[CI]: add android build key + signing process

.github/workflows/plugin-apk.yml

@@ -48,9 +48,18 @@ jobs:
 
       - name: Build plugin APK
         run: gradle --no-daemon -p android-plugin :app:assembleRelease
+        env:
+          SIGNING_STORE_PASSWORD: ${{ secrets.SIGNING_STORE_PASSWORD }}
+          SIGNING_KEY_ALIAS: ${{ secrets.SIGNING_KEY_ALIAS }}
+          SIGNING_KEY_PASSWORD: ${{ secrets.SIGNING_KEY_PASSWORD }}
+
+      - name: Verify signed APK
+        run: |
+          APKSIGNER="$(find "$ANDROID_HOME/build-tools" -name apksigner -type f | sort -V | tail -n 1)"
+          "$APKSIGNER" verify --verbose android-plugin/app/build/outputs/apk/release/app-release.apk
 
       - name: Upload plugin APK
         uses: actions/upload-artifact@v4
         with:
           name: MobileGL-plugin-${{ env.date_today }}-${{ env.short_sha }}
-          path: android-plugin/app/build/outputs/apk/release/*.apk
+          path: android-plugin/app/build/outputs/apk/release/app-release.apk

android-plugin/app/build.gradle

@@ -9,6 +9,14 @@ def mobileGlEnv = [
 ]
 
 def mobileGlEnvString = mobileGlEnv.collect { key, value -> "${key}=${value}" }.join(':')
+def signingStoreFile = file('../keystore.jks')
+def signingStorePassword = System.getenv('SIGNING_STORE_PASSWORD')
+def signingKeyAlias = System.getenv('SIGNING_KEY_ALIAS')
+def signingKeyPassword = System.getenv('SIGNING_KEY_PASSWORD')
+def releaseSigningReady = signingStoreFile.exists()
+        && signingStorePassword
+        && signingKeyAlias
+        && signingKeyPassword
 
 android {
     namespace 'top.mobilegl.plugin'
@@ -34,9 +42,23 @@ android {
         ]
     }
 
+    if (releaseSigningReady) {
+        signingConfigs {
+            release {
+                storeFile signingStoreFile
+                storePassword signingStorePassword
+                keyAlias signingKeyAlias
+                keyPassword signingKeyPassword
+            }
+        }
+    }
+
     buildTypes {
         release {
             minifyEnabled false
+            if (releaseSigningReady) {
+                signingConfig signingConfigs.release
+            }
         }
     }