Block pre release upload on device test completion

.github/workflows/build.yml

@@ -37,40 +37,7 @@ jobs:
             app/build/outputs/apk/debug/app-debug.apk
             app/build/outputs/apk/androidTest/debug/app-debug-androidTest.apk
 
-      - name: Decode Keystore
-        if: github.event_name != 'pull_request'
-        env:
-          ENCODED_RELEASE_KEYSTORE: ${{ secrets.ENCODED_RELEASE_KEYSTORE }}
-        run: echo $ENCODED_RELEASE_KEYSTORE | base64 -d > keystore
-
-      - name: Build & Assemble Release APK
-        if: github.event_name != 'pull_request'
-        env:
-          VERSION_CODE: ${{ github.run_number }}
-          RELEASE_KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
-          RELEASE_KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
-        run: |
-          ./gradlew assembleRelease
-
-      - name: Install Firebase CLI
-        if: github.event_name != 'pull_request'
-        run: npm install -g firebase-tools
-
-      - name: Decode Firebase Service Account JSON
-        if: github.event_name != 'pull_request'
-        run: echo ${{ secrets.FIREBASE_SERVICE_ACCOUNT_BASE_64 }} | base64 -d > service_account.json
-
-      - name: Deploy to Firebase
-        if: github.event_name != 'pull_request'
-        env:
-          GOOGLE_APPLICATION_CREDENTIALS: service_account.json
-        run: firebase appdistribution:distribute app/build/outputs/apk/release/app-release.apk --app ${{ secrets.FIREBASE_APP_ID }} --groups "internal"
-
-      - name: Upload to Play Store
-        if: github.event_name != 'pull_request'
-        uses: r0adkll/upload-google-play@v1
-        with:
-          serviceAccountJsonPlainText: ${{ secrets.PLAY_STORE_CREDENTIALS }}
-          packageName: com.willowtree.vocable
-          releaseFiles: app/build/outputs/apk/release/app-release.apk
-          track: alpha
+  pre-release-upload:
+    needs: build
+    if: github.event_name != 'pull_request'
+    uses: ./.github/workflows/pre-release-upload.yml

.github/workflows/device-tests.yml

@@ -1,19 +1,26 @@
 name: Run Device Tests
+# Run device tests using Firebase Test Lab
+#
+# This action is separated so that it can run on PRs coming from forks, without
+# giving those forks access to our repository secrets, which are necessary to run against Firebase.
+# There is also additional configuration so this workflow can be reused in our main workflow and block
+# deployments on UI test results.
 
-# read-write repo token
-# access to secrets
 on:
   workflow_run:
     workflows: ["Build & Test Project"]
+    branches-ignore: [main]
     types:
       - completed
+  workflow_call:
 
 jobs:
   device-tests:
     runs-on: ubuntu-20.04
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     steps:
       - uses: haya14busa/action-workflow_run-status@v1
+        if: ${{ github.event_name == 'workflow_run' }}
       - uses: actions/download-artifact@v4
         with:
           run-id: ${{github.event.workflow_run.id }}

.github/workflows/pre-release-upload.yml

@@ -0,0 +1,42 @@
+name: Pre-Release Upload
+
+on:
+  workflow_call:
+
+jobs:
+  pre-release-upload:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: ./.github/workflows/device-tests.yml
+
+      - name: Decode Keystore
+        env:
+          ENCODED_RELEASE_KEYSTORE: ${{ secrets.ENCODED_RELEASE_KEYSTORE }}
+        run: echo $ENCODED_RELEASE_KEYSTORE | base64 -d > keystore
+
+      - name: Build & Assemble Release APK
+        env:
+          VERSION_CODE: ${{ github.run_number }}
+          RELEASE_KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
+          RELEASE_KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
+        run: |
+          ./gradlew assembleRelease
+
+      - name: Install Firebase CLI
+        run: npm install -g firebase-tools
+
+      - name: Decode Firebase Service Account JSON
+        run: echo ${{ secrets.FIREBASE_SERVICE_ACCOUNT_BASE_64 }} | base64 -d > service_account.json
+
+      - name: Deploy to Firebase
+        env:
+          GOOGLE_APPLICATION_CREDENTIALS: service_account.json
+        run: firebase appdistribution:distribute app/build/outputs/apk/release/app-release.apk --app ${{ secrets.FIREBASE_APP_ID }} --groups "internal"
+
+      - name: Upload to Play Store
+        uses: r0adkll/upload-google-play@v1
+        with:
+          serviceAccountJsonPlainText: ${{ secrets.PLAY_STORE_CREDENTIALS }}
+          packageName: com.willowtree.vocable
+          releaseFiles: app/build/outputs/apk/release/app-release.apk
+          track: alpha