fix(ci): build the release APKs with build-fdroid.sh, then sign them

[lollipopkit]

Refs #1274

Summary

Changes

• Harden release builds and F-Droid preparation: The workflow validates build selection and release versions, builds and verifies platform artifacts, and publishes only a complete release. The F-Droid preparation script fetches its pinned build dependencies and seeds the isolated cache needed for offline reproducible builds.

Summary by CodeRabbit

• Chores
  • Android release builds now produce signed APKs for supported device architectures. The release packages are checked to confirm their signatures and contents remain intact, and are named consistently with the app version. This improves the reliability of the APKs available for download.

[winnowl]

Important

Review completed

Reviewed commit b7b3a6f; the results are in the review on this pull request.

Merge risk: 🟢 Low · no blocking findings

📝 Walkthrough

• Harden release builds and F-Droid preparation: The workflow validates build selection and release versions, builds and verifies platform artifacts, and publishes only a complete release. The F-Droid preparation script fetches its pinned build dependencies and seeds the isolated cache needed for offline reproducible builds.

• Review again

Commenting @winnowl review does the same.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: e1281477-f7b9-457d-a309-6c7cf9776b35

---

📥 Commits

Reviewing files that changed from the base of the PR and between 40e734a and b7b3a6f.

---

📒 Files selected for processing (3)

• .github/workflows/build.yml
• fdroid/README.md
• scripts/release/prepare-fdroid.sh

---

💤 Files with no reviewable changes (1)

• fdroid/README.md

---

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📜 Recent review details

🔇 Additional comments (3)

.github/workflows/build.yml (2)

569-595: LGTM!

---

607-663: LGTM!

---

scripts/release/prepare-fdroid.sh (1)

6-6: LGTM!

---

---

---

---

📝 Walkthrough

Walkthrough

The Android workflow now builds APKs for each matrix ABI with build-fdroid.sh, then signs and verifies the APKs. The workflow also removes copied unsigned APKs. The F-Droid release guide was deleted, and a script comment was updated.

Changes

F-Droid Android build

Layer / File(s)	Summary
Configure the F-Droid build .github/workflows/build.yml, fdroid/README.md, scripts/release/prepare-fdroid.sh	The workflow installs pinned Android SDK components, enforces dependency lockfiles, and invokes build-fdroid.sh for each matrix ABI. The F-Droid release guide was removed, and a script comment no longer points to it.
Sign and name APK artifacts .github/workflows/build.yml	The workflow maps supported ABIs to unsigned APKs, signs with v2 only, verifies signatures and APK entry metadata, and writes versioned APK names. It removes Flutter’s copied unsigned APKs. The separate rename step was removed.

Suggested reviewers: gt-610

---

Priority: ➖ Normal

Change: Bug fix

Merge Risk: ⚪ Minimal · up to b7b3a

The release workflow now builds APKs with the F-Droid build script and then signs them. No concrete merge-blocking risk was found in the supplied changes. Run the release workflow once to confirm the signed artifacts.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[winnowl]

Actionable comments posted: 0

✅ No blocking issues found — approving.

ℹ️ Review info

⚙️ Run configuration

Configuration: defaults

Review profile: balanced

Model: gpt-6-luna

📥 Commits

Reviewing files that changed between 40e734a and b7b3a6f.

📒 Files selected for processing (2)

• .github/workflows/build.yml
• scripts/release/prepare-fdroid.sh

Coverage

• 1 of 1 areas reviewed