version = "1.1.11"

apply plugin: "com.dipien.android.semantic-version"
----

I then searched for a Jenkins plugin that would create a GitHub release.
As the saying goes,

[quote]
____
There's a plugin for that
____

but unfortunately, I couldn't find one that meets my needs. While there
is a plugin called link:https://plugins.jenkins.io/git-changelog/[Git
Changelog] that can merge
commit messages to produce a readable version of the changes, it doesn't
create the release.

== GitHub release

If you want to stay on the Jenkins side, there isn't a plugin this time.
However, there are various ways to create a release. You could use the
link:https://docs.github.com/en/rest?apiVersion=2022-11-28[GitHub REST API]
or the link:https://cli.github.com/[`gh`] command, which can handle all the
heavy lifting for us. Therefore, let's go back to the drawing board and
add the command to our Docker image.


---- {.dockerfile}
== Install GitHub command line tool
ENV GITHUB_TOKEN $GITHUB_TOKEN
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && \
    chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg && \
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null && \
    apt update && apt install -y --no-install-recommends gh
----

Once that's done, we need to use link:https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/about-authentication-with-a-github-app[GitHub App
authentication]
to enable `gh` to use our credentials. To do this, we have to install
the link:https://plugins.jenkins.io/github-branch-source/[GitHub Branch Source
plugin] and then
create a link:https://www.jenkins.io/blog/2020/04/16/github-app-authentication/[GitHub
Application].

No need to replicate here the link:https://github.com/jenkinsci/github-branch-source-plugin/blob/master/docs/github-app.adoc[efficient
documentation]
existing on GitHub. The only fields you need to prepare and fill out
(currently) are:

*   Github App name - i.e. `Jenkins-<team name>`

*   Homepage URL - your company's domain or a GitHub repository,
    anything would do.

*   Webhook URL - your jenkins instance, i.e.
    `https://<jenkins-host>/github-webhook/`

At that moment, I
link:https://github.com/gounthar/MyFirstAndroidAppBuiltByJenkins/blob/main/jenkins/create-release.sh[queried]
GitHub using `gh` to determine whether the release already existed, and
created it if it did not.\
My choice of how to create the release was entirely arbitrary: I decided
to create a release when the version ended with `"RELEASE"`, a draft
release when there was no suffix, and a pre-release when the version
ended with `"ALPHA"` or `"BETA"`.


---- {.bash}
suffix=$(echo $versionName | sed 's/.*-//')
case $suffix in
    ALPHA|BETA)
        echo "Time to do a prerelease"
        GH_OPTS="$GH_OPTS-p"
        ;;
    SNAPSHOT)
        echo "This is a snapshot, we won't release anything"
        GH_OPTS="$GH_OPTS DO_NOT_RELEASE"
        ;;
    RELEASE)
        echo "This a real release, so no need to use -d or -p";;
    *)
        echo "Unknown suffix \"$suffix\", so we'll do a draft release"
        GH_OPTS="$GH_OPTS-d"
        ;;
esac
----

Good enough for my use case.

The `gh` command does a nice job of preparing a release change log, so
I'm relying on it. If we're not building on the main branch, the release
is not finalized, so I can still tidy it up later.\
It's great to be able to create a release as soon as it's required, even
when it's not necessary...

image::/assets/images/2023/05/03/2023-05-03-android-and-jenkins-releases/too-many-releases.png[Too many
releases]

It looks like I may have gone a little too far with the automatic
release creation, don't you think?

Now, what about using that workflow to create a release on the Play
Store?

== Google Play Store release

The version is already handled by the semantic plugin, and the release
notes are almost ready to go. Now, we just need to find the right plugin
to push our app to the Google Play Store.\
Luckily, we have a plugin for that, called
link:https://github.com/Triple-T/gradle-play-publisher[`com.github.triplet.play`].
This time, it's a link:https://plugins.gradle.org/plugin/com.github.triplet.play[Gradle
plugin]
instead of a Jenkins plugin.

The first step to getting your app on the Play Store is to pay the \$25
developer account fee. After that, you need to register your app, import
the EULA (there are link:https://termly.io/products/eula-generator/[free
websites] to generate that),
upload the required paperwork, and then upload the signed app. Since the
app is not signed yet, we'll need to do that first.

