=\"android.permission.INTERNET\"/>\n    <uses-permission android:name=\"android.permission.REQUEST_INSTALL_PACKAGES\"/>\n    <application#" "$MAN"
-              # Signature release + schéma de redirection OIDC (patch build.gradle)
-              cat > android/key.properties <<EOF
-storePassword=${KSPW}
-keyPassword=${KSPW}
-keyAlias=${ALIAS}
-storeFile=/app/gamemanager.keystore
-EOF
-              python3 - <<PY
-import re
-p="android/app/build.gradle"; s=open(p).read()
-# charge key.properties en tête
-if "keystoreProperties" not in s:
-    s = ("def keystoreProperties = new Properties()\n"
-         "def keystorePropertiesFile = rootProject.file(\"key.properties\")\n"
-         "if (keystorePropertiesFile.exists()) { keystoreProperties.load(new FileInputStream(keystorePropertiesFile)) }\n\n") + s
-# schéma OIDC pour flutter_appauth
-s = s.replace("defaultConfig {",
-    "defaultConfig {\n        manifestPlaceholders += [appAuthRedirectScheme: \"nfteam.gamemanager\"]", 1)
-# bloc signingConfigs.release
-if "signingConfigs {" not in s:
-    s = re.sub(r"(buildTypes\s*\{)",
-        "signingConfigs {\n        release {\n"
-        "            keyAlias keystoreProperties[\"keyAlias\"]\n"
-        "            keyPassword keystoreProperties[\"keyPassword\"]\n"
-        "            storeFile file(keystoreProperties[\"storeFile\"])\n"
-        "            storePassword keystoreProperties[\"storePassword\"]\n"
-        "        }\n    }\n    \\1", s, count=1)
-# release utilise la clé release
-s = s.replace("signingConfig signingConfigs.debug", "signingConfig signingConfigs.release")
-open(p,"w").write(s)
-print("build.gradle patché")
-PY
-              flutter pub get
-              flutter build apk --release --build-name="${BUILD_NAME}" --build-number="${BUILD_NUMBER}"
-            '
-          cp build/app/outputs/flutter-apk/app-release.apk "gamemanager.apk"
-          cat > version.json <<EOF
-          {"version":"1.0.${RUN}","version_code":${RUN},"notes":"Build CI #${RUN}"}
-          EOF
+            "${FLUTTER_IMAGE}" bash -euxc 'git config --global --add safe.directory /app && flutter create --platforms=android --org nfteam --project-name gamemanager . && python3 tool/patch_android.py && flutter pub get && flutter build apk --release --build-name="${BUILD_NAME}" --build-number="${BUILD_NUMBER}"'
+          cp build/app/outputs/flutter-apk/app-release.apk gamemanager.apk
+          printf '{"version":"1.0.%s","version_code":%s,"notes":"Build CI #%s"}' "${RUN}" "${RUN}" "${RUN}" > version.json
 
       - name: Publish Gitea release
         run: |
           set -e
-          RUN="${{ github.run_number }}"; TAG="v1.0.${RUN}"
+          RUN="${{ github.run_number }}"
+          TAG="v1.0.${RUN}"
           API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
           AUTH="Authorization: token ${{ secrets.GITHUB_TOKEN }}"
-          REL=$(curl -s -X POST "$API/releases" -H "$AUTH" -H 'Content-Type: application/json' \
-            -d "{\"tag_name\":\"${TAG}\",\"name\":\"GameManager ${TAG}\",\"target_commitish\":\"main\"}")
-          ID=$(echo "$REL" | python3 -c "import sys,json;print(json.load(sys.stdin)['id'])")
-          curl -s -X POST "$API/releases/$ID/assets?name=gamemanager.apk" -H "$AUTH" \
-            -F "attachment=@gamemanager.apk;type=application/vnd.android.package-archive" >/dev/null
-          curl -s -X POST "$API/releases/$ID/assets?name=version.json" -H "$AUTH" \
-            -F "attachment=@version.json;type=application/json" >/dev/null
-          echo "Release ${TAG} publiée"
+          REL=$(curl -s -X POST "${API}/releases" -H "${AUTH}" -H 'Content-Type: application/json' -d "{\"tag_name\":\"${TAG}\",\"name\":\"GameManager ${TAG}\",\"target_commitish\":\"main\"}")
+          ID=$(echo "${REL}" | python3 -c "import sys,json;print(json.load(sys.stdin)['id'])")
+          curl -s -X POST "${API}/releases/${ID}/assets?name=gamemanager.apk" -H "${AUTH}" -F "attachment=@gamemanager.apk;type=application/vnd.android.package-archive" >/dev/null
+          curl -s -X POST "${API}/releases/${ID}/assets?name=version.json" -H "${AUTH}" -F "attachment=@version.json;type=application/json" >/dev/null
+          echo "Release ${TAG} publiee"
 
