From dd525baf88f5958745c2b52a8cfafa81eb9238c9 Mon Sep 17 00:00:00 2001
From: FooIbar <118464521+FooIbar@users.noreply.github.com>
Date: Tue, 6 Aug 2024 21:33:46 +0800
Subject: [PATCH] Use encoded token to avoid detection & revocation (#1492)

---
 .github/workflows/ci.yml                                 | 4 ----
 .github/workflows/releases.yml                           | 2 --
 app/build.gradle.kts                                     | 5 -----
 .../main/kotlin/com/hippo/ehviewer/updater/AppUpdater.kt | 9 ++++++++-
 4 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4d6c52b4a..a1cb0f25d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -84,8 +84,6 @@ jobs:
           restore-keys: cmake-default-
 
       - name: Build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GithubToken }}
         run: ./gradlew assembleDefaultRelease
 
       - name: Upload ARM64
@@ -154,8 +152,6 @@ jobs:
           restore-keys: cmake-marshmallow-
 
       - name: Build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GithubToken }}
         run: ./gradlew assembleMarshmallowRelease
 
       - name: Upload ARM64
diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml
index bb29dfb1b..e9ed6e19d 100644
--- a/.github/workflows/releases.yml
+++ b/.github/workflows/releases.yml
@@ -53,8 +53,6 @@ jobs:
           -Pandroid.testoptions.manageddevices.emulator.gpu="swiftshader_indirect"
 
       - name: Build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GithubToken }}
         run: ./gradlew assembleRelease
 
       - name: Rename Apks
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 9aa6e6a5e..df9ae9265 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -1,4 +1,3 @@
-import com.android.build.gradle.internal.cxx.configure.gradleLocalProperties
 import com.mikepenz.aboutlibraries.plugin.DuplicateMode.MERGE
 import com.mikepenz.aboutlibraries.plugin.DuplicateRule.GROUP
 import org.jetbrains.kotlin.compose.compiler.gradle.ComposeFeatureFlag
@@ -65,9 +64,6 @@ android {
     val chromeVersion = rootProject.layout.projectDirectory.file("chrome-for-testing/LATEST_RELEASE_STABLE").asFile
         .readText().substringBefore('.')
 
-    val githubToken = gradleLocalProperties(rootDir, providers)["GITHUB_TOKEN"] as? String
-        ?: System.getenv("GITHUB_TOKEN").orEmpty()
-
     defaultConfig {
         applicationId = "moe.tarsin.ehviewer"
         minSdk = 26
@@ -96,7 +92,6 @@ android {
         buildConfigField("long", "COMMIT_TIME", commitTime)
         buildConfigField("String", "REPO_NAME", "\"$repoName\"")
         buildConfigField("String", "CHROME_VERSION", "\"$chromeVersion\"")
-        buildConfigField("String", "GITHUB_TOKEN", "\"$githubToken\"")
         ndk {
             if (isRelease) {
                 abiFilters.addAll(supportedAbis)
diff --git a/app/src/main/kotlin/com/hippo/ehviewer/updater/AppUpdater.kt b/app/src/main/kotlin/com/hippo/ehviewer/updater/AppUpdater.kt
index f69ca410b..9cc5ae9f1 100644
--- a/app/src/main/kotlin/com/hippo/ehviewer/updater/AppUpdater.kt
+++ b/app/src/main/kotlin/com/hippo/ehviewer/updater/AppUpdater.kt
@@ -84,9 +84,16 @@ object AppUpdater {
 }
 
 private suspend inline fun ghStatement(url: String) = ktorClient.prepareGet(url) {
-    header("Authorization", "Bearer ${BuildConfig.GITHUB_TOKEN}")
+    header("Authorization", GithubTokenParts.joinToString("_"))
 }
 
+private val GithubTokenParts = arrayOf(
+    "github",
+    "pat",
+    "11A4H2ACI04oacouUsibSx",
+    "QYqH5WhdRjJUSmezj3vex9sQLZC8vSrL4VXPxDcwfhcWLQFH6H3L0tDYupr",
+)
+
 data class Release(
     val version: String,
     val changelog: String,