CI: fix Play Console edit auth scope and silent versionCode fallback - #685
Merged
Mansimran Singh (Mansimran-Singh) merged 1 commit intoAug 19, 2026
Merged
Conversation
The real 2026-08-19 dry run (PR #684, pre-release-upload.yml) got past the APK/bundle mismatch but failed on "Version code 31 has already been used." The log showed the actual cause: get-next-version-code.sh printed "Failed to create a Play Console edit for com.willowtree.vocable" and produced no output, but the calling step still reported success — `echo "value=$(script)" >> "$GITHUB_OUTPUT"` swallows the inner command's exit code because echo itself always succeeds. Downstream, build.gradle.kts's `System.getenv("VERSION_CODE")?.toIntOrNull() ?: 1` fell back to 1, and its legacy `+ 30` offset landed on exactly the already-published version code (31) — a coincidence that made the failure look like a version-code bug rather than an auth bug. Root cause of the edit-creation failure: the `google-github-actions/auth` step never set `access_token_scopes`, so it defaults to the generic `cloud-platform` scope, which the Android Publisher API's edits.insert call rejects — it needs the `androidpublisher` scope specifically. The later r0adkll/upload-google-play step works today because it authenticates independently from the raw service account JSON with the correct scope built in, masking this from the earlier failure. Fixes: - Set access_token_scopes to https://www.googleapis.com/auth/androidpublisher on the auth step in both workflows. - Assign the script's output to a variable before writing it to GITHUB_OUTPUT, so a real failure aborts the step instead of silently falling back to versionCode 1. Related to #626.
Mansimran Singh (Mansimran-Singh)
requested review from
Michael Gonzalez (MicGon7) and
dlucci-wt
as code owners
August 19, 2026 16:46
Mansimran Singh (Mansimran-Singh)
deleted the
feature/626/fix-version-code-edit-auth
branch
August 19, 2026 17:18
12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Version code 31 has already been used.The actual cause, visible in the run log, wasget-next-version-code.shfailing to create a Play Console edit (Failed to create a Play Console edit for com.willowtree.vocable) and silently falling back toversionCode = 1 + 30 = 31viabuild.gradle.kts's legacy+ 30offset — landing exactly on an already-used code by coincidence.google-github-actions/authstep in both workflows never setaccess_token_scopes, defaulting to the genericcloud-platformscope, which the Android Publisher API'sedits.insertcall rejects. It needs theandroidpublisherscope specifically. (The laterr0adkll/upload-google-playstep works today because it authenticates independently from the raw service account JSON with the correct scope baked in — that's why this was masked until the version-code step ran.)echo "value=$(script)" >> "$GITHUB_OUTPUT"always reports success becauseechoitself succeeds even when the substituted command fails. Now assigns to a variable first so a real failure aborts the step loudly instead of silently defaulting to versionCode 1.Ticket
Related to #626
Type of Change
Testing
CI workflow config only, no unit-testable logic. Verified by reading the actual failed run's log (
gh run view <id> --log) to confirm the edit-creation failure and the emptyVERSION_CODEenv var reaching the build step. The real validation happens on the next merge tomain, which triggerspre-release-upload.ymlautomatically.Checklist
./gradlew testDebug)