From 999865fe3d8ca803a1504fcc75b58c14c126aa7e Mon Sep 17 00:00:00 2001 From: Mansimran Singh Date: Wed, 19 Aug 2026 12:46:11 -0400 Subject: [PATCH] Fix Play Console edit auth scope and silent versionCode fallback MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The real 2026-08-19 dry run (PR #684, pre-release-upload.yml) got past the APK/bundle mismatch but failed on "Version code 31 has already been used." The log showed the actual cause: get-next-version-code.sh printed "Failed to create a Play Console edit for com.willowtree.vocable" and produced no output, but the calling step still reported success — `echo "value=$(script)" >> "$GITHUB_OUTPUT"` swallows the inner command's exit code because echo itself always succeeds. Downstream, build.gradle.kts's `System.getenv("VERSION_CODE")?.toIntOrNull() ?: 1` fell back to 1, and its legacy `+ 30` offset landed on exactly the already-published version code (31) — a coincidence that made the failure look like a version-code bug rather than an auth bug. Root cause of the edit-creation failure: the `google-github-actions/auth` step never set `access_token_scopes`, so it defaults to the generic `cloud-platform` scope, which the Android Publisher API's edits.insert call rejects — it needs the `androidpublisher` scope specifically. The later r0adkll/upload-google-play step works today because it authenticates independently from the raw service account JSON with the correct scope built in, masking this from the earlier failure. Fixes: - Set access_token_scopes to https://www.googleapis.com/auth/androidpublisher on the auth step in both workflows. - Assign the script's output to a variable before writing it to GITHUB_OUTPUT, so a real failure aborts the step instead of silently falling back to versionCode 1. Related to #626. --- .github/workflows/pre-release-upload.yml | 4 +++- .github/workflows/ps-release.yml | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pre-release-upload.yml b/.github/workflows/pre-release-upload.yml index 674fbf51..df8b2684 100644 --- a/.github/workflows/pre-release-upload.yml +++ b/.github/workflows/pre-release-upload.yml @@ -36,11 +36,13 @@ jobs: uses: google-github-actions/auth@v2 with: credentials_json: ${{ secrets.PLAY_STORE_CREDENTIALS }} + access_token_scopes: https://www.googleapis.com/auth/androidpublisher - name: Compute next versionCode id: version_code run: | - echo "value=$(./scripts/get-next-version-code.sh com.willowtree.vocable)" >> "$GITHUB_OUTPUT" + value=$(./scripts/get-next-version-code.sh com.willowtree.vocable) + echo "value=$value" >> "$GITHUB_OUTPUT" - name: Build & Assemble Release APK/Bundle env: diff --git a/.github/workflows/ps-release.yml b/.github/workflows/ps-release.yml index 29680aaa..826ce9c1 100644 --- a/.github/workflows/ps-release.yml +++ b/.github/workflows/ps-release.yml @@ -44,11 +44,13 @@ jobs: uses: google-github-actions/auth@v2 with: credentials_json: ${{ secrets.PLAY_STORE_CREDENTIALS }} + access_token_scopes: https://www.googleapis.com/auth/androidpublisher - name: Compute next versionCode id: version_code run: | - echo "value=$(./scripts/get-next-version-code.sh com.willowtree.vocable)" >> "$GITHUB_OUTPUT" + value=$(./scripts/get-next-version-code.sh com.willowtree.vocable) + echo "value=$value" >> "$GITHUB_OUTPUT" - name: Build & Assemble Release APK/Bundle env: