feat(ci): build and publish signed Android release APK

.github/workflows/build.yml

@@ -43,6 +43,8 @@ jobs:
   build-android:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    env:
+      ANDROID_APK_NAME: tg-ws-proxy-android-${{ github.event.inputs.version }}.apk
     defaults:
       run:
         working-directory: android
@@ -50,6 +52,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Validate Android release signing secrets
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          test -n "$ANDROID_KEYSTORE_BASE64" || { echo "Missing secret: ANDROID_KEYSTORE_BASE64"; exit 1; }
+          test -n "$ANDROID_KEYSTORE_PASSWORD" || { echo "Missing secret: ANDROID_KEYSTORE_PASSWORD"; exit 1; }
+          test -n "$ANDROID_KEY_ALIAS" || { echo "Missing secret: ANDROID_KEY_ALIAS"; exit 1; }
+          test -n "$ANDROID_KEY_PASSWORD" || { echo "Missing secret: ANDROID_KEY_PASSWORD"; exit 1; }
+
       - name: Set up JDK 17
         uses: actions/setup-java@v5
         with:
@@ -71,19 +85,32 @@ jobs:
       - name: Install Android SDK packages
         run: sdkmanager "platforms;android-34" "build-tools;34.0.0"
 
-      - name: Build Android debug APK
+      - name: Prepare Android release keystore
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+        run: |
+          printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 --decode > "$RUNNER_TEMP/android-release.keystore"
+          test -s "$RUNNER_TEMP/android-release.keystore"
+
+      - name: Build Android release APK
+        env:
+          LOCAL_CHAQUOPY_REPO: ${{ github.workspace }}/android/.m2-chaquopy-ci
+          ANDROID_KEYSTORE_FILE: ${{ runner.temp }}/android-release.keystore
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
         run: |
           chmod +x gradlew build-local-debug.sh
-          LOCAL_CHAQUOPY_REPO="$GITHUB_WORKSPACE/android/.m2-chaquopy-ci" ./build-local-debug.sh
+          ./build-local-debug.sh assembleRelease
 
       - name: Rename APK
-        run: cp app/build/outputs/apk/debug/app-debug.apk app/build/outputs/apk/debug/tg-ws-proxy-android-debug.apk
+        run: cp app/build/outputs/apk/release/app-release.apk "app/build/outputs/apk/release/$ANDROID_APK_NAME"
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
-          name: TgWsProxy-android-debug
+          name: TgWsProxy-android-release
-          path: android/app/build/outputs/apk/debug/tg-ws-proxy-android-debug.apk
+          path: android/app/build/outputs/apk/release/${{ env.ANDROID_APK_NAME }}
 
   build-win7:
     runs-on: windows-latest
@@ -134,7 +161,7 @@ jobs:
       - name: Download Android build
         uses: actions/download-artifact@v4
         with:
-          name: TgWsProxy-android-debug
+          name: TgWsProxy-android-release
           path: dist
 
       - name: Create GitHub Release
@@ -147,7 +174,7 @@ jobs:
           files: |
             dist/TgWsProxy.exe
             dist/TgWsProxy-win7.exe
-            dist/tg-ws-proxy-android-debug.apk
+            dist/tg-ws-proxy-android-${{ github.event.inputs.version }}.apk
           draft: false
           prerelease: false
         env:

.gitignore

@@ -25,7 +25,7 @@ android/.idea/
 android/build/
 android/app/build/
 android/*.jks
-android/*.keystore
+*.keystore
 android/*.keystore.properties
 
 # OS