release: develop 누적 145커밋을 main 릴리스 후보로 반영 [base: main]

.github/actions/cleanup-release-config/action.yml

@@ -0,0 +1,35 @@
+name: Remove release build configuration
+description: Delete the credential files setup-release-config created
+
+# 공개 저장소라 job 이 어떻게 끝나든 러너에 credential 을 남기지 않는다. if: always() 로 부를 것.
+
+inputs:
+  keystore-path:
+    description: setup-release-config 의 keystore-path output
+    required: false
+    default: ""
+  firebase-credentials-path:
+    description: setup-release-config 의 firebase-credentials-path output
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Remove release build files
+      shell: bash
+      env:
+        KEYSTORE_PATH: ${{ inputs.keystore-path }}
+        FIREBASE_CREDENTIALS_PATH: ${{ inputs.firebase-credentials-path }}
+      run: |
+        set -euo pipefail
+
+        rm -f app/google-services.json local.properties
+
+        if [ -n "$KEYSTORE_PATH" ]; then
+          rm -f "$KEYSTORE_PATH"
+        fi
+
+        if [ -n "$FIREBASE_CREDENTIALS_PATH" ]; then
+          rm -f "$FIREBASE_CREDENTIALS_PATH"
+        fi

.github/actions/setup-release-config/action.yml

@@ -0,0 +1,162 @@
+name: Set up release build configuration
+description: Verify the release secrets a job declares and materialise the build files they back
+
+# setup-ci-config 와 별개 action 이다. 그쪽은 실서비스 값이 없는 결정적 stub 을 만들어 PR 검증에
+# 쓰고(#842), 이쪽은 승인 environment 뒤에서 실서비스 secret 을 다룬다. 두 경로가 한 action 으로
+# 섞이면 PR 검증이 실서비스 secret 을 참조할 여지가 생기므로 합치지 않는다.
+
+inputs:
+  require:
+    description: "검증할 secret 이름 목록 (공백 구분). 나열된 이름의 값이 비면 이름만 보고하고 실패한다."
+    required: true
+  kakao-native-app-key:
+    description: KAKAO_NATIVE_APP_KEY
+    required: false
+    default: ""
+  google-web-client-id:
+    description: GOOGLE_WEB_CLIENT_ID
+    required: false
+    default: ""
+  google-services-json-b64:
+    description: GOOGLE_SERVICES_JSON_B64 — 주어지면 app/google-services.json 을 만든다
+    required: false
+    default: ""
+  release-store-file-b64:
+    description: RELEASE_STORE_FILE_B64 — 주어지면 release keystore 를 만든다
+    required: false
+    default: ""
+  release-store-password:
+    description: RELEASE_STORE_PASSWORD
+    required: false
+    default: ""
+  release-key-alias:
+    description: RELEASE_KEY_ALIAS
+    required: false
+    default: ""
+  release-key-password:
+    description: RELEASE_KEY_PASSWORD
+    required: false
+    default: ""
+  firebase-service-account-json:
+    description: FIREBASE_SERVICE_ACCOUNT_JSON — 주어지면 ADC credential 파일을 만든다
+    required: false
+    default: ""
+  compose-local-properties:
+    description: "true 면 app/build.gradle.kts 의 signingConfigs.release 가 읽는 local.properties 를 만든다"
+    required: false
+    default: "false"
+
+outputs:
+  keystore-path:
+    description: decode 된 release keystore 경로 (만들지 않았으면 빈 값)
+    value: ${{ steps.materialise.outputs.keystore-path }}
+  firebase-credentials-path:
+    description: Firebase service account credential 경로 (만들지 않았으면 빈 값)
+    value: ${{ steps.materialise.outputs.firebase-credentials-path }}
+
+runs:
+  using: composite
+  steps:
+    # fail-fast — secret 누락 시 Gradle 까지 가지 않고 즉시 실패.
