Guardsquare / appsweep-gradle

This Gradle plugin can be used to continuously integrate app scanning using AppSweep into your Android app build process
http://guardsquare.com/appsweep-mobile-application-security-testing
Apache License 2.0
47 stars 3 forks source link

How to upload APK or AAB file using the plugin #4

Closed ArcherEmiya05 closed 2 years ago

ArcherEmiya05 commented 2 years ago

Good day we have use case in our CI CD setup where we build debug APK file, now we want to use this APK file instead of building another one with uploadToAppSweepDebug to save build minute. We also want to know how to upload AAB instead of APK for release build as the documentation currently did not mention it. Thanks a lot!

Masrepus commented 2 years ago

While AppSweep also supports AAB files, our Gradle plugin currently only uploads APK files. For your scan results this should not make a difference however, as the difference between the two formats is mostly just the way your app's components are organized.

Regarding your CI setup, we checked this locally, and if you build a debug APK using the assembleDebug Gradle task, the uploadToAppSweepDebug task reuses the cached results from this task and doesn't run everything again. In a CI setup this might vary, so your safest bet to make sure the tasks aren't executed multiple times is to run them in the same Gradle command: ./gradlew :app:assembleDebug :app:uploadToAppSweepDebug

ArcherEmiya05 commented 2 years ago

While AppSweep also supports AAB files, our Gradle plugin currently only uploads APK files. For your scan results this should not make a difference however, as the difference between the two formats is mostly just the way your app's components are organized.

Regarding your CI setup, we checked this locally, and if you build a debug APK using the assembleDebug Gradle task, the uploadToAppSweepDebug task reuses the cached results from this task and doesn't run everything again. In a CI setup this might vary, so your safest bet to make sure the tasks aren't executed multiple times is to run them in the same Gradle command: ./gradlew :app:assembleDebug :app:uploadToAppSweepDebug

Thanks for the response, however we are using AAB file to automatically publish our app to the store. Can we use that AAB file with uploadToAppSweepRelease instead of building another release for APK?

Masrepus commented 2 years ago

Ah I see, that's indeed a use case where the AppSweep task would create an extra build. We're investigating how to add AAB support to our Gradle plugin and will make sure to update you when that has been implemented, so that extra APK builds won't be necessary in the future

ArcherEmiya05 commented 2 years ago

Thanks a lot! That would be very nice to have, something similar to what you just said for the debug build we could just have something like ./gradlew :app:publishReleaseBundle :app:uploadToAppSweepRelease which is ideal when releasing to internal track so we could examine it more before actually promoting it to production track.

Masrepus commented 2 years ago

The new 1.1.0 release should support your workflow now: Using the ./gradlew :app:publishReleaseBundle :app:uploadToAppSweepReleaseBundle command will not have to build an APK anymore. To use this version, make sure to use latest.release or 1.1.0 when including the AppSweep plugin

ArcherEmiya05 commented 2 years ago

The new 1.1.0 release should support your workflow now: Using the ./gradlew :app:publishReleaseBundle :app:uploadToAppSweepReleaseBundle command will not have to build an APK anymore. To use this version, make sure to use latest.release or 1.1.0 when including the AppSweep plugin

Finally! Thanks a lot! This made our week great.

ArcherEmiya05 commented 2 years ago

While AppSweep also supports AAB files, our Gradle plugin currently only uploads APK files. For your scan results this should not make a difference however, as the difference between the two formats is mostly just the way your app's components are organized.

Regarding your CI setup, we checked this locally, and if you build a debug APK using the assembleDebug Gradle task, the uploadToAppSweepDebug task reuses the cached results from this task and doesn't run everything again. In a CI setup this might vary, so your safest bet to make sure the tasks aren't executed multiple times is to run them in the same Gradle command: ./gradlew :app:assembleDebug :app:uploadToAppSweepDebug

Follow up question, can we define a path of APK to be uploaded explicitly with the plugin?

Masrepus commented 2 years ago

This is not possible right now, although it also shouldn't be necessary. If you don't heavily deviate from the standard Android build process, the existing AppSweep Gradle tasks will cover all of the artifacts being built, even if you use additional tools such as R8, ProGuard or DexGuard to shrink or obfuscate your app. What reason would you see for needing to specify a custom path?

ArcherEmiya05 commented 2 years ago

This is not possible right now, although it also shouldn't be necessary. If you don't heavily deviate from the standard Android build process, the existing AppSweep Gradle tasks will cover all of the artifacts being built, even if you use additional tools such as R8, ProGuard or DexGuard to shrink or obfuscate your app. What reason would you see for needing to specify a custom path?

Hmm, probably useful or good to have option when you want to upload existing artifact stored in different directories.

Masrepus commented 2 years ago

If you come across a use case for this at some point feel free to open another issue, then we'll be happy to evaluate if such an option should be integrated!

ArcherEmiya05 commented 2 years ago

If you come across a use case for this at some point feel free to open another issue, then we'll be happy to evaluate if such an option should be integrated!

Great! Thanks a lot!