This repository has no description
tools.hermes-voice: build, sign and publish the Android APK in CI
.github/workflows/assist-android.yml builds packages.hermes-voice-android
on master pushes that touch it (and on demand) with the run number as
versionCode and the short commit as versionName, signs it with
hermes-voice-android-sign from the ANDROID_KEYSTORE_B64 and
ANDROID_KEYSTORE_PASSWORD secrets (the clan var
hermes-voice-android-signing of coaxmetal) and uploads it as assist.apk
of the rolling release assist-android.
The package takes versionCode and versionName (default 1), so
`nix build .#hermes-voice-android` stays pure; CI overrides them through
--impure --expr. The unsigned APK is also a check, so PR CI builds it.
author
Hermes
committer
lassulus
date
(Oct 18, 2026, 7:27 PM CEST)
commit
1a69285c
1a69285cd52a22180a9f8dfaf9130e18e654e658
parent
f3905a93
f3905a938319eb4b155ed722eb7490369ae6254e
+86
-2
+80
.github/workflows/assist-android.yml
+80
.github/workflows/assist-android.yml
···
1
+
name: assist-android
2
+
3
+
# Builds the Android wrapper of the voice page (packages.hermes-voice-android),
4
+
# signs it and publishes it as assist.apk of the rolling release
5
+
# assist-android:
6
+
# https://github.com/lassulus/superconfig/releases/download/assist-android/assist.apk
7
+
#
8
+
# versionCode is the run number, so every published APK installs over the
9
+
# previous one; versionName is the short commit.
10
+
#
11
+
# Secrets, from the clan var hermes-voice-android-signing on coaxmetal:
12
+
# - ANDROID_KEYSTORE_B64: the keystore, base64
13
+
# - ANDROID_KEYSTORE_PASSWORD: its password
14
+
on:
15
+
push:
16
+
branches: [master]
17
+
paths:
18
+
- tools/hermes-voice/android/**
19
+
- tools/hermes-voice/flake-module.nix
20
+
- flake.lock
21
+
- .github/workflows/assist-android.yml
22
+
workflow_dispatch:
23
+
24
+
permissions:
25
+
contents: read
26
+
27
+
# queued, not cancelled: an older run must not publish after a newer one
28
+
concurrency:
29
+
group: assist-android
30
+
cancel-in-progress: false
31
+
32
+
jobs:
33
+
apk:
34
+
runs-on: ubuntu-latest
35
+
permissions:
36
+
contents: write # release upload
37
+
steps:
38
+
- uses: actions/checkout@v4
39
+
40
+
- uses: cachix/install-nix-action@v31
41
+
42
+
- id: build
43
+
env:
44
+
VERSION_CODE: ${{ github.run_number }}
45
+
run: |
46
+
unsigned=$(nix build -L --no-link --print-out-paths --impure --expr "
47
+
(builtins.getFlake \"git+file://$PWD\").packages.x86_64-linux.hermes-voice-android.override {
48
+
versionCode = $VERSION_CODE;
49
+
versionName = \"${GITHUB_SHA::8}\";
50
+
}")
51
+
echo "apk=$unsigned/hermes-voice-android-unsigned.apk" >> "$GITHUB_OUTPUT"
52
+
53
+
- env:
54
+
KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
55
+
KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
56
+
run: |
57
+
umask 077
58
+
base64 -d <<<"$KEYSTORE_B64" > "$RUNNER_TEMP/keystore"
59
+
printf '%s' "$KEYSTORE_PASSWORD" > "$RUNNER_TEMP/password"
60
+
61
+
# verifies and prints the certificate as well
62
+
- env:
63
+
UNSIGNED: ${{ steps.build.outputs.apk }}
64
+
run: |
65
+
nix run .#hermes-voice-android-sign -- \
66
+
"$RUNNER_TEMP/keystore" "$RUNNER_TEMP/password" "$RUNNER_TEMP/assist.apk" "$UNSIGNED"
67
+
68
+
- env:
69
+
GH_TOKEN: ${{ github.token }}
70
+
run: |
71
+
notes="Built from $GITHUB_SHA by $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID (versionCode $GITHUB_RUN_NUMBER)."
72
+
if gh release view assist-android >/dev/null 2>&1; then
73
+
gh release edit assist-android --notes "$notes"
74
+
else
75
+
gh release create assist-android --title "Assist (Android)" --target "$GITHUB_SHA" --latest=false --notes "$notes"
76
+
fi
77
+
gh release upload assist-android "$RUNNER_TEMP/assist.apk" --clobber
78
+
79
+
- if: always()
80
+
run: rm -f "$RUNNER_TEMP/keystore" "$RUNNER_TEMP/password"
+1
tools/hermes-voice/flake-module.nix
+1
tools/hermes-voice/flake-module.nix
···
66
66
# The voice page as Android app and digital assistant (Trusted Web
67
67
# Activity), unsigned.
68
68
packages.hermes-voice-android = android;
69
+
checks.hermes-voice-android = android;
69
70
70
71
# Aligns and signs the APK with the keystore from
71
72
# `clan vars get coaxmetal hermes-voice-android-signing/keystore`.
+5
-2
tools/hermes-voice/android/default.nix
+5
-2
tools/hermes-voice/android/default.nix
···
6
6
unzip,
7
7
zip,
8
8
icon,
9
+
# CI sets them per run; Android only installs updates with a higher versionCode.
10
+
versionCode ? 1,
11
+
versionName ? "1",
9
12
}:
10
13
let
11
14
sdk = androidenv.composeAndroidPackages {
···
28
31
# dependencies.
29
32
stdenvNoCC.mkDerivation {
30
33
pname = "hermes-voice-android";
31
-
version = "1";
34
+
version = versionName;
32
35
src = ./.;
33
36
nativeBuildInputs = [
34
37
jdk17_headless
···
45
48
${buildTools}/aapt2 link -o unsigned.apk -I ${androidJar} \
46
49
--manifest AndroidManifest.xml res.zip \
47
50
--min-sdk-version 29 --target-sdk-version 36 \
48
-
--version-code 1 --version-name 1
51
+
--version-code ${toString versionCode} --version-name ${versionName}
49
52
50
53
javac -source 8 -target 8 -Xlint:-options -encoding UTF-8 \
51
54
-bootclasspath ${androidJar} -cp browser/classes.jar \