== Signing the app from the command line

There are different ways to sign your app - from the command line using
`apksigner` for APKs or `jarsigner` for app bundles or you can configure
Gradle to sign it during the build. In either case, you need to generate
a private key using `keytool` before signing the app.


---- {.bash}
 keytool -genkey -v -keystore my-release-key.jks -keyalg RSA -validity 10000 -alias my-alias
----

Let's see quickly how to sign an apk:

.  Align the unsigned APK using zipalign:


---- {.bash}
    zipalign -v -p 4 my-app-unsigned.apk my-app-unsigned-aligned.apk
    ----

    `zipalign` ensures that all uncompressed data starts with a
    particular byte alignment relative to the start of the file, which
    may reduce the amount of RAM consumed by an app. 2. Sign your APK
    with your previously generated private key using `apksigner`:


---- {.bash}
    apksigner sign --ks my-release-key.jks --out my-app-release.apk my-app-unsigned-aligned.apk
    ----

    This example outputs the signed APK at `my-app-release.apk` after
    signing it with a private key and certificate that are stored in a
    single KeyStore file: `my-release-key.jks`.

Now, let's see how to sign an application bundle (located in
`app/build/outputs/bundle/debug`) thanks to Gradle.


---- {.bash}
jarsigner -verbose -sigalg SHA256withRSA -keystore ../../../../../my-release-key.jks app-debug.aab my-alias
----

== Signing the app from Gradle

Open the module-level `build.gradle` file and add the
`signingConfigs {}` block with entries for `storeFile`, `storePassword`,
`keyAlias` and `keyPassword`, and then pass that object to the
`signingConfig` property in your build type. For example:


---- {.groovy}
 signingConfigs {
        release {
            // You need to specify either an absolute path or include the
            // keystore file in the same directory as the build.gradle file.
            storeFile file("my-release-key.jks")
            storePassword "password"
            keyAlias "my-alias"
            keyPassword "password"
        }
    }

    buildTypes {
        release {
            minifyEnabled false
            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
            signingConfig signingConfigs.release
        }
    }
----

From now on, when you create the bundle with Gradle, it will be signed,
self-signed, which is not what we're aiming for. We still need to upload
the icon, a summary, screenshots, banners, and other boilerplate
content... The next step is to create a GCP project.

== Creating a GCP project

<!-- blank line -->
<figure class="video_container">
  video::Vdw1LgBcy3o[youtube] </iframe>
</figure>
<!-- blank line -->

You have to link:https://developers.google.com/android-publisher/getting_started#enable[enable the Android Publisher
API]
for that project.

<!-- blank line -->
<figure class="video_container">
  video::eXJBIkHNB48[youtube] </iframe>
</figure>
<!-- blank line -->

Then you have to
link:https://developers.google.com/android-publisher/getting_started#existing[link]
your Google Play developer account to the GCP project.


<!-- blank line -->
<figure class="video_container">
  video::XaokL2ku4JA[youtube] </iframe>
</figure>
<!-- blank line -->

Then you will have to link:https://cloud.google.com/iam/docs/service-accounts-create[create a service
account].


<!-- blank line -->
<figure class="video_container">
  video::hAHvZe1XklU[youtube] </iframe>
</figure>
<!-- blank line -->

Then you have to create a
link:https://cloud.google.com/iam/docs/keys-create-delete[key].


<!-- blank line -->
<figure class="video_container">
  video::LdMSK1d63Sw[youtube] </iframe>
</figure>
<!-- blank line -->

To set up the necessary credentials for publishing our app to the Play
Store, we'll need to create an environment variable in Jenkins. To do
this, we first need to install the link:https://plugins.jenkins.io/envinject/[Environment Injector
plugin]. Once that's done, we can
grant the necessary permissions to our service account so that it can
publish the app on our behalf.


<!-- blank line -->
<figure class="video_container">
  video::LXVydeeMnSU[youtube] </iframe>
</figure>
<!-- blank line -->

And we're finally ready to publish our app thanks to gradle on Jenkins.

== Publishing the app

The `gradlew` tasks group `publishing` tells us we have a
`publishBundle` task that uploads App Bundle for all variants.


---- {.bash}
./gradlew tasks --group publishing

[quote]
____
Task :tasks
____