From 1d13299559ee2b6ca4173da178ff6bfa57a71965 Mon Sep 17 00:00:00 2001
From: Devasy Patel <110348311+Devasy23@users.noreply.github.com>
Date: Sun, 16 Aug 2026 09:27:13 +0530
Subject: [PATCH] ci: bring release workflow CI hygiene fixes to main

Ports release.yml improvements that were sitting on migrate/sqflite-db
(via the feat/genui PR #64 merge, commit e89e2ca) but never reached
main - so the currently-published releases were built without them:

- Apply -Wl,--build-id=none to the jni package's native CMakeLists.txt
  during dependency install. Without this, libdartjni.so embeds a
  non-deterministic GNU build-id, which is why the F-Droid submission
  (fdroiddata MR 40630) can never byte-match a reference binary built
  from an unpatched release - this was the actual root cause, not
  anything in fdroiddata's own build recipe.
- flutter build apk --obfuscate --split-debug-info=..., matching what
  CLAUDE.md already documents as the intended release build command.
- Pin newer action versions (checkout@v7, setup-java@v5,
  action-gh-release@v3), add Gradle build cache setup, add a
  concurrency group, and fail fast with a clear error if
  KEYSTORE_BASE64 isn't configured.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 33 ++++++++++++++++++++++++++++-----
 1 file changed, 28 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 393c5ca..e12a3fe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,6 +6,10 @@ on:
       - main
   workflow_dispatch:
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   release:
     name: Build and Release APK
@@ -18,17 +22,20 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0  # Fetch all history for proper versioning
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: '17'
 
+      - name: Setup Gradle Build Cache
+        uses: gradle/actions/setup-gradle@v6
+
       - name: Set up Flutter
         uses: subosito/flutter-action@v2
         with:
@@ -39,7 +46,19 @@ jobs:
 
       - name: Install dependencies
         working-directory: ./workout-logger
-        run: flutter pub get
+        run: |
+          flutter pub get
+          : "${PUB_CACHE:?PUB_CACHE is not set}"
+          mapfile -t targets < <(find "$PUB_CACHE" -type f -path '*/jni-*/src/CMakeLists.txt')
+          if [ "${#targets[@]}" -eq 0 ]; then
+            echo "Error: no jni-*/src/CMakeLists.txt files found under \$PUB_CACHE" >&2
+            exit 1
+          fi
+          for f in "${targets[@]}"; do
+            if ! grep -q -- '-Wl,--build-id=none' "$f"; then
+              sed -i -e 's/-Wl,/-Wl,--build-id=none,/' "$f"
+            fi
+          done
 
       - name: Bump version
         if: github.event_name == 'push'
@@ -117,6 +136,10 @@ jobs:
 
       - name: Decode release keystore
         run: |
+          if [ -z "${{ secrets.KEYSTORE_BASE64 }}" ]; then
+            echo "Error: KEYSTORE_BASE64 secret is not configured in repository secrets."
+            exit 1
+          fi
           echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 --decode > /tmp/repforge-release.jks
 
       - name: Build APK
@@ -126,7 +149,7 @@ jobs:
           KEY_STORE_PASSWORD: ${{ secrets.KEY_STORE_PASSWORD }}
           KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
           KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
-        run: flutter build apk --release --split-per-abi
+        run: flutter build apk --release --split-per-abi --obfuscate --split-debug-info=build/app/outputs/symbols
 
       - name: Rename APKs
         run: |
@@ -150,7 +173,7 @@ jobs:
 
       - name: Create GitHub Release
         if: github.event_name == 'push' && steps.commit_version.outputs.committed == 'true'
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: v${{ steps.version.outputs.value }}
           name: RepForge v${{ steps.version.outputs.value }}