Android app signing using Google Play App Signing

[bqubique]

If you are looking for help, please confirm the following...

• I confirm I have searched the Docs, Codemagic Sample Projects, and GitHub Discussions.
• I confirm the software versions on my local computer match the ones in CI environment (e.g. Xcode version, Gradle version). See here
• I confirm I am able to do a fresh clone of the repository and build the project on my local computer.

Which mobile framework are you using?

Flutter (Dart)

Steps to reproduce

If we have enabled Google Play App Signing to manage the signing keys itself instead of uploading our own keystore, how are we supposed to enable this with Codemagic CI?

We can technically download the deployment_certificate.der from Play Store Console Release->Setup->App Signing
and I tried generating a .jks keystore using it with this command:

keytool -import -v -trustcacerts \ 
-alias ALIAS \
-file deployment_cert.der \
-keystore cacerts_deployment.jks \
-keypass KEY_PASSWORD

and tried it with both Deployment Certificate and App signing key certificate (which are both downloadable using Play Store console - picture above).

My build.gradle is set up correctly according to Codemagic's docs:

...
signingConfigs {
       release {
        if (System.getenv()["CI"]) { // CI=true is exported by Codemagic
            storeFile file(System.getenv()["CM_KEYSTORE_PATH"])
            storePassword System.getenv()["CM_KEYSTORE_PASSWORD"]
            keyAlias System.getenv()["CM_KEY_ALIAS"]
            keyPassword System.getenv()["CM_KEY_PASSWORD"]
        } else {
            keyAlias keystoreProperties['keyAlias']
            keyPassword keystoreProperties['keyPassword']
            storeFile keystoreProperties['storeFile'] ? file(keystoreProperties['storeFile']) : null
            storePassword keystoreProperties['storePassword']
        }
       }
   }

buildTypes {
       release {
           signingConfig signingConfigs.release
           minifyEnabled true
           shrinkResources true

           proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro' 
           signingConfig signingConfigs.release

       }
   }
...

What would be the correct flow to carry out this?

Expected results

A way to use Google's Play App Signing feature (?).

Actual results

Unable to sign bundle /Users/builder/clone/build/app/outputs/bundle/devDebug/app-dev-debug.aab

Failed to sign artifact app-dev-debug.aab. Failed to sign Android app bundle: 

Build failed :|
Failed to sign artifacts

Build id (optional)

66e28d50b314de02d4ecb0b7

[dtrdic]

hey @bqubique please make sure you have set your signing configuration in app level build.gradle like this..
And make sure you have added the buildTypes section as well

...
android {
    ...
    defaultConfig { ... }
    signingConfigs {
        release {
            if (System.getenv()["CI"]) { // CI=true is exported by Codemagic
                storeFile file(System.getenv()["CM_KEYSTORE_PATH"])
                storePassword System.getenv()["CM_KEYSTORE_PASSWORD"]
                keyAlias System.getenv()["CM_KEY_ALIAS"]
                keyPassword System.getenv()["CM_KEY_PASSWORD"]
            } else {
                keyAlias keystoreProperties['keyAlias']
                keyPassword keystoreProperties['keyPassword']
                storeFile keystoreProperties['storeFile'] ? file(keystoreProperties['storeFile']) : null
                storePassword keystoreProperties['storePassword']
            }
        }
    }
    buildTypes {
        release {
            ...
            signingConfig signingConfigs.release
        }
    }
}
...

[bqubique]

@dtrdic thanks. Yes, all of them are handled as you mentioned. The hidden tag did not have the build.gradle formatted correctly, so I edited my question and added all the details in there. All of the things you mentioned were already as you said!

[dtrdic]

@bqubique in your build types section you have set signingConfig signingConfigs.release two times.
And also you are trying to build in debug mode, please change it to release mode in workflow editor

[bqubique]

Thanks for the heads-up @dtrdic, trying your solution as we speak, will update you in a few moments (66e2a43d206d4f135c653389)

[bqubique]

@dtrdic nope it did not work, tried uploading the keystore again, but now it gives me another error:

Failed to read key key0 from store

[bqubique]

@dtrdic so, now I re-uploaded my .jks keystore file, and it seems that I now ran into 403, which is documented here.
We will re-try creating a service account for this and come back if there's anything else that needs clarification.
Thank you!

[bqubique]

@dtrdic all good now. I don't know why and how, but maybe just selecting the Release from the available Modes was the magic.

Thank you!