DevOps and Security (DevOps 与资安)

Instructions

• 仅在发布准备或流程自动化需求时使用

• 先填写 Required Inputs（CI 平台、签章策略、密钥来源）

• 依照下方章节顺序套用

• 一次只处理一个 pipeline 或安全措施

• 完成后对照 Quick Checklist

When to Use

• Scenario E：App 发布准备

Example Prompts

• "请依照 Build Speed Optimization，调整 Gradle 设置"

• "用 CI Quality Gates 章节创建 GitHub Actions"

• "请参考 Security Hardening，检查 secrets 与网络安全"

Workflow

• 先确认 Required Inputs（CI provider、发布渠道、secret 管理）

• 创建 Build Speed 与 CI Quality Gates

• 导入 Fastlane 与 Security Hardening

• 执行 Delivery Gate 并记录发布演练结果

• 用 Quick Checklist 验收

Practical Notes (2026)

• 依赖来源与版本必有审核与锁定策略

• Secrets 仅能通过环境变量或安全保存

• CI Gate 必含 Lint/Detekt/Test/Build

• Pipeline 失败要可重现，禁止人工临时绕过

• 发布流程至少每月 dry-run 一次，避免到发布日失效

Minimal Template

目标: CI Gate: CI Provider: Secrets 来源: 安全措施: 发版流程: 验收: Quick Checklist

Required Inputs (执行前输入)

• CI provider （GitHub Actions / GitLab CI / Jenkins）

• 发布渠道 （Play Internal/Alpha/Production）

• Secret 管理策略 （CI Secret / Vault / KMS）

• 签章策略 （keystore 来源、轮换周期）

• 阻挡条件 （哪些任务失败即阻挡发布）

Deliverables (完成后交付物)

• 可执行 CI pipeline （lint/detekt/test/assemble）

• 发布流水线 （Fastlane 或等效脚本）

• 安全加固配置 （Network Security / Pinning / Secret policy）

• 告警与追踪 （失败通知、日志可追溯）

• 发布演练记录 （dry-run 结果）

Delivery Gate (验收门槛)

./gradlew lint detekt test assemble ./gradlew bundleRelease

若使用 Fastlane，需补跑 fastlane lane 的 dry-run 或 internal track 发布演练。

Build Speed Optimization

Configuration Cache

// gradle.properties org.gradle.configuration-cache=true org.gradle.configuration-cache.problems=warn

Build Cache

// settings.gradle.kts buildCache { local { directory = File(rootDir, "build-cache") removeUnusedEntriesAfterDays = 7 }

// 企业级：Remote cache
remote<HttpBuildCache> {
    url = uri("https://cache.example.com/")
    isPush = System.getenv("CI") != null
}

}

Parallel Execution

// gradle.properties org.gradle.parallel=true org.gradle.caching=true org.gradle.jvmargs=-Xmx4g -XX:+HeapDumpOnOutOfMemoryError

CI Quality Gates

GitHub Actions 范例

name: Android CI

on: pull_request: branches: [main, develop]

jobs: quality: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4

  - name: Setup JDK
    uses: actions/setup-java@v4
    with:
      java-version: '17'
      distribution: 'temurin'
  
  - name: Lint
    run: ./gradlew lintDebug
  
  - name: Detekt
    run: ./gradlew detekt
  
  - name: Unit Tests
    run: ./gradlew testDebugUnitTest
  
  - name: Build
    run: ./gradlew assembleDebug

Danger for PR Review

Dangerfile

APK Size Check

apk_size = File.size("app/build/outputs/apk/debug/app-debug.apk") / 1024.0 / 1024.0 warn "APK size is #{apk_size.round(2)}MB" if apk_size > 50

Kotlin Files changed

kotlin_files = git.modified_files.select { |f| f.end_with?(".kt") } warn "Large PR with #{kotlin_files.count} Kotlin files" if kotlin_files.count > 20

Fastlane Automation

Fastfile

default_platform(:android)

platform :android do

desc "Deploy to Play Store Internal Track" lane :internal do gradle(task: "bundleRelease") upload_to_play_store( track: "internal", aab: "app/build/outputs/bundle/release/app-release.aab" ) end

desc "Promote Internal to Production" lane :promote do upload_to_play_store( track: "internal", track_promote_to: "production", skip_upload_apk: true, skip_upload_aab: true ) end end

Security Hardening

Secrets Management

// ❌ 不要把真实密钥写进 BuildConfig / strings.xml / assets // ✅ 用 secrets-gradle-plugin 管理「可公开但需分环境」的配置 // build.gradle.kts plugins { id("com.google.android.libraries.mapsplatform.secrets-gradle-plugin") }

secrets { propertiesFileName = "secrets.properties" // 本地/CI 注入，不进版控 defaultPropertiesFileName = "local.defaults.properties" // 可提交的占位值 }

// 真正敏感凭证：由后端签发短时 token，不内置在 APK interface TokenApi { suspend fun getEphemeralToken(): String }

secrets.properties local.properties

Certificate Pinning

// OkHttp val certificatePinner = CertificatePinner.Builder() .add("example.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=") .build()

val client = OkHttpClient.Builder() .certificatePinner(certificatePinner) .build()

Root Detection

class RootDetection { fun isDeviceRooted(): Boolean { return checkRootBinaries() || checkSuExists() || checkRootCloaking() }

private fun checkRootBinaries(): Boolean {
    val paths = arrayOf("/system/bin/su", "/system/xbin/su", "/sbin/su")
    return paths.any { File(it).exists() }
}

}

Network Security Config

<!-- res/xml/network_security_config.xml --> <network-security-config> <base-config cleartextTrafficPermitted="false"> <trust-anchors> <certificates src="system" /> </trust-anchors> </base-config>

<domain-config>
    <domain includeSubdomains="true">example.com</domain>
    <pin-set>
        <pin digest="SHA-256">...</pin>
    </pin-set>
</domain-config>

</network-security-config>

Quick Checklist

• Required Inputs 已填写并冻结（CI/发布/密钥策略）

• Build Cache 激活 (Local + Remote)

• CI 包含 Lint, Detekt, Unit Test

• Fastlane 自动化部署

• Secrets 不进版控

• Certificate Pinning 激活

• Network Security Config 禁止 Cleartext

• Delivery Gate 已执行并通过