From d21c944f3f04b3da1683fdcd7053a75973fe0138 Mon Sep 17 00:00:00 2001 From: jwinterm Date: Tue, 19 May 2026 07:57:22 -0400 Subject: [PATCH 1/2] CI: manual-trigger only for all build workflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Auto-triggers on push were noisy — every merged PR kicked off the linux + android + ios-sim builds. Switching to workflow_dispatch only. Trigger via Gitea Actions UI when you want a build. workflow_dispatch runs as the authenticated user, so secrets are always present. Adds the push trigger back when we want pre-merge gating or CI on every commit (e.g., release-tag automation). --- .github/workflows/build-android.yml | 10 +++------- .github/workflows/build-ios-sim.yml | 5 ++--- .github/workflows/build-linux.yml | 9 +++------ 3 files changed, 8 insertions(+), 16 deletions(-) diff --git a/.github/workflows/build-android.yml b/.github/workflows/build-android.yml index b682b689..a1e56610 100644 --- a/.github/workflows/build-android.yml +++ b/.github/workflows/build-android.yml @@ -5,13 +5,9 @@ name: Hash Bags Android build # - PRs targeting dev/main (gate merges) # - manual via workflow_dispatch on: - # PR-from-fork triggers strip secrets in Gitea (and GitHub) for security. - # We mirror github-such-software/hash-wallet → Builds/hash-wallet via PRs, - # so a pull_request trigger here would always run without secrets. - # Listen only to push events on the destination branch (post-merge) so - # secrets are reliably available. - push: - branches: [dev, main] + # Manual-only for now. Trigger via Actions → "Hash Bags Android build" + # → Run workflow when you want a build. workflow_dispatch runs as the + # triggering user, so secrets are always available (unlike PR triggers). workflow_dispatch: concurrency: diff --git a/.github/workflows/build-ios-sim.yml b/.github/workflows/build-ios-sim.yml index 6be9bafe..f5a934be 100644 --- a/.github/workflows/build-ios-sim.yml +++ b/.github/workflows/build-ios-sim.yml @@ -8,9 +8,8 @@ name: Hash Bags iOS Simulator build # Phase 2 (separate workflow): full TestFlight pipeline with signing. on: - # See note in build-android.yml about Gitea PR-from-fork secret stripping. - push: - branches: [dev, main] + # Manual-only for now. Trigger via Actions → "Hash Bags iOS Simulator + # build" → Run workflow when you want a build. workflow_dispatch: # Cancel in-flight runs when a newer commit lands on the same branch — so a diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml index e8422c0e..332824cd 100644 --- a/.github/workflows/build-linux.yml +++ b/.github/workflows/build-linux.yml @@ -5,12 +5,9 @@ name: Hash Bags Linux build # - on PRs targeting dev/main (gates merges) # - manual via workflow_dispatch ("Run workflow" button in the UI) on: - # See note in build-android.yml about pull_request vs push triggers and - # Gitea Actions' from-fork secret stripping. Push-only here too for - # consistency (no secrets are required for Linux build today, but if we - # add any in future this avoids surprises). - push: - branches: [dev, main] + # Manual-only for now — auto-run on every push was too noisy. Trigger + # via Actions → "Hash Bags Linux build" → Run workflow when you want a + # build. Add `push:` back here if/when we want pre-merge validation. workflow_dispatch: concurrency: -- 2.50.1 (Apple Git-155) From bf2a35893d7ffda42d3199177875fb5df8a8988f Mon Sep 17 00:00:00 2001 From: jwinterm Date: Tue, 19 May 2026 08:02:33 -0400 Subject: [PATCH 2/2] CI: iOS workflows clone BitBox without running Android bindings build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit build_bindings.sh in bitbox_flutter unconditionally runs 'gomobile bind -target=android -androidapi 24' which produces an api.aar — needed only for Android. The Mac runner has no Android SDK, so gomobile fails with 'could not locate Android SDK'. iOS doesn't need the .aar. BitBox's iOS support is a separate native plugin under bitbox_flutter/ios/Classes/ + bitbox_flutter.podspec, linked via flutter pub get + pod install. We just need the directory present so the path-dep resolves. Replace the wrapper invocation in iOS workflows with the clone steps only; skip build_bindings.sh entirely. Android workflow keeps using the wrapper as-is. --- .github/workflows/build-ios-sim.yml | 16 ++++++++++++++-- .github/workflows/build-ios-testflight.yml | 13 +++++++++++-- 2 files changed, 25 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build-ios-sim.yml b/.github/workflows/build-ios-sim.yml index f5a934be..6bd3718b 100644 --- a/.github/workflows/build-ios-sim.yml +++ b/.github/workflows/build-ios-sim.yml @@ -125,11 +125,23 @@ jobs: rm reown_flutter.tar.gz popd - - name: Clone BitBox Flutter + - name: Clone BitBox Flutter (iOS — skip Android bindings) run: | + # Pubspec has bitbox_flutter as a path: dep at scripts/bitbox_flutter, + # so the directory must exist for pub get. The bundled build_bindings.sh + # runs `gomobile bind -target=android` which needs the Android SDK we + # don't have on the Mac runner — and the resulting .aar is Android-only. + # iOS uses bitbox_flutter's native ios/Classes plugin, no .aar required. set -x -e pushd scripts - ./build_bitbox_flutter.sh + if [[ ! -d bitbox_flutter ]]; then + git clone https://github.com/konstantinullrich/bitbox_flutter + fi + cd bitbox_flutter + git fetch -a + git reset --hard + git checkout 5a6e6dd388ef64003f86094af80d5453518b601d + git reset --hard popd # ---- Native crypto cores (monero_c prebuilt bundle) ------------------ diff --git a/.github/workflows/build-ios-testflight.yml b/.github/workflows/build-ios-testflight.yml index 27e818cd..f2492653 100644 --- a/.github/workflows/build-ios-testflight.yml +++ b/.github/workflows/build-ios-testflight.yml @@ -127,11 +127,20 @@ jobs: rm reown_flutter.tar.gz popd - - name: Clone BitBox Flutter + - name: Clone BitBox Flutter (iOS — skip Android bindings) run: | + # See note in build-ios-sim.yml — iOS uses bitbox's native plugin, + # not the .aar that build_bindings.sh generates. set -x -e pushd scripts - ./build_bitbox_flutter.sh + if [[ ! -d bitbox_flutter ]]; then + git clone https://github.com/konstantinullrich/bitbox_flutter + fi + cd bitbox_flutter + git fetch -a + git reset --hard + git checkout 5a6e6dd388ef64003f86094af80d5453518b601d + git reset --hard popd - name: Fetch prebuilt monero_c bundle -- 2.50.1 (Apple Git-155)