+    # secret 값은 echo 하지 않는다 (env 로만 받아 길이 검사). 누락 키 이름은 안전.
+    - name: Verify required secrets are set
+      shell: bash
+      env:
+        REQUIRE: ${{ inputs.require }}
+        KAKAO_NATIVE_APP_KEY: ${{ inputs.kakao-native-app-key }}
+        GOOGLE_WEB_CLIENT_ID: ${{ inputs.google-web-client-id }}
+        GOOGLE_SERVICES_JSON_B64: ${{ inputs.google-services-json-b64 }}
+        RELEASE_STORE_FILE_B64: ${{ inputs.release-store-file-b64 }}
+        RELEASE_STORE_PASSWORD: ${{ inputs.release-store-password }}
+        RELEASE_KEY_ALIAS: ${{ inputs.release-key-alias }}
+        RELEASE_KEY_PASSWORD: ${{ inputs.release-key-password }}
+        FIREBASE_SERVICE_ACCOUNT_JSON: ${{ inputs.firebase-service-account-json }}
+      run: |
+        set -euo pipefail
+
+        read -ra required_names <<< "$REQUIRE"
+        if [ "${#required_names[@]}" -eq 0 ]; then
+          echo "::error::require 가 비어 있다 — 검증할 secret 이름을 지정할 것"
+          exit 1
+        fi
+
+        missing=""
+        for name in "${required_names[@]}"; do
+          case "$name" in
+            KAKAO_NATIVE_APP_KEY) value="$KAKAO_NATIVE_APP_KEY" ;;
+            GOOGLE_WEB_CLIENT_ID) value="$GOOGLE_WEB_CLIENT_ID" ;;
+            GOOGLE_SERVICES_JSON_B64) value="$GOOGLE_SERVICES_JSON_B64" ;;
+            RELEASE_STORE_FILE_B64) value="$RELEASE_STORE_FILE_B64" ;;
+            RELEASE_STORE_PASSWORD) value="$RELEASE_STORE_PASSWORD" ;;
+            RELEASE_KEY_ALIAS) value="$RELEASE_KEY_ALIAS" ;;
+            RELEASE_KEY_PASSWORD) value="$RELEASE_KEY_PASSWORD" ;;
+            FIREBASE_SERVICE_ACCOUNT_JSON) value="$FIREBASE_SERVICE_ACCOUNT_JSON" ;;
+            *)
+              echo "::error::이 action 이 모르는 secret 이름: $name"
+              exit 1
+              ;;
+          esac
+          if [ -z "$value" ]; then
+            missing="$missing $name"
+          fi
+        done
+
+        if [ -n "$missing" ]; then
+          echo "::error::필수 secret 누락:$missing — Settings → Secrets and variables → Actions 에 등록"
+          exit 1
+        fi
+
+    # keystore·credential 은 workspace 밖 RUNNER_TEMP 에 둔다 — job 종료 시 러너와 함께 폐기되고
+    # actions/upload-artifact 의 workspace glob 에 딸려 올라갈 수 없다.
+    - name: Materialise release build files
+      id: materialise
+      shell: bash
+      env:
+        KAKAO_NATIVE_APP_KEY: ${{ inputs.kakao-native-app-key }}
+        GOOGLE_WEB_CLIENT_ID: ${{ inputs.google-web-client-id }}
+        GOOGLE_SERVICES_JSON_B64: ${{ inputs.google-services-json-b64 }}
+        RELEASE_STORE_FILE_B64: ${{ inputs.release-store-file-b64 }}
+        RELEASE_STORE_PASSWORD: ${{ inputs.release-store-password }}
+        RELEASE_KEY_ALIAS: ${{ inputs.release-key-alias }}
+        RELEASE_KEY_PASSWORD: ${{ inputs.release-key-password }}
+        FIREBASE_SERVICE_ACCOUNT_JSON: ${{ inputs.firebase-service-account-json }}
+        COMPOSE_LOCAL_PROPERTIES: ${{ inputs.compose-local-properties }}
+      run: |
+        set -euo pipefail
+
+        keystore_path=""
+        firebase_credentials_path=""
+
+        # google-services plugin 이 app/google-services.json 을 요구한다. 파일은 .gitignore 라
+        # CI 환경엔 없으므로 base64 secret 에서 복원한다.
