Pass keystore data via env

android/app/build.gradle.kts

@@ -42,27 +42,23 @@ android {
     }
 
     // Release signing is optional:
-    // - With a complete key.properties -> signed (for Play/GitHub releases)
+    // - With ZAPSTORE_KEY_PATH + ZAPSTORE_KEY_PASSWORD env vars -> signed
-    // - Without key.properties (or incomplete) -> unsigned (for reproducible builds / F-Droid)
+    // - Without env vars -> unsigned (for reproducible builds / F-Droid)
-    val releaseSigningConfig = if (keystorePropertiesFile.exists()) {
+    val envKeyPassword = System.getenv("ZAPSTORE_KEY_PASSWORD")?.trim()
-        val alias = keystoreProperties.getProperty("keyAlias")?.trim().orEmpty()
+    val envKeyPath = System.getenv("ZAPSTORE_KEY_PATH")?.trim()
-        val keyPass = keystoreProperties.getProperty("keyPassword")?.trim().orEmpty()
-        val storePath = keystoreProperties.getProperty("storeFile")?.trim().orEmpty()
-        val storePass = keystoreProperties.getProperty("storePassword")?.trim().orEmpty()
 
-        val store = storePath.takeIf { it.isNotBlank() }?.let { file(it) }
+    val envKeyAlias = System.getenv("ZAPSTORE_KEY_ALIAS")?.trim()
-        val isComplete = alias.isNotBlank() && keyPass.isNotBlank() && store != null && store.exists() && storePass.isNotBlank()
 
-        if (isComplete) {
+    val releaseSigningConfig = if (envKeyPassword != null && envKeyPath != null && envKeyAlias != null) {
-            signingConfigs.create("release") {
+        val store = file(envKeyPath)
-                storeFile = store
+        if (!store.exists()) {
-                storePassword = storePass
+            error("ZAPSTORE_KEY_PATH points to a file that does not exist: $envKeyPath")
-                keyAlias = alias
+        }
-                keyPassword = keyPass
+        signingConfigs.create("release") {
-            }
+            storeFile = store
-        } else {
+            storePassword = envKeyPassword
-            logger.warn("key.properties found but incomplete. Building unsigned release APK.")
+            keyAlias = envKeyAlias
-            null
+            keyPassword = envKeyPassword
         }
     } else {
         null