Skip to content

ci(android): let pull requests from forks build - #2710

Open
cuong-tran wants to merge 1 commit into
maxrave-dev:devfrom
cuong-tran:ci/fork-pr-builds
Open

cuong-tran wants to merge 1 commit into
maxrave-dev:devfrom
cuong-tran:ci/fork-pr-builds

Conversation

@cuong-tran

Copy link
Copy Markdown
Contributor

What & why

Every pull request from a fork fails "Build release APK (FOSS)", in both build and build-vivo, while pushes to dev pass. GitHub gives no repository secrets to pull_request runs from forks, so local.properties gets an empty SENTRY_AUTH_TOKEN. The Full build still had autoUploadProguardMapping on, so after the APK had already built, uploadSentryProguardMappingsRelease failed:

sentry reported an error: Invalid token header. No credentials provided. (http status: 401)

Seen on #2709 (run 39217097153) and on earlier fork PRs (runs 38939224887, 35792460797).

  • androidApp and vivoAndroidApp: upload the mapping only when a token is present. Without one, the Sentry plugin runs sentry-cli upload-proguard --no-upload, which still writes the mapping UUID but makes no API call. Builds with the secret behave exactly as before. A local Full build without a token now succeeds too.
  • android.yml: skip signing and the artifact upload for pull requests from forks, which have no signing key either. Pushes and same-repo PRs still sign and upload.

Trade-off: if the SENTRY_AUTH_TOKEN secret ever goes missing upstream, the mapping upload is skipped silently instead of failing the build.

Linked issue

No issue: this fixes the CI failure seen on fork PRs such as #2709.

Checklist

  • This PR addresses an accepted issue (linked above)
  • I wrote or personally reviewed every line of this change
  • I tested it on Android and/or Desktop (say which, and how)

CI only, no app code changed. This PR comes from a fork, so its own check run is the test: both jobs should pass, with the sign and upload steps skipped.

A pull request from a fork gets no repository secrets, so the Full build's Sentry mapping upload ran with an empty auth token and failed with a 401 after the APK had already built, failing every fork PR. Upload the mapping only when a token is present (the plugin then runs sentry-cli with --no-upload), and skip signing and the artifact upload for fork PRs, which have no signing key either.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant