Revert "ci(release): revert to F-Droid-signed recipe; drop pre-merge reference build"

This reverts commit 4d99e1a840.

.forgejo/workflows/release.yml

@@ -1,11 +1,14 @@
 # Release automation for git.comunes.org (Forgejo Actions).
 #
-# Pushing a tag `v*` builds the signed AAB and ships it to Google Play (internal
-# track) via fastlane. F-Droid is NOT built here: F-Droid clones the repo and
-# builds+signs it itself from the recipe in docs/fdroid/org.comunes.tane.yml
-# (that build environment already handles the tesseract4android/NDK/old-repo
-# dependencies). So the F-Droid and Play builds have different signatures; a
-# reproducible developer-signed setup can be added later as a post-merge step.
+# Pushing a tag `v*` runs two independent jobs:
+#   play            - build the signed AAB and ship it to Google Play (internal).
+#   fdroid_reference- build the per-ABI reference APKs the SAME way F-Droid will
+#                     (fdroid build inside the fdroidserver buildserver image),
+#                     sign them with the tane-upload key, and attach them to the
+#                     Forgejo release. F-Droid re-runs `fdroid build` on the same
+#                     commit+recipe+image, gets byte-identical output, verifies our
+#                     signature (AllowedAPKSigningKeys) and publishes OUR APK — so
+#                     F-Droid and Play share the same signing key.
 #
 # All credentials come from repo secrets (Settings > Actions > Secrets):
 #   TANE_KEYSTORE_BASE64   base64 of the dedicated tane-upload.jks
@@ -15,6 +18,8 @@
 #   SUPPLY_JSON_KEY_DATA   Google Play service-account JSON
 #
 # NOTE: `runs-on` must match a label your Forgejo runner registered with.
+# The fdroid_reference job pulls a large image (~2 GB) and builds tesseract from
+# source, so it is slow (~20-40 min); the play job is independent and unaffected.
 
 name: release
 
@@ -22,9 +27,13 @@ on:
   push:
     tags:
       - 'v*'
+  # Manual trigger to test the fdroid_reference job on a branch without cutting a
+  # tag or deploying to Play (the play job below is guarded to tags only).
+  workflow_dispatch:
 