+        if [ -n "$GOOGLE_SERVICES_JSON_B64" ]; then
+          printf '%s' "$GOOGLE_SERVICES_JSON_B64" | base64 -d > app/google-services.json
+        fi
+
+        if [ -n "$RELEASE_STORE_FILE_B64" ]; then
+          keystore_path="$RUNNER_TEMP/afternote-release.jks"
+          printf '%s' "$RELEASE_STORE_FILE_B64" | base64 -d > "$keystore_path"
+        fi
+
+        # Firebase App Distribution Gradle plugin 은 GOOGLE_APPLICATION_CREDENTIALS 환경변수로
+        # service account JSON 경로를 인식한다. 경로만 output 으로 넘기고 export 는 호출자가 한다.
+        if [ -n "$FIREBASE_SERVICE_ACCOUNT_JSON" ]; then
+          firebase_credentials_path="$RUNNER_TEMP/firebase-service-account.json"
+          printf '%s' "$FIREBASE_SERVICE_ACCOUNT_JSON" > "$firebase_credentials_path"
+        fi
+
+        if [ "$COMPOSE_LOCAL_PROPERTIES" = "true" ]; then
+          {
+            echo "KAKAO_NATIVE_APP_KEY=$KAKAO_NATIVE_APP_KEY"
+            echo "GOOGLE_WEB_CLIENT_ID=$GOOGLE_WEB_CLIENT_ID"
+            echo "RELEASE_STORE_FILE=$keystore_path"
+            echo "RELEASE_STORE_PASSWORD=$RELEASE_STORE_PASSWORD"
+            echo "RELEASE_KEY_ALIAS=$RELEASE_KEY_ALIAS"
+            echo "RELEASE_KEY_PASSWORD=$RELEASE_KEY_PASSWORD"
+          } > local.properties
+        fi
+
+        {
+          echo "keystore-path=$keystore_path"
+          echo "firebase-credentials-path=$firebase_credentials_path"
+        } >> "$GITHUB_OUTPUT"

.github/scripts/build-cache-policy.test.mjs

@@ -0,0 +1,98 @@
+import assert from "node:assert/strict";
+import { readdir, readFile } from "node:fs/promises";
+import test from "node:test";
+
+const workflowDirectory = new URL("../workflows/", import.meta.url);
+
+async function workflows() {
+    const names = (await readdir(workflowDirectory)).filter((name) => name.endsWith(".yml"));
+    return Promise.all(names.map(async (name) => [name, await readFile(new URL(name, workflowDirectory), "utf8")]));
+}
+
+// 주석은 왜 그렇게 했는지를 적어 두는 자리라 액션 이름·플래그가 그대로 등장한다.
+// 정책은 실제로 실행되는 줄에만 걸어야 한다.
+function withoutComments(source) {
+    return source
+        .split("\n")
+        .filter((line) => !/^\s*#/.test(line))
+        .join("\n");
+}
+
+// Actions 캐시 엔트리는 (키, ref) 로 격리되고, 읽기는 «현재 ref → base → default branch»
+// 순으로 매칭된다. 그래서 경쟁이 일어나는 범위는 develop 스코프 하나다 — release·canary
+// 워크플로는 main 스코프에 쓰므로 develop PR 이 받는 엔트리를 가리지 않는다.
