From af7b23156146cc2da4849ed4290f6882c650acba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=CE=9ET=CE=9ERNAL?=
 <137927782+particle-box@users.noreply.github.com>
Date: Fri, 16 Jan 2026 21:33:49 +0530
Subject: [PATCH] fix: signing

---
 .github/workflows/debug.yml | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/debug.yml b/.github/workflows/debug.yml
index 2be673be..2eb496f3 100644
--- a/.github/workflows/debug.yml
+++ b/.github/workflows/debug.yml
@@ -44,7 +44,15 @@ jobs:
           set -euo pipefail
           SIGNING_DIR="app/build/outputs/apk/armv8/debug"
           KEYSTORE_PATH="${SIGNING_DIR}/signingKey.jks"
-          echo "${SIGNING_KEY_BASE64}" | base64 -d > "${KEYSTORE_PATH}"
+          if [ -z "${SIGNING_KEY_BASE64}" ] || [ -z "${SIGNING_KEY_ALIAS}" ] || [ -z "${SIGNING_STORE_PASSWORD}" ] || [ -z "${SIGNING_KEY_PASSWORD}" ]; then
+            echo "Signing secrets are missing. Ensure PS_BASE_64, PS_RELEASE_KEY_ALIAS, PS_RELEASE_STORE_PASSWORD, PS_RELEASE_KEY_PASSWORD are set." >&2
+            exit 1
+          fi
+          printf '%s' "${SIGNING_KEY_BASE64}" | base64 --decode > "${KEYSTORE_PATH}"
+          if [ ! -s "${KEYSTORE_PATH}" ]; then
+            echo "Decoded keystore is empty or invalid." >&2
+            exit 1
+          fi
           APK_INPUT=$(ls "${SIGNING_DIR}"/*.apk | head -n 1)
           "${ANDROID_HOME}/build-tools/${BUILD_TOOLS_VERSION}/zipalign" -v 4 "${APK_INPUT}" "${SIGNING_DIR}/purrfectsnap-armv8Debug-aligned.apk"
           "${ANDROID_HOME}/build-tools/${BUILD_TOOLS_VERSION}/apksigner" sign \
@@ -107,7 +115,15 @@ jobs:
           set -euo pipefail
           SIGNING_DIR="app/build/outputs/apk/armv7/debug"
           KEYSTORE_PATH="${SIGNING_DIR}/signingKey.jks"
-          echo "${SIGNING_KEY_BASE64}" | base64 -d > "${KEYSTORE_PATH}"
+          if [ -z "${SIGNING_KEY_BASE64}" ] || [ -z "${SIGNING_KEY_ALIAS}" ] || [ -z "${SIGNING_STORE_PASSWORD}" ] || [ -z "${SIGNING_KEY_PASSWORD}" ]; then
+            echo "Signing secrets are missing. Ensure PS_BASE_64, PS_RELEASE_KEY_ALIAS, PS_RELEASE_STORE_PASSWORD, PS_RELEASE_KEY_PASSWORD are set." >&2
+            exit 1
+          fi
+          printf '%s' "${SIGNING_KEY_BASE64}" | base64 --decode > "${KEYSTORE_PATH}"
+          if [ ! -s "${KEYSTORE_PATH}" ]; then
+            echo "Decoded keystore is empty or invalid." >&2
+            exit 1
+          fi
           APK_INPUT=$(ls "${SIGNING_DIR}"/*.apk | head -n 1)
           "${ANDROID_HOME}/build-tools/${BUILD_TOOLS_VERSION}/zipalign" -v 4 "${APK_INPUT}" "${SIGNING_DIR}/purrfectsnap-armv7Debug-aligned.apk"
           "${ANDROID_HOME}/build-tools/${BUILD_TOOLS_VERSION}/apksigner" sign \