upload to Google Play with GitHub Actions, remove Bitrise (#4682)

closes https://github.com/tuskyapp/Tusky/issues/4236

I hope I did everything correctly, we will find out after this is
merged.

I am setting up the environment variables containing the keys so they
are only available to actions that need them.

This should be easier to maintain, GitHub seems to be faster then
Bitrise, and we no longer have two checks on every pull request.

.github/workflows/check-and-build.yml

@@ -1,15 +1,11 @@
-name: CI
+name: Check and build
 
 on:
-  push:
-    tags:
-      - '*'
   pull_request:
-  workflow_dispatch:
+  workflow_call:
 
 jobs:
   build:
-    name: Build
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -20,14 +16,11 @@ jobs:
           java-version: '21'
           distribution: 'temurin'
 
-      - name: Gradle Wrapper Validation
-        uses: gradle/actions/wrapper-validation@v4
-
       - name: Copy CI gradle.properties
         run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
 
       - name: Gradle Build Action
-        uses: gradle/gradle-build-action@v3
+        uses: gradle/actions/setup-gradle@v4
         with:
           cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/develop' }}
 

.github/workflows/deploy-release.yml

@@ -0,0 +1,45 @@
+# When a tag is created, create a release build and upload it to Google Play
+
+name: Deploy release to Google Play
+
+on:
+  push:
+    tags:
+      - '*'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ./.github/workflows/check-and-build.yml
+
+      - name: Build Blue aab
+        run: ./gradlew app:bundleBlueRelease
+
+      - uses: r0adkll/sign-android-release@f30bdd30588842ac76044ecdbd4b6d0e3e813478
+        name: Sign Tusky Blue aab
+        id: sign_aab
+        with:
+          releaseDirectory: app/build/outputs/bundle/blueRelease
+          signingKeyBase64: ${{ secrets.KEYSTORE }}
+          alias: ${{ secrets.KEY_ALIAS }}
+          keyStorePassword: ${{ secrets.KEYSTORE_PASSWORD }}
+          keyPassword: ${{ secrets.KEY_PASSWORD }}
+
+      - name: Generate whatsnew
+        id: generate-whatsnew
+        run: |
+          mkdir whatsnew
+          cp $(find fastlane/metadata/android/en-US/changelogs | sort -n -k6 -t/ | tail -n 1) whatsnew/whatsnew-en-US
+
+      - name: Upload AAB to Google Play
+        id: upload-release-asset-aab
+        uses: r0adkll/upload-google-play@v1.1.3
+        with:
+          serviceAccountJsonPlainText: ${{ secrets.SERVICE_ACCOUNT_JSON }}
+          packageName: com.keylesspalace.tusky
+          releaseFiles: ${{steps.sign_aab.outputs.signedReleaseFile}}
+          track: internal
+          whatsNewDirectory: whatsnew
+          status: completed
+          mappingFile: app/build/outputs/mapping/blueGoogleRelease/mapping.txt

.github/workflows/deploy-test.yml

@@ -0,0 +1,45 @@
+# Deploy Tusky Nightly on each push to develop
+
+name: Deploy Tusky Nightly to Google Play
+
+on:
+  push:
+    branches:
+      - develop
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ./.github/workflows/check-and-build.yml
+
+      - name: Build Green aab
+        run: ./gradlew app:bundleGreenRelease
+
+      - uses: r0adkll/sign-android-release@f30bdd30588842ac76044ecdbd4b6d0e3e813478
+        name: Sign Tusky Green aab
+        id: sign_aab
+        with:
+          releaseDirectory: app/build/outputs/bundle/greenRelease
+          signingKeyBase64: ${{ secrets.KEYSTORE }}
+          alias: ${{ secrets.KEY_ALIAS }}
+          keyStorePassword: ${{ secrets.KEYSTORE_PASSWORD }}
+          keyPassword: ${{ secrets.KEY_PASSWORD }}
+
+      - name: Generate whatsnew
+        id: generate-whatsnew
+        run: |
+          mkdir whatsnew
+          git log -3 --pretty=%B | head -c 500 > whatsnew/whatsnew-en-US
+
+      - name: Upload AAB to Google Play
+        id: upload-release-asset-aab
+        uses: r0adkll/upload-google-play@v1.1.3
+        with:
+          serviceAccountJsonPlainText: ${{ secrets.SERVICE_ACCOUNT_JSON }}
+          packageName: com.keylesspalace.tusky.test
+          releaseFiles: ${{steps.sign_aab.outputs.signedReleaseFile}}
+          track: production
+          whatsNewDirectory: whatsnew
+          status: completed
+          mappingFile: app/build/outputs/mapping/blueGoogleRelease/mapping.txt

.github/workflows/populate-gradle-build-cache.yml

@@ -1,34 +0,0 @@
-# Build the app on each push to `develop`, populating the build cache to speed
-# up CI on PRs.
-
-name: Populate build cache
-
-on:
-  push:
-    branches:
-      - develop
-
-jobs:
-  build:
-    name: app:buildGreenDebug
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-java@v4
-        with:
-          java-version: '21'
-          distribution: 'temurin'
-
-      - name: Gradle Wrapper Validation
-        uses: gradle/actions/wrapper-validation@v4
-
-      - name: Copy CI gradle.properties
-        run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
-
-      - uses: gradle/gradle-build-action@v3
-        with:
-          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/develop' }}
-
-      - name: Run app:buildGreenDebug
-        run: ./gradlew app:buildGreenDebug