+function runsOnDevelopPush(source) {
+    return /^\s{2}push:\n\s{4}branches:\s*\[[^\]]*\bdevelop\b/m.test(source);
+}
+
+function runsOnPullRequests(source) {
+    return /^on:\n(?:[^\n]*\n)*?\s{2}pull_request:/m.test(source);
+}
+
+test("exactly one workflow may write the shared Gradle User Home cache", async () => {
+    // Actions 캐시는 같은 키를 덮어쓰지 못한다. writer 가 둘이면 먼저 끝난 쪽이 키를
+    // 차지하고, build cache 를 채운 쪽의 저장이 조용히 버려진다 (#996).
+    const writers = (await workflows())
+        .filter(([, source]) => runsOnDevelopPush(source))
+        .filter(([, source]) => /cache-read-only:\s*false/.test(withoutComments(source)))
+        .map(([name]) => name);
+
+    assert.deepEqual(writers, ["build-cache-warm.yml"]);
+});
+
+test("every other Gradle workflow reads the cache without writing to it", async () => {
+    for (const [name, source] of await workflows()) {
+        if (name === "build-cache-warm.yml" || !/uses:\s*gradle\/actions\/setup-gradle@/.test(source)) {
+            continue;
+        }
+        if (!runsOnPullRequests(source) && !runsOnDevelopPush(source)) {
+            continue;
+        }
+        assert.match(source, /cache-read-only:\s*true/, `${name} must not write to the shared cache`);
+        // 조건식으로 쓰면 pull_request 가 아닌 trigger 에서 writer 로 돌변한다.
+        assert.doesNotMatch(
+            source,
+            /cache-read-only:\s*\$\{\{/,
+            `${name} must not decide cache writability from the event`,
+        );
+    }
+});
+
+test("the warming workflow runs on develop pushes and is never cancelled mid-run", async () => {
+    const source = await readFile(new URL("build-cache-warm.yml", workflowDirectory), "utf8");
+
+    assert.match(source, /push:\n\s+branches:\s*\[develop\]/);
+    // 캐시는 job 의 post 스텝에서 저장된다. 중도 취소되면 그 스텝에 닿지 못한다.
+    assert.match(source, /cancel-in-progress:\s*false/);
+    assert.match(source, /--build-cache/);
+});
+
+test("the warming workflow covers the tasks pull request jobs actually run", async () => {
+    const warm = await readFile(new URL("build-cache-warm.yml", workflowDirectory), "utf8");
+    const lint = await readFile(new URL("lint.yml", workflowDirectory), "utf8");
+    const unitTest = await readFile(new URL("unit-test.yml", workflowDirectory), "utf8");
+
+    for (const task of ["ktlintCheck", "lintDebug"]) {
+        assert.match(lint, new RegExp(`\\./gradlew[^\\n]*${task}`), `lint.yml no longer runs ${task}`);
+        assert.match(warm, new RegExp(`\\b${task}\\b`), `warming misses ${task}`);
+    }
+    for (const task of [":koverXmlReportCi", ":konsist:test", ":app:compileDebugAndroidTestKotlin"]) {
+        assert.ok(unitTest.includes(task), `unit-test.yml no longer runs ${task}`);
+        assert.ok(warm.includes(task), `warming misses ${task}`);
+    }
+});
+
+test("CodeQL stays out of the build cache in both directions", async () => {
+    const source = await readFile(new URL("codeql.yml", workflowDirectory), "utf8");
+
+    // 추출기가 컴파일러 호출을 관찰해야 하므로 FROM-CACHE 로 넘어가면 안 된다 (#1014).
+    assert.doesNotMatch(withoutComments(source), /--build-cache/);
+    assert.match(source, /cache-read-only:\s*true/);
+});
+
+test("the local Gradle default stays uncached", async () => {
+    // #996 은 CI 한정이다. 로컬은 손상된 cache 엔트리 사례 때문에 여전히 꺼 둔다.
+    const properties = await readFile(new URL("../../gradle.properties", import.meta.url), "utf8");
+
+    assert.match(properties, /^org\.gradle\.caching=false$/m);
+});