The migration of jobs from Binary Factory to KDE's GitLab continues. Last week almost all jobs that built APKs were migrated to invent.kde.org. The only remaining Android job on Binary Factory doesn't use Craft.

The Android APK jobs running on invent are the first jobs that make use of our CI Notary Services delegating tasks that require sensitive information (e.g. the keys to sign the APKs or the credentials to upload the APKs to our F-Droid repositories) to services running outside of GitLab. Currently, the apksigner service and the fdroidpublisher service are live. The configuration of the services can be found in the sysadmin/ci-utilities repository.

As before, the APKs are published in our F-Droid repositories:

• KDE Android Release Builds provides APKs built from the 23.08 branches.
• KDE Android Nightly Builds provides APKs built from the master branches.

Many apps have already switched from Qt 5 to Qt 6, but the Qt 6 APKs are not yet ready for public consumption. Not even as nightly builds. Therefore many "nightly" builds are many weeks old.

The migration to invent has a few implications. On Binary Factory all APKs (release and nightly) were rebuilt once a day even if nothing changed. On invent the APKs are rebuilt whenever a change is pushed to the release/23.08 branch or the master branch of a project. Another change is that on invent any KDE developer can manually trigger a new pipeline to build the APKs (e.g. if a bug in a dependency was fixed). On Binary Factory you often needed to ask someone to trigger a build for you.

Building APKs
If you want to start building APKs for your project then add the craft-android-apks.yml template for Qt 5 or the craft-android-qt6-apks.yml template for Qt 6 to the .gitlab-ci-yml of your project. Note that you must use the include:project format (example).

The jobs will build unsigned APKs. To enable signing your project (more precisely, a branch of your project) needs to be cleared for using the signing service. This is done by adding your project to the project settings of the apksigner. The master branch is cleared by default for all applications listed in the project settings, so that you only need to add two lines: The repo path on invent and the ID of your application. The key used to sign your application will best be created by us directly on the machine that does the signing.

Once you think the APKs are ready for publication you can enable publishing in our F-Droid repositories by adding your project to the project settings of the fdroidpublisher. Because some Qt 6 APKs are not yet ready for publication although their build succeeds, by default the master branch is not cleared for publishing. This means you will have to add five lines to the project settings of fdroidpublisher.

Outlook
To complete the Android jobs/services a job/service for submitting APKs to Google Play will go live soon. It's currently only used by Itinerary but, in view of our Make a Living initiative, we hope to publish more apps on Google Play to create some revenue to fund our work. Creating and publishing Android Application Bundles (AAB), the new packaging format required for new applications published on Google Play, will follow soon after.

Then we'll add signing of Windows artifacts and installers and submission to the Microsoft Store, signing and publishing of Flatpaks, and signing and publishing of builds for macOS.