Add CI workflow for tagging releases

.github/workflows/release.yml

@@ -4,9 +4,14 @@ on:
   push:
     tags:
       - "v*"
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
 
 env:
-  HAVE_KEYSTORE: ${{ secrets.SECRET_KEYSTORE != '' }}
+  TAG_REF: "${{ inputs.version || github.ref_name }}"
 
 jobs:
   build:
@@ -19,10 +24,13 @@ jobs:
 
     env:
       BUILD_ENV_FILE: ${{ vars.BUILD_ENV_FILE || 'beta-stable.env' }}
+      HAVE_KEYSTORE: ${{ secrets.SECRET_KEYSTORE != '' }}
       GRADLE_OPTS: "-Dorg.gradle.project.kotlin.compiler.execution.strategy=in-process"
 
     steps:
       - uses: actions/checkout@v3
+        with:
+          ref: "${{ env.TAG_REF }}"
 
       - name: Set up builder image
         run: docker-compose build
@@ -96,11 +104,13 @@ jobs:
 
     steps:
       - uses: actions/checkout@v3
+        with:
+          ref: "${{ env.TAG_REF }}"
 
       - name: Check if release exists
         id: check_release
         run: |
-          if gh release view "$GITHUB_REF_NAME"; then
+          if gh release view "$TAG_REF"; then
             echo "release_exists=true" >> $GITHUB_OUTPUT
           else
             echo "release_exists=false" >> $GITHUB_OUTPUT
@@ -110,7 +120,7 @@ jobs:
 
       - name: Create release draft
         if: "steps.check_release.outputs.release_exists == 'false'"
-        run: gh release create -d --verify-tag -t "$GITHUB_REF_NAME" "$GITHUB_REF_NAME"
+        run: gh release create -d --verify-tag -t "$TAG_REF" "$TAG_REF"
         env:
           GITHUB_TOKEN: ${{ secrets.PUBLISH_PAT || secrets.GITHUB_TOKEN }}
 
@@ -123,6 +133,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v3
+        with:
+          ref: "${{ env.TAG_REF }}"
 
       - name: Download artifacts
         uses: actions/download-artifact@v3
@@ -151,6 +163,6 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload APKs to GitHub release
-        run: gh release upload "$GITHUB_REF_NAME" ./apk/*/release/*.apk --clobber
+        run: gh release upload "$TAG_REF" ./apk/*/release/*.apk --clobber
         env:
           GITHUB_TOKEN: ${{ secrets.PUBLISH_PAT || secrets.GITHUB_TOKEN }}

.github/workflows/reprocheck.yml

@@ -3,7 +3,7 @@ name: Reproducible build
 on:
   workflow_dispatch:
     inputs:
-      tag_name:
+      version:
         description: "Enter the version to check"
         required: true
   release:
@@ -14,7 +14,7 @@ permissions:
   contents: read # to fetch code (actions/checkout)
 
 env:
-  TAG_NAME: "${{ github.event.inputs.tag_name || github.event.release.tag_name }}"
+  TAG_REF: "${{ github.event.inputs.version || github.event.release.tag_name }}"
 
 jobs:
   build:
@@ -28,7 +28,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
         with:
-          ref: "${{ env.TAG_NAME }}"
+          ref: "${{ env.TAG_REF }}"
 
       - name: Set up builder image
         run: docker-compose build
@@ -76,10 +76,10 @@ jobs:
     steps:
       - uses: actions/checkout@v3
         with:
-          ref: "${{ env.TAG_NAME }}"
+          ref: "${{ env.TAG_REF }}"
 
       - name: Download published APKs
-        run: gh release download --pattern '*.apk' "$TAG_NAME"
+        run: gh release download --pattern '*.apk' "$TAG_REF"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/tagrelease.yml

@@ -0,0 +1,50 @@
+name: Tag Commit for Release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  push_tag:
+    name: Push version tag
+    runs-on: ubuntu-22.04
+    outputs:
+      version: ${{ steps.extract_version.outputs.version }}
+      should_call_release: ${{ steps.release_trigger.outputs.should_call_release }}
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          token: ${{ secrets.PUBLISH_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 17
+          cache: gradle
+
+      - name: Extract version from source
+        id: extract_version
+        run: |
+          version_name=$(./gradlew -q :app:version | jq -r .versionName)
+          echo "version=v$version_name" >> $GITHUB_OUTPUT
+
+      - name: Tag current commit and push
+        run: |
+          git tag -f "${{ steps.extract_version.outputs.version }}"
+          git push -f origin "${{ steps.extract_version.outputs.version }}"
+
+      - name: Determine release trigger
+        id: release_trigger
+        run: echo "should_call_release=$IS_PAT_MISSING" >> $GITHUB_OUTPUT
+        env:
+          IS_PAT_MISSING: ${{ secrets.PUBLISH_PAT == '' }}
+
+  call_release_workflow:
+    name: Release workflow
+    if: "needs.push_tag.outputs.should_call_release == 'true'"
+    needs: push_tag
+    uses: ./.github/workflows/release.yml
+    with:
+      version: ${{ needs.push_tag.outputs.version }}
+    secrets: inherit