@@ -20,6 +20,35 @@ Optional app targeting:
|
20 | 20 | GOOGLE_PLAY_PACKAGE_NAME=ai.openclaw.app |
21 | 21 | ``` |
22 | 22 | |
| 23 | +Android release signing uses the same private `apps-signing` repository and `MATCH_PASSWORD` secret as iOS, but with Android-specific encrypted assets. Pull the shared upload key before release validation: |
| 24 | + |
| 25 | +```bash |
| 26 | +pnpm android:release:signing:plan |
| 27 | +MATCH_PASSWORD=<signing repo password> pnpm android:release:signing:sync:pull |
| 28 | +MATCH_PASSWORD=<signing repo password> pnpm android:release:signing:check |
| 29 | +``` |
| 30 | + |
| 31 | +The pull command materializes decrypted signing files under `apps/android/build/release-signing/`, which is gitignored. Later Fastlane release commands reload those materialized values and export them to Gradle for the current process. |
| 32 | + |
| 33 | +For the first setup or rotation, provide the Play upload keystore and a local signing properties file, then push encrypted assets to `apps-signing`: |
| 34 | + |
| 35 | +```bash |
| 36 | +MATCH_PASSWORD=<signing repo password> \ |
| 37 | +OPENCLAW_ANDROID_UPLOAD_KEYSTORE=<path-to-upload-keystore.jks> \ |
| 38 | +OPENCLAW_ANDROID_SIGNING_PROPERTIES=<path-to-android-signing.properties> \ |
| 39 | +pnpm android:release:signing:sync:push |
| 40 | +``` |
| 41 | + |
| 42 | +The source signing properties file must contain: |
| 43 | + |
| 44 | +```properties |
| 45 | +OPENCLAW_ANDROID_STORE_PASSWORD=<store-password> |
| 46 | +OPENCLAW_ANDROID_KEY_ALIAS=<upload-key-alias> |
| 47 | +OPENCLAW_ANDROID_KEY_PASSWORD=<key-password> |
| 48 | +``` |
| 49 | + |
| 50 | +Store the Google Play upload key, not the irreplaceable app signing key, when Play App Signing is enabled. |
| 51 | + |
23 | 52 | Validate auth: |
24 | 53 | |
25 | 54 | ```bash |
@@ -58,13 +87,17 @@ Release rules:
|
58 | 87 | - `apps/android/Config/Version.properties` is generated from that source and read by Gradle. |
59 | 88 | - `apps/android/CHANGELOG.md` is the Android-only changelog and release-note source. |
60 | 89 | - `apps/android/fastlane/metadata/android/en-US/release_notes.txt` is generated from that changelog by `pnpm android:version:sync`. |
| 90 | +- `apps/android/Config/ReleaseSigning.json` pins the encrypted Android signing assets in the shared signing repo. |
| 91 | +- `MATCH_PASSWORD` enables Fastlane to pull encrypted Android signing assets into `apps/android/build/release-signing/` before release validation or archive builds. |
61 | 92 | - Supported pinned Android versions use CalVer: `YYYY.M.D`. |
62 | 93 | - `versionCode` uses `YYYYMMDDNN`, where `NN` is a two-digit build number for the pinned version. |
63 | 94 | - `pnpm android:version:pin -- --from-gateway` promotes the current root gateway version into the pinned Android release version. |
64 | 95 | - `pnpm android:version:pin -- --version 2026.6.5 --version-code 2026060502` increments another build on the same Android release train. |
65 | 96 | - `pnpm android:version:sync` updates generated version artifacts. |
66 | 97 | - `pnpm android:version:check` validates checked-in Android version artifacts. |
67 | 98 | - `pnpm android:release:preflight` validates Google Play auth, Android release signing, synced versioning, release notes, and prints the package/track/version/versionCode that will be uploaded. |
| 99 | +- `pnpm android:release:signing:sync:pull` pulls encrypted Android signing assets from `apps-signing`. |
| 100 | +- `pnpm android:release:signing:sync:push` creates or refreshes encrypted Android signing assets in `apps-signing`. |
68 | 101 | - `pnpm android:screenshots` builds and installs the Play debug app, launches deterministic screenshot scenes, and captures raw PNGs. |
69 | 102 | - `pnpm android:release:archive` builds the signed Play AAB and third-party APK into `apps/android/build/release-artifacts/`. |
70 | 103 | - `pnpm android:release:upload` uploads the Play AAB to the configured Google Play track. The default track is `internal`. |
|
