fix(release): port store publishing to Forgejo Actions (canonical remote is Forgejo)

git.comunes.org runs Forgejo Actions, not GitLab CI, so the tag-triggered
signed-AAB build + fastlane Play upload now lives in .forgejo/workflows/release.yml
(single job, no cross-job artifact passing). Removed the equivalent GitLab jobs;
.gitlab-ci.yml keeps only the analyze/test gate. Play service account is reused
from Ğ1nkgo. docs/release.md updated (Forgejo secrets).

.forgejo/workflows/release.yml

@@ -0,0 +1,78 @@
+# Release automation for git.comunes.org (Forgejo Actions).
+#
+# Password-free: pushing a tag `v*` builds a signed AAB/APK and uploads it to
+# Google Play's internal track via fastlane. All credentials come from repo
+# secrets (Settings > Actions > Secrets), never typed:
+#   TANE_KEYSTORE_BASE64   base64 of the dedicated tane-upload.jks
+#   TANE_KEYSTORE_PASSWORD store password
+#   TANE_KEY_ALIAS         tane-upload
+#   TANE_KEY_PASSWORD      key password
+#   SUPPLY_JSON_KEY_DATA   Google Play service-account JSON (reused from Ğ1nkgo)
+#
+# Build + deploy live in ONE job so the AAB never has to cross a job boundary.
+# NOTE: `runs-on` must match a label your Forgejo runner registered with; adjust
+# if the Comunes runner uses something other than `docker`.
+
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  android:
+    runs-on: docker
+    container:
+      image: ghcr.io/cirruslabs/flutter:3.41.9
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Generate code (i18n + Drift)
+        working-directory: apps/app_seeds
+        run: |
+          flutter pub get
+          dart run slang
+          dart run build_runner build --delete-conflicting-outputs
+
+      - name: Materialize signing material from secrets
+        working-directory: apps/app_seeds
+        env:
+          TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
+          TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
+          TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
+          TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
+        run: |
+          echo "$TANE_KEYSTORE_BASE64" | base64 -d > "$GITHUB_WORKSPACE/tane-upload.jks"
+          cat > android/key.properties <<EOF
+          storeFile=$GITHUB_WORKSPACE/tane-upload.jks
+          storePassword=$TANE_KEYSTORE_PASSWORD
+          keyAlias=$TANE_KEY_ALIAS
+          keyPassword=$TANE_KEY_PASSWORD
+          EOF
+
+      - name: Build signed AAB + APK
+        working-directory: apps/app_seeds
+        run: |
+          flutter build appbundle --release
+          flutter build apk --release
+
+      - name: Install fastlane
+        working-directory: apps/app_seeds
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq ruby ruby-dev build-essential
+          gem install bundler --no-document
+          bundle install
+
+      - name: Publish to Google Play (internal track)
+        working-directory: apps/app_seeds
+        env:
+          SUPPLY_JSON_KEY_DATA: ${{ secrets.SUPPLY_JSON_KEY_DATA }}
+        run: bundle exec fastlane deploy_play
+
+      - name: Scrub signing material
+        if: always()
+        working-directory: apps/app_seeds
+        run: rm -f android/key.properties "$GITHUB_WORKSPACE/tane-upload.jks"

.gitlab-ci.yml

@@ -10,7 +10,6 @@ stages:
   - analyze
   - test
   - build
-  - deploy
 
 variables:
   PUB_CACHE: "$CI_PROJECT_DIR/.pub-cache"
@@ -84,62 +83,6 @@ test:app_seeds:
         coverage_format: cobertura
         path: apps/app_seeds/coverage/cobertura.xml
 
