Restore complete Android release workflow

.github/workflows/android-build.yml

@@ -8,7 +8,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  contents: write
 
 concurrency:
   group: android-build-${{ github.ref }}
@@ -17,7 +17,7 @@ concurrency:
 env:
   FLUTTER_VERSION: '3.44.6'
   JAVA_VERSION: '17'
-  ANDROID_COMPILE_SDK: '37.0'
+  ANDROID_COMPILE_SDK: '37'
   ANDROID_BUILD_TOOLS: '37.0.0'
   GRADLE_VERSION: '9.1.0'
 
@@ -35,6 +35,7 @@ jobs:
         with:
           distribution: temurin
           java-version: ${{ env.JAVA_VERSION }}
+          cache: gradle
       - name: Set up Flutter
         uses: subosito/flutter-action@v2
         with:
@@ -75,6 +76,7 @@ jobs:
           set -euo pipefail
           if [ ! -f android/gradlew ]; then (cd android && gradle wrapper --gradle-version "$GRADLE_VERSION" --distribution-type all); fi
           chmod +x android/gradlew
+          ./android/gradlew --version
       - name: Flutter and Android environment
         run: |
           flutter --version
@@ -84,6 +86,20 @@ jobs:
         run: flutter pub get
       - name: Generate Drift sources
         run: dart run build_runner build --delete-conflicting-outputs
+      - name: Commit regenerated Drift sources
+        if: github.event_name == 'push' && github.actor != 'github-actions[bot]'
+        shell: bash
+        run: |
+          set -euo pipefail
+          if git diff --quiet -- lib/database/database.g.dart; then
+            echo 'database.g.dart is already current.'
+            exit 0
+          fi
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add lib/database/database.g.dart
+          git commit -m 'Regenerate Drift database source'
+          git push origin HEAD:${GITHUB_REF_NAME}
       - name: Analyze
         run: flutter analyze --no-fatal-infos
       - name: Run tests
@@ -124,15 +140,121 @@ jobs:
         with:
           distribution: temurin
           java-version: ${{ env.JAVA_VERSION }}
+          cache: gradle
       - name: Set up Flutter
         uses: subosito/flutter-action@v2
         with:
           flutter-version: ${{ env.FLUTTER_VERSION }}
           channel: stable
           cache: true
+      - name: Free runner disk space
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo rm -rf /usr/share/dotnet /usr/local/share/powershell /opt/ghc /usr/local/.ghcup /usr/local/lib/android/sdk/emulator /usr/local/lib/android/sdk/system-images
+          sudo apt-get clean || true
+          sudo rm -rf /var/lib/apt/lists/*
+          docker system prune -af --volumes 2>/dev/null || true
+      - name: Create Flutter local.properties
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "${FLUTTER_ROOT:-}" && test -d "$FLUTTER_ROOT"
+          printf 'flutter.sdk=%s\n' "$FLUTTER_ROOT" > android/local.properties
+      - name: Provision Android SDK
+        shell: bash
+        run: |
+          set -euo pipefail
+          SDKROOT="${ANDROID_SDK_ROOT:-${ANDROID_HOME:-}}"
+          SDKMANAGER="$(find "$SDKROOT/cmdline-tools" -type f -name sdkmanager -print -quit 2>/dev/null || true)"
+          test -x "$SDKMANAGER"
+          "$SDKMANAGER" --licenses </dev/null >/dev/null 2>&1 || true
+          "$SDKMANAGER" "platform-tools" "platforms;android-${ANDROID_COMPILE_SDK}" "build-tools;${ANDROID_BUILD_TOOLS}"
+          yes | "$SDKMANAGER" --licenses >/dev/null 2>&1 || true
+      - name: Provision Gradle wrapper
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ ! -f android/gradlew ]; then (cd android && gradle wrapper --gradle-version "$GRADLE_VERSION" --distribution-type all); fi
+          chmod +x android/gradlew
+          ./android/gradlew --version
       - name: Get dependencies
         run: flutter pub get
       - name: Generate Drift sources
         run: dart run build_runner build --delete-conflicting-outputs
-      - name: Build release artifacts
+      - name: Restore release keystore
+        env:
+          KEYSTORE_BASE64: ${{ secrets.MOTORSIGNAL_KEYSTORE_BASE64 }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "$KEYSTORE_BASE64" || { echo "Missing MOTORSIGNAL_KEYSTORE_BASE64 repository secret"; exit 1; }
+          printf '%s' "$KEYSTORE_BASE64" | base64 --decode > android/app/motorsignal-upload-keystore.jks
+          chmod 600 android/app/motorsignal-upload-keystore.jks
+          test -s android/app/motorsignal-upload-keystore.jks
+      - name: Create signing properties
+        env:
+          STORE_PASSWORD: ${{ secrets.MOTORSIGNAL_STORE_PASSWORD }}
+          KEY_PASSWORD: ${{ secrets.MOTORSIGNAL_KEY_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.MOTORSIGNAL_KEY_ALIAS }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "$STORE_PASSWORD" || { echo "Missing MOTORSIGNAL_STORE_PASSWORD repository secret"; exit 1; }
+          test -n "$KEY_PASSWORD" || { echo "Missing MOTORSIGNAL_KEY_PASSWORD repository secret"; exit 1; }
+          test -n "$KEY_ALIAS" || { echo "Missing MOTORSIGNAL_KEY_ALIAS repository secret"; exit 1; }
+          cat > android/key.properties <<EOF
+          storePassword=$STORE_PASSWORD
+          keyPassword=$KEY_PASSWORD
+          keyAlias=$KEY_ALIAS
+          storeFile=app/motorsignal-upload-keystore.jks
+          EOF
+          chmod 600 android/key.properties
+      - name: Verify release signing key
+        env:
+          STORE_PASSWORD: ${{ secrets.MOTORSIGNAL_STORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.MOTORSIGNAL_KEY_ALIAS }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          keytool -list -keystore android/app/motorsignal-upload-keystore.jks -storetype PKCS12 -storepass "$STORE_PASSWORD" -alias "$KEY_ALIAS" >/dev/null
+      - name: Build release APK
         run: flutter build apk --release
+      - name: Build release App Bundle
+        run: flutter build appbundle --release
+      - name: Verify release artifacts and signatures
+        env:
+          STORE_PASSWORD: ${{ secrets.MOTORSIGNAL_STORE_PASSWORD }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          APK="build/app/outputs/flutter-apk/app-release.apk"
+          AAB="build/app/outputs/bundle/release/app-release.aab"
+          test -s "$APK"
+          test -s "$AAB"
+          file "$APK" "$AAB"
+          "$ANDROID_HOME/build-tools/$(ls "$ANDROID_HOME/build-tools" | sort -V | tail -n 1)/apksigner" verify --verbose "$APK"
+          sha256sum "$APK" "$AAB" | tee build/release-artifacts.sha256
+      - name: Upload release APK
+        uses: actions/upload-artifact@v5
+        with:
+          name: motorsignal-release-apk
+          path: |
+            build/app/outputs/flutter-apk/app-release.apk
+            build/release-artifacts.sha256
+          if-no-files-found: error
+          retention-days: 30
+      - name: Upload release App Bundle
+        uses: actions/upload-artifact@v5
+        with:
+          name: motorsignal-release-aab
+          path: |
+            build/app/outputs/bundle/release/app-release.aab
+            build/release-artifacts.sha256
+          if-no-files-found: error
+          retention-days: 30
+      - name: Remove signing credentials
+        if: always()
+        shell: bash
+        run: |
+          rm -f android/key.properties android/app/motorsignal-upload-keystore.jks