Skip to content

A pull request builds an APK somebody can install - #132

Merged
sridharkalaibala merged 1 commit into
mainfrom
ci/a-pull-request-builds-an-apk
Sep 17, 2026
Merged

sridharkalaibala merged 1 commit into
mainfrom
ci/a-pull-request-builds-an-apk

Conversation

@sridharkalaibala

Copy link
Copy Markdown
Contributor

main is protected by a required status check named "Debug APK", and nothing in this repository produces a check by that name. release.yml builds Android, but it runs on tags, so it has never run for a pull request.

The effect: every pull request sits BLOCKED for ever, waiting on a check that cannot arrive, and the only way to merge anything is an administrator overriding the rule by hand. That is what happened to #127 through #131 today, and to this one until it merges.

So the protection was not protecting anything. It was a step somebody learned to skip, and a rule that can only ever be bypassed teaches people to bypass rules.

Either the check exists or the requirement should not. Of the two, a build on every pull request is worth having anyway.

Why it is worth having

A handset app is not reviewable by reading it. Half of what goes wrong here is only visible on a phone: a gesture that fights a tap, a sheet that opens under a thumb, a screen unreadable in a kitchen. A branch that produces an installable build is a branch somebody can try on the shop floor before it reaches a waiter mid-service.

Tonight's sold-out long press is exactly that shape. It is 18 tests green and nobody has held it.

Choices

  • Unsigned on purpose. Signing keys belong to a tag and a release. A debug APK cannot be updated in place by a signed one later, because Android treats a different signature as a different app, so the artifact is named so nobody mistakes one for the other.
  • Node 22 and Java 21, in step with release.yml. A pull request that builds on a Node the release cannot use is a green tick that means nothing. Both numbers already carry comments in release.yml explaining which failure they were bought with.
  • The same build-apk.js the release runs, without --release, so a pull request cannot pass through a build the release does not perform.
  • packages: '' for setup-android, because the tools package no longer exists in the SDK repository and asking for it kills the job before any of our code runs.
  • Concurrency cancels the older run, since what anybody wants to install is the newest one.

After this

This PR will itself be blocked, because the check only starts existing once it is merged. It needs one last admin merge, and then merges here are normal.

If you would rather not spend the build minutes, the alternative is to remove "Debug APK" from the protection rule instead. Either is fine; what is not fine is leaving a required check that nothing can satisfy.

main is protected by a required status check named "Debug APK", and nothing in this repository produced a check by that name. release.yml builds Android, but it runs on tags, so it never ran for a pull request.

So every pull request sat BLOCKED for ever, waiting on a check that could not arrive, and the only way to merge anything was an administrator overriding the rule by hand. That means the protection was not protecting anything; it was a step somebody learned to skip. A rule that can only ever be bypassed teaches people to bypass rules.

Either the check exists or the requirement should not, and of the two, a build on every pull request is worth having anyway. A handset app is not reviewable by reading it: a gesture that fights a tap, a sheet that opens under a thumb, a screen unreadable in a kitchen, are only visible on a phone. A branch that produces an installable build is one somebody can try on the shop floor before it reaches a waiter mid-service.

Unsigned on purpose. Signing keys belong to a tag and a release, and a debug APK cannot be updated in place by a signed one later because Android treats a different signature as a different app. It is named so nobody mistakes one for the other.

Node 22 and Java 21 kept in step with release.yml deliberately: a pull request that builds on a Node the release cannot use is a green tick that means nothing. It runs the same build-apk.js the release runs, without --release, so a pull request cannot pass through a build the release does not perform.
@sridharkalaibala
sridharkalaibala merged commit f8477a6 into main Sep 17, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant