ci(release): pre-clone app into fdroid build dir so SOURCE_DATE_EPOCH resolves; fail fast unless 3 APKs

.forgejo/workflows/release.yml

@@ -152,12 +152,31 @@ jobs:
           sed -i "s#^\( *commit: \).*#\1${GITHUB_SHA}#" metadata/org.comunes.tane.yml
           sed -i '/^ *binary: /d' metadata/org.comunes.tane.yml
 
+          # Pre-clone the app into fdroid's build dir: fdroidserver computes
+          # SOURCE_DATE_EPOCH from this checkout BEFORE it clones anything — on a
+          # fresh dir it falls back to `git log` of the fdroiddata tree, which our
+          # assembled skeleton doesn't have, and crashes on None. With the clone in
+          # place the primary path pins SOURCE_DATE_EPOCH to the app commit
+          # timestamp (deterministic; the public URL is redirected to forgejo:3000
+          # by the insteadOf rule above).
+          mkdir -p build
+          git clone -q https://git.comunes.org/comunes/tane.git build/org.comunes.tane
+          git -C build/org.comunes.tane checkout -q "${GITHUB_SHA}"
+
           # 5) Build the three per-ABI splits with F-Droid's own toolchain.
           fdroid build --verbose --no-tarball \
             "org.comunes.tane:$((base * 10 + 1))" \
             "org.comunes.tane:$((base * 10 + 2))" \
             "org.comunes.tane:$((base * 10 + 3))"
 
+          # `fdroid build` exits 0 even when builds fail — demand the 3 APKs.
+          apk_count=$(ls unsigned/org.comunes.tane_*.apk 2>/dev/null | wc -l)
+          if [ "$apk_count" -ne 3 ]; then
+            echo "expected 3 unsigned APKs, got $apk_count" >&2
+            tail -n 80 logs/*.log 2>/dev/null || true
+            exit 1
+          fi
+
           # 6) Sign each unsigned APK with tane-upload and attach to the Forgejo release.
           apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
           if [ -z "$apksigner" ]; then