ci: add a signed release-APK workflow

[1a1a11a]

Summary

Adds a CI pipeline that builds a signed release APK and publishes it, so a release artifact can be produced on demand. (The APK is built by CI — it needs the Android SDK, which isn't in the dev sandbox.)

Changes

• .github/workflows/release.yml — builds :app:assembleRelease, signs it, and:
  • on a v* tag push → publishes a GitHub Release with the APK attached;
  • via manual dispatch → uploads the signed APK as a workflow artifact.
• app/build.gradle.kts — release buildType now uses an env-driven signing config (KEYSTORE_FILE/KEYSTORE_PASSWORD/KEY_ALIAS/KEY_PASSWORD). When those are unset (e.g. a local assembleDebug), no signing config is attached, so debug builds are unaffected.
• docs/ANDROID_APP.md — a "Releases" section documenting the tag/dispatch flow, keystore-secret setup, and a local signed-build command.

Signing strategy

• If the repo defines KEYSTORE_BASE64 + KEYSTORE_PASSWORD + KEY_ALIAS + KEY_PASSWORD secrets → signs with that keystore (stable signature; updates install in place).
• Otherwise → generates an ephemeral keystore so the build still yields an installable, signed APK (signature changes per run, so those builds can't update a prior install — reinstall instead).

Notes

• Release builds use the same code as debug (isMinifyEnabled = false); only signing differs. The app still requires root at runtime.
• The existing Android CI will run on this PR (build.gradle changed) and validates that the signing-config change doesn't break the debug build.

Producing the APK

After merge, push a tag (e.g. git tag v0.1.0 && git push origin v0.1.0) to generate the signed APK as a GitHub Release — I can do that step on your go-ahead.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VbHpkJ1MdVfGz9bi6Ekb1i

---

Generated by Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[gemini-code-assist]

Code Review

This pull request introduces release signing configuration to the Android application build setup, driven by environment variables, and adds comprehensive documentation on how to build and sign release APKs. The review feedback suggests improving the robustness of the Gradle build script by validating all required signing environment variables and resolving the keystore path relative to the root project. Additionally, it recommends using a portable base64 command in the documentation to ensure compatibility across both Linux and macOS environments.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Using file(keystoreFile) resolves relative paths relative to the subproject directory (app/), which can cause build failures if the keystore is placed in the root directory (a common pattern in CI workflows and local builds). Additionally, checking only keystoreFile != null can lead to cryptic build failures if other required environment variables (like KEYSTORE_PASSWORD) are missing or empty.

We can make this robust by:

1. Validating that all required environment variables are present and non-empty.
2. Resolving the keystore path relative to the root project using rootProject.file(...) so both relative and absolute paths work seamlessly.
3. Conditionally creating and assigning the release signing configuration only when all signing environment variables are fully configured.

    val envKeystoreFile = System.getenv("KEYSTORE_FILE")
    val envKeystorePassword = System.getenv("KEYSTORE_PASSWORD")
    val envKeyAlias = System.getenv("KEY_ALIAS")
    val envKeyPassword = System.getenv("KEY_PASSWORD")

    val hasSigningEnv = !envKeystoreFile.isNullOrEmpty() &&
            !envKeystorePassword.isNullOrEmpty() &&
            !envKeyAlias.isNullOrEmpty() &&
            !envKeyPassword.isNullOrEmpty()

    if (hasSigningEnv) {
        signingConfigs {
            create("release") {
                storeFile = rootProject.file(envKeystoreFile)
                storePassword = envKeystorePassword
                keyAlias = envKeyAlias
                keyPassword = envKeyPassword
            }
        }
    }

    buildTypes {
        release {
            isMinifyEnabled = false
            proguardFiles(
                getDefaultProguardFile("proguard-android-optimize.txt"),
                "proguard-rules.pro",
            )
            if (hasSigningEnv) {
                signingConfig = signingConfigs.getByName("release")
            }

[gemini-code-assist]

The -w0 flag is specific to GNU base64 (Linux) and will fail on macOS with base64: invalid option -- w.

Using base64 release.jks | tr -d '\n' is fully portable and works seamlessly on both Linux and macOS to produce a single-line base64 string.

Suggested change

	base64 -w0 release.jks # paste into the KEYSTORE_BASE64 repo secret
	base64 release.jks | tr -d '\n' # paste into the KEYSTORE_BASE64 repo secret