Joren/qbz
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): inject API secrets into Flatpak manifest before build

Browse Source 
flatpak-builder doesn't support --env-var, so we inject the secrets
directly into the manifest's build-options.env before building.

cc
This commit is contained in:
vicrodh committed 2026-01-14 04:52:47 -06:00
1 parent 3a7b05b859
commit bfdb65a680
1 file changed
+35 -9
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release-flatpak.yml
+35 -9
View File
@@ -85,7 +85,7 @@ jobs:
org.freedesktop.Sdk.Extension.node20//25.08 \
org.freedesktop.Sdk.Extension.rust-stable//25.08
- name: Build Flatpak
- name: Inject API secrets into Flatpak manifest
env:
SPOTIFY_API_CLIENT_ID: ${{ secrets.SPOTIFY_API_CLIENT_ID }}
SPOTIFY_API_CLIENT_SECRET: ${{ secrets.SPOTIFY_API_CLIENT_SECRET }}
@@ -95,17 +95,43 @@ jobs:
DISCOGS_API_CLIENT_SECRET: ${{ secrets.DISCOGS_API_CLIENT_SECRET }}
LAST_FM_API_KEY: ${{ secrets.LAST_FM_API_KEY }}
LAST_FM_API_SHARED_SECRET: ${{ secrets.LAST_FM_API_SHARED_SECRET }}
run: |
# Inject env vars into the qbz module's build-options.env in the manifest
python3 << 'PY'
import yaml
import os
with open('packaging/flatpak/com.blitzkriegfc.qbz.yml', 'r') as f:
manifest = yaml.safe_load(f)
# Find the qbz module and add env vars
for module in manifest.get('modules', []):
if module.get('name') == 'qbz':
if 'build-options' not in module:
module['build-options'] = {}
if 'env' not in module['build-options']:
module['build-options']['env'] = {}
env_vars = [
'SPOTIFY_API_CLIENT_ID', 'SPOTIFY_API_CLIENT_SECRET',
'TIDAL_API_CLIENT_ID', 'TIDAL_API_CLIENT_SECRET',
'DISCOGS_API_CLIENT_KEY', 'DISCOGS_API_CLIENT_SECRET',
'LAST_FM_API_KEY', 'LAST_FM_API_SHARED_SECRET'
]
for var in env_vars:
val = os.environ.get(var, '')
if val:
module['build-options']['env'][var] = val
break
with open('packaging/flatpak/com.blitzkriegfc.qbz.yml', 'w') as f:
yaml.dump(manifest, f, default_flow_style=False, sort_keys=False)
PY
- name: Build Flatpak
run: |
mkdir -p flatpak-build flatpak-repo dist
flatpak-builder --user --force-clean --repo=flatpak-repo \
--env-var=SPOTIFY_API_CLIENT_ID="$SPOTIFY_API_CLIENT_ID" \
--env-var=SPOTIFY_API_CLIENT_SECRET="$SPOTIFY_API_CLIENT_SECRET" \
--env-var=TIDAL_API_CLIENT_ID="$TIDAL_API_CLIENT_ID" \
--env-var=TIDAL_API_CLIENT_SECRET="$TIDAL_API_CLIENT_SECRET" \
--env-var=DISCOGS_API_CLIENT_KEY="$DISCOGS_API_CLIENT_KEY" \
--env-var=DISCOGS_API_CLIENT_SECRET="$DISCOGS_API_CLIENT_SECRET" \
--env-var=LAST_FM_API_KEY="$LAST_FM_API_KEY" \
--env-var=LAST_FM_API_SHARED_SECRET="$LAST_FM_API_SHARED_SECRET" \
flatpak-build packaging/flatpak/com.blitzkriegfc.qbz.yml
flatpak build-bundle flatpak-repo dist/QBZ.flatpak com.blitzkriegfc.qbz