From e25d40f2376b59a8fb86dacb2fb1c74b91e6a0c9 Mon Sep 17 00:00:00 2001
From: Miuzarte <982809597@qq.com>
Date: Sun, 12 Apr 2026 01:15:49 +0800
Subject: [PATCH] feat: signed release

---
 .github/workflows/android.yml | 37 +++++++++++++++++++++++++----------
 .gitignore                    |  1 +
 app/build.gradle.kts          | 21 ++++++++++++++++++++
 3 files changed, 49 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index ec81f4b..42b52e2 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -12,6 +12,11 @@ jobs:
   ci-build:
     if: ${{ github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-latest
+    env:
+      RELEASE_STORE_FILE: /tmp/release.p12
+      RELEASE_STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
+      RELEASE_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+      RELEASE_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
 
     steps:
       - uses: actions/checkout@v4
@@ -45,8 +50,14 @@ jobs:
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew
 
-      - name: Build debug and unsigned release APKs
-        run: ./gradlew clean assembleDebug assembleRelease
+      - name: Decode signing keystore
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > "$RELEASE_STORE_FILE"
+
+      - name: Build signed release APKs
+        run: ./gradlew clean assembleRelease
 
       - name: Collect CI APKs
         run: |
@@ -80,6 +91,11 @@ jobs:
   release-build:
     if: ${{ startsWith(github.ref, 'refs/tags/') }}
     runs-on: ubuntu-latest
+    env:
+      RELEASE_STORE_FILE: /tmp/release.p12
+      RELEASE_STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
+      RELEASE_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+      RELEASE_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
 
     steps:
       - uses: actions/checkout@v4
@@ -113,8 +129,14 @@ jobs:
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew
 
-      - name: Build debug and unsigned release APKs
-        run: ./gradlew clean assembleDebug assembleRelease
+      - name: Decode signing keystore
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > "$RELEASE_STORE_FILE"
+
+      - name: Build signed release APKs
+        run: ./gradlew clean assembleRelease
 
       - name: Collect release assets
         run: |
@@ -148,8 +170,6 @@ jobs:
           download_base_url="https://github.com/${GITHUB_REPOSITORY}/releases/download/${GITHUB_REF_NAME}"
 
           {
-            echo "**release-unsigned** 为未签名构建，无法直接安装"
-            echo
             echo "| 架构 | 构建类型 | 文件 | SHA256 | 大小 |"
             echo "| --- | --- | --- | --- | --- |"
 
@@ -170,10 +190,7 @@ jobs:
                 arch="arm_all"
               fi
 
-              build_type="debug"
-              if [[ "$file_name" == *"unsigned"* ]]; then
-                build_type="release-unsigned"
-              fi
+              build_type="release"
 
               file_url="${download_base_url}/${file_name}"
               sha256_value="$(sha256sum "$apk" | awk '{print $1}')"
diff --git a/.gitignore b/.gitignore
index f966e01..89e2ea9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,6 +26,7 @@ render.experimental.xml
 # Keystore files
 *.jks
 *.keystore
+.env
 
 # Google Services (e.g. APIs or Firebase)
 google-services.json
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 6d81a82..d2d7610 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -16,6 +16,26 @@ android {
     namespace = "io.github.miuzarte.scrcpyforandroid"
     compileSdk = 37
 
+    signingConfigs {
+        create("release") {
+            val releaseStoreFile = System.getenv("RELEASE_STORE_FILE")
+            val releaseStorePassword = System.getenv("RELEASE_STORE_PASSWORD")
+            val releaseKeyAlias = System.getenv("RELEASE_KEY_ALIAS")
+            val releaseKeyPassword = System.getenv("RELEASE_KEY_PASSWORD")
+
+            if (!releaseStoreFile.isNullOrBlank()) {
+                storeFile = file(releaseStoreFile)
+                storePassword = releaseStorePassword
+                keyAlias = releaseKeyAlias
+                keyPassword = releaseKeyPassword
+                enableV1Signing = true
+                enableV2Signing = true
+                enableV3Signing = true
+                enableV4Signing = true
+            }
+        }
+    }
+
     defaultConfig {
         applicationId = "io.github.miuzarte.scrcpyforandroid"
         minSdk = 26
@@ -49,6 +69,7 @@ android {
 
     buildTypes {
         release {
+            signingConfig = signingConfigs.getByName("release")
             isMinifyEnabled = false
             proguardFiles(
                 getDefaultProguardFile("proguard-android-optimize.txt"),