       - name: Notify ntfy
         if: always()
         run: |
           if [ "${{ job.status }}" = "success" ]; then E="white_check_mark"; P="default"; else E="rotating_light"; P="high"; fi
-          curl -s -H "Authorization: Bearer ${{ secrets.NTFY_TOKEN }}" -H "Title: gamemanager APK — ${{ job.status }}" \
-            -H "Priority: ${P}" -H "Tags: ${E}" \
-            -d "Build APK #${{ github.run_number }} : ${{ job.status }}" \
-            "${{ secrets.NTFY_URL }}/${{ secrets.NTFY_TOPIC }}" || true
+          curl -s -H "Authorization: Bearer ${{ secrets.NTFY_TOKEN }}" -H "Title: gamemanager APK - ${{ job.status }}" -H "Priority: ${P}" -H "Tags: ${E}" -d "Build APK #${{ github.run_number }} : ${{ job.status }}" "${{ secrets.NTFY_URL }}/${{ secrets.NTFY_TOPIC }}" || true

tool/patch_android.py

@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+"""Patche le scaffold Android généré par `flutter create` :
+   - permissions (internet + auto-install APK)
+   - signature release depuis key.properties
+   - schéma de redirection OIDC (flutter_appauth)
+Lancé dans la CI après `flutter create`. Idempotent."""
+import os
+import re
+
+KSPW = os.environ["KSPW"]
+ALIAS = os.environ["ALIAS"]
+
+# 1) key.properties
+with open("android/key.properties", "w") as f:
+    f.write(
+        f"storePassword={KSPW}\n"
+        f"keyPassword={KSPW}\n"
+        f"keyAlias={ALIAS}\n"
+        "storeFile=/app/gamemanager.keystore\n"
+    )
+
+# 2) AndroidManifest : permissions
+man = "android/app/src/main/AndroidManifest.xml"
+s = open(man).read()
+perms = (
+    '<uses-permission android:name="android.permission.INTERNET"/>\n'
+    '    <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES"/>\n'
+)
+if "REQUEST_INSTALL_PACKAGES" not in s:
+    s = s.replace("<application", perms + "    <application", 1)
+open(man, "w").write(s)
+
+# 3) build.gradle : signature + schéma OIDC
+gr = "android/app/build.gradle"
+s = open(gr).read()
+if "keystoreProperties" not in s:
+    s = (
+        'def keystoreProperties = new Properties()\n'
+        'def keystorePropertiesFile = rootProject.file("key.properties")\n'
+        'if (keystorePropertiesFile.exists()) { keystoreProperties.load(new FileInputStream(keystorePropertiesFile)) }\n\n'
+    ) + s
+if "appAuthRedirectScheme" not in s:
+    s = s.replace(
+        "defaultConfig {",
+        'defaultConfig {\n        manifestPlaceholders += [appAuthRedirectScheme: "nfteam.gamemanager"]',
+        1,
+    )
+if "signingConfigs {" not in s:
+    s = re.sub(
+        r"(\n\s*buildTypes\s*\{)",
+        '\n    signingConfigs {\n'
+        '        release {\n'
+        '            keyAlias keystoreProperties["keyAlias"]\n'
+        '            keyPassword keystoreProperties["keyPassword"]\n'
+        '            storeFile file(keystoreProperties["storeFile"])\n'
+        '            storePassword keystoreProperties["storePassword"]\n'
+        '        }\n    }\n\\1',
+        s,
+        count=1,
+    )
+s = s.replace("signingConfig signingConfigs.debug", "signingConfig signingConfigs.release")
+open(gr, "w").write(s)
+print("patch_android: OK")