 jobs:
   play:
+    if: ${{ startsWith(github.ref, 'refs/tags/') }}
     runs-on: docker
     container:
       image: ghcr.io/cirruslabs/flutter:3.41.9
@@ -86,3 +95,108 @@ jobs:
         if: always()
         working-directory: apps/app_seeds
         run: rm -f android/key.properties "$GITHUB_WORKSPACE/tane-upload.jks"
+
+  fdroid_reference:
+    runs-on: docker
+    container:
+      image: registry.gitlab.com/fdroid/fdroidserver:buildserver-trixie
+    steps:
+      - name: Build reference APKs with fdroid, sign, and attach to the release
+        env:
+          TOKEN: ${{ github.token }}
+          TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
+          TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
+          TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
+          TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
+        run: |
+          set -eu
+
+          # 1) Reproduce F-Droid's build environment (ANDROID_HOME, PATH, NDK...).
+          sh /opt/buildserver/setup-env-vars /opt/android-sdk
+          . /etc/profile.d/bsenv.sh
+
+          # 2) fdroidserver from master, exactly like the fdroiddata CI.
+          fds=/opt/fdroidserver-src
+          mkdir -p "$fds"
+          curl -sL https://gitlab.com/fdroid/fdroidserver/-/archive/master/fdroidserver-master.tar.gz \
+            | tar -xz -C "$fds" --strip-components=1
+          export PATH="$fds:$PATH"
+          export PYTHONPATH="$fds:$fds/examples"
+          git config --global --add safe.directory '*'
+          # The job container reaches github.com but not the host's public git.comunes.org
+          # (NAT hairpin); redirect the app clone to the internal Forgejo host so
+          # `fdroid build` can fetch the source (and SOURCE_DATE_EPOCH from its commit).
+          git config --global url."http://x-access-token:${TOKEN}@forgejo:3000/".insteadOf "https://git.comunes.org/"
+
+          # 3) Fetch our in-repo recipe (the single source of truth) at this commit,
+          #    plus the pubspec versionCode base for the per-ABI codes.
+          work=/tmp/tane-src
+          mkdir -p "$work" && cd "$work"
+          git init -q .
+          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
+          git fetch -q --depth 1 origin "${GITHUB_SHA}"
+          git checkout -q FETCH_HEAD
+          base=$(sed -n -E 's/^version:.*\+([0-9]+)$/\1/p' apps/app_seeds/pubspec.yaml)
+          [ -n "$base" ]
+
+          # 4) Assemble a minimal fdroiddata (config.yml + srclibs + our recipe) from the
+          #    in-repo files. No external host needed — the job container reaches
+          #    git.comunes.org (via forgejo:3000) but not gitlab.com.
+          fdd=/tmp/fdroiddata
+          mkdir -p "$fdd/metadata" "$fdd/srclibs"
+          cp "$work/fdroid-ci/config.yml" "$fdd/config.yml"
+          cp "$work"/fdroid-ci/srclibs/*.yml "$fdd/srclibs/"
+          cp "$work/docs/fdroid/org.comunes.tane.yml" "$fdd/metadata/org.comunes.tane.yml"
+          cd "$fdd"
+          # Build THIS commit; drop binary: (we PRODUCE the reference here, not verify it).
+          sed -i "s#^\( *commit: \).*#\1${GITHUB_SHA}#" metadata/org.comunes.tane.yml
+          sed -i '/^ *binary: /d' metadata/org.comunes.tane.yml
+
+          # 5) Build the three per-ABI splits with F-Droid's own toolchain.
+          fdroid build --verbose --no-tarball \
+            "org.comunes.tane:$((base * 10 + 1))" \
+            "org.comunes.tane:$((base * 10 + 2))" \
+            "org.comunes.tane:$((base * 10 + 3))"
+
+          # 6) Sign each unsigned APK with tane-upload and attach to the Forgejo release.
+          apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
+          if [ -z "$apksigner" ]; then
+            yes | sdkmanager "build-tools;34.0.0" >/dev/null 2>&1 || true
+            apksigner=$(find "$ANDROID_HOME" -name apksigner -type f 2>/dev/null | sort -V | tail -1)
+          fi
+          echo "$TANE_KEYSTORE_BASE64" | base64 -d > /tmp/ks.jks
+          api="http://forgejo:3000/api/v1/repos/${GITHUB_REPOSITORY}"
+          tag="${GITHUB_REF_NAME}"
+          is_tag=false; [ "${GITHUB_REF_TYPE:-}" = tag ] && is_tag=true
+          rid=""
+          if $is_tag; then
+            curl -sf -X POST "$api/releases" \
+              -H "Authorization: token ${TOKEN}" -H 'Content-Type: application/json' \
+              -d "{\"tag_name\":\"${tag}\",\"name\":\"${tag}\"}" >/dev/null || true
+            rid=$(curl -sf -H "Authorization: token ${TOKEN}" "$api/releases/tags/${tag}" \
+              | python3 -c 'import sys,json;print(json.load(sys.stdin)["id"])')
+          fi
+          for f in unsigned/org.comunes.tane_*.apk; do
+            vc=$(echo "$f" | sed -E 's/.*_([0-9]+)\.apk/\1/')
+            case $((vc % 10)) in
+              1) abi=armeabi-v7a ;;
+              2) abi=arm64-v8a ;;
+              3) abi=x86_64 ;;
+              *) echo "unexpected versionCode $vc"; exit 1 ;;
+            esac
+            out="/tmp/app-${abi}-release.apk"
+            "$apksigner" sign --ks /tmp/ks.jks --ks-key-alias "$TANE_KEY_ALIAS" \
+              --ks-pass "pass:$TANE_KEYSTORE_PASSWORD" --key-pass "pass:$TANE_KEY_PASSWORD" \
+              --out "$out" "$f"
+            # Prove the signer cert matches AllowedAPKSigningKeys.
+            "$apksigner" verify --print-certs "$out" | grep -i 'SHA-256' || true
+            if $is_tag; then
+              curl -sf -X POST "$api/releases/${rid}/assets?name=app-${abi}-release.apk" \
+                -H "Authorization: token ${TOKEN}" \
+                -F "attachment=@${out};type=application/vnd.android.package-archive"
+              echo "uploaded app-${abi}-release.apk (from ${f##*/})"
+            else
+              echo "built+signed app-${abi}-release.apk (dispatch: upload skipped)"
+            fi
+          done
+          rm -f /tmp/ks.jks