From 734642b817c22ba366356088772acad7692be1c5 Mon Sep 17 00:00:00 2001
From: kuaifan <aipaw@live.cn>
Date: Tue, 20 Oct 2026 11:17:24 +0000
Subject: [PATCH] =?UTF-8?q?ci(app):=20APK=20=E7=AD=BE=E5=90=8D=E6=8C=87?=
 =?UTF-8?q?=E7=BA=B9=E6=A0=A1=E9=AA=8C=E5=85=BC=E5=AE=B9=E6=96=B0=E7=89=88?=
 =?UTF-8?q?=20apksigner=20=E8=BE=93=E5=87=BA=E6=A0=BC=E5=BC=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/app-build.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/app-build.yml b/.github/workflows/app-build.yml
index e97190fbb..13665dd07 100644
--- a/.github/workflows/app-build.yml
+++ b/.github/workflows/app-build.yml
@@ -191,7 +191,10 @@ jobs:
           apksigner=$(ls "$ANDROID_HOME"/build-tools/*/apksigner | sort -V | tail -1)
           "$apksigner" verify "$apk"
           if [ "$MODE" = release ]; then
-            actual=$("$apksigner" verify --print-certs "$apk" | sed -n 's/^Signer #1 certificate SHA-256 digest: //p' | head -1)
+            # 新版 apksigner 的行首可能是 "Signer #1" 或 "Signer (minSdkVersion=…)"，只按字段名匹配
+            certs=$("$apksigner" verify --print-certs "$apk")
+            echo "$certs" | grep -i 'certificate SHA-256 digest' || true
+            actual=$(echo "$certs" | grep -i -m1 'certificate SHA-256 digest:' | sed 's/.*: *//' | tr -d ': ' | tr 'A-F' 'a-f')
             expected=$(echo "$ANDROID_CERT_SHA256" | tr -d ':' | tr 'A-F' 'a-f')
             if [ "$actual" != "$expected" ]; then
               echo "::error::APK 签名证书与正式包不一致（$actual），无法覆盖升级"