-# ---------------------------------------------------------------------------
+# Release automation (signed AAB + Play upload on tag) lives in Forgejo Actions,
-# Release automation. Runs ONLY on tags, so it never touches the per-push gate.
+# since the canonical remote (git.comunes.org) is Forgejo, not GitLab:
-# Password-free: signing + Play credentials come from masked+protected CI vars.
+#   .forgejo/workflows/release.yml
-# Required CI variables (Settings > CI/CD > Variables), set once:
-#   TANE_KEYSTORE_BASE64   base64 of the dedicated Tane upload keystore (.jks)
-#   TANE_KEYSTORE_PASSWORD store password
-#   TANE_KEY_ALIAS         key alias (tane-upload)
-#   TANE_KEY_PASSWORD      key password
-#   SUPPLY_JSON_KEY_DATA   Google Play service-account JSON (raw file contents)
-# Tag a commit (e.g. `git tag v0.1.0 && git push --tags`) to build + publish.
-# ---------------------------------------------------------------------------
-
-# Build the signed release artifacts (AAB for Play, APK for sideload/QA).
-build:android:
-  stage: build
-  rules:
-    - if: '$CI_COMMIT_TAG'
-  script:
-    - cd apps/app_seeds
-    - dart run slang
-    - dart run build_runner build --delete-conflicting-outputs
-    # Materialize the signing material from CI secrets (never in the repo).
-    - echo "$TANE_KEYSTORE_BASE64" | base64 -d > "$CI_PROJECT_DIR/tane-upload.jks"
-    - |
-      cat > android/key.properties <<EOF
-      storeFile=$CI_PROJECT_DIR/tane-upload.jks
-      storePassword=$TANE_KEYSTORE_PASSWORD
-      keyAlias=$TANE_KEY_ALIAS
-      keyPassword=$TANE_KEY_PASSWORD
-      EOF
-    - flutter build appbundle --release
-    - flutter build apk --release
-    # Don't leave signing material in the workspace/cache.
-    - rm -f android/key.properties "$CI_PROJECT_DIR/tane-upload.jks"
-  artifacts:
-    paths:
-      - apps/app_seeds/build/app/outputs/bundle/release/app-release.aab
-      - apps/app_seeds/build/app/outputs/flutter-apk/app-release.apk
-    expire_in: 90 days
-
-# Upload the AAB + store listing to Google Play (internal track) via fastlane.
-# Needs a Ruby image, not the Flutter one, so it overrides the global setup.
-deploy:play:
-  stage: deploy
-  image: ruby:3.2
-  needs:
-    - job: build:android
-      artifacts: true
-  rules:
-    - if: '$CI_COMMIT_TAG'
-  before_script:
-    - cd apps/app_seeds
-    - bundle install --path vendor/bundle
-  script:
-    - bundle exec fastlane deploy_play
-  cache:
-    key: "fastlane-gems"
-    paths:
-      - apps/app_seeds/vendor/bundle/

docs/release.md

@@ -14,8 +14,8 @@ Once the one-time setup below is done:
 git tag v0.1.0 && git push origin v0.1.0
 ```
 
-CI (`build:android` → `deploy:play` in [`../.gitlab-ci.yml`](../.gitlab-ci.yml)) builds
+Forgejo Actions ([`../.forgejo/workflows/release.yml`](../.forgejo/workflows/release.yml))
-the signed AAB/APK and uploads to Play's **internal** track. No passwords are typed.
+builds the signed AAB/APK and uploads to Play's **internal** track. No passwords are typed.
 
 ## Versioning
 
@@ -55,11 +55,11 @@ With **Play App Signing** (recommended, enabled once in the console) this is the
 *upload key*; Google holds the app signing key and can help rotate the upload key
 if it is ever lost.
 
-### CI secrets (one-time, GitLab → Settings → CI/CD → Variables)
+### CI secrets (one-time, Forgejo → repo Settings → Actions → Secrets)
 
-Set these as **masked + protected** so releases never prompt for a password:
+Set these so releases never prompt for a password:
 
-| Variable | What |
+| Secret | What |
 |---|---|
 | `TANE_KEYSTORE_BASE64` | `base64 -w0 tane-upload.jks` |
 | `TANE_KEYSTORE_PASSWORD` | store password |
@@ -67,10 +67,12 @@ Set these as **masked + protected** so releases never prompt for a password:
 | `TANE_KEY_PASSWORD` | key password |
 | `SUPPLY_JSON_KEY_DATA` | Google Play service-account JSON (raw file contents) |
 
-The Play service account is created in Google Cloud and granted release access in
+The Play service account is **reused from Ğ1nkgo** (`ginkgo-play-uploader@…`,
-Play Console; it is what lets `fastlane supply` upload without a human. The first
+`/home/vjrj/etc/ginkgo_play_api_key.json`) — it belongs to the Comunes Play account,
-upload of a brand-new app must still be done by hand in the console (Play requires
+not to one app, so it just needs access granted to `org.comunes.tane` in Play Console.
-the app to exist before the API accepts uploads).
+`fastlane supply` uses it to upload without a human. The first upload of the brand-new
+app must still be done by hand in the console (Play requires the app to exist before
+the API accepts uploads).
 
 ## Build by hand (fallback / first Play upload)