ci: pin toolchains and verify release artifacts

Checksum-pin every downloaded toolchain archive. Before publishing,
verify the APK was built from HEAD, the tag matches versionName,
apksigner passes, and the tree is clean; publish a sha256 sidecar
and treat published assets as immutable. Compare full unsigned APKs
in verify-repro and run the Android unit tests in CI.

1 files changed, 16 insertions, 5 deletions

diff --git a/ci/test.sh b/ci/test.sh
index 5c141e5..2e6b14d 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -1,12 +1,14 @@
 #!/bin/sh
-# Host-verifiable checks: pinned source checksum, Go formatting, vet, and tests
-# (including the real-rsync-through-rsh end-to-end). Needs Go and rsync; no
-# Android toolchain. This is what runs on every push.
+# Full checks: source pins, Go formatting/vet/tests, real-rsync integration,
+# and Android JVM tests. Requires the provisioned toolchain and host rsync.
 set -eu
 
 root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 . "$root/versions"
 
+command -v rsync >/dev/null 2>&1 || { echo "ci: rsync is required" >&2; exit 1; }
+command -v gradle >/dev/null 2>&1 || { echo "ci: gradle is required" >&2; exit 1; }
+
 if [ -f "$root/rsync/rsync-${RSYNC_VERSION}.tar.gz" ]; then
 	echo "ci: verifying pinned rsync checksum"
 	( cd "$root/rsync" && sha256sum -c "rsync-${RSYNC_VERSION}.tar.gz.sha256" )
@@ -16,15 +18,21 @@ fi
 # a shell file); fail loud if they drift.
 echo "ci: version pins"
 pin() {
-	grep -q "$2" "$root/$1" || { echo "ci: $1 does not pin '$2' (see versions)" >&2; exit 1; }
+	grep -Fq "$2" "$root/$1" || { echo "ci: $1 does not pin '$2' (see versions)" >&2; exit 1; }
 }
 pin build.gradle "version '${AGP_VERSION}'"
 pin build.gradle "version '${KOTLIN_VERSION}'"
 pin gradle/wrapper/gradle-wrapper.properties "gradle-${GRADLE_VERSION}-bin.zip"
 pin app/build.gradle "compileSdk ${ANDROID_PLATFORM}"
+pin app/build.gradle "buildToolsVersion '${ANDROID_BUILD_TOOLS}'"
 pin app/build.gradle "minSdk ${ANDROID_MIN_SDK}"
 pin app/build.gradle "targetSdk ${ANDROID_TARGET_SDK}"
-pin rsh/go.mod "^go ${GO_VERSION}"
+pin rsh/go.mod "go ${GO_VERSION}"
+pin app/build.gradle "androidx.core:core-ktx:${ANDROIDX_CORE_VERSION}"
+pin app/build.gradle "androidx.appcompat:appcompat:${ANDROIDX_APPCOMPAT_VERSION}"
+pin app/build.gradle "androidx.work:work-runtime-ktx:${ANDROIDX_WORK_VERSION}"
+pin app/build.gradle "junit:junit:${JUNIT_VERSION}"
+pin app/build.gradle "org.json:json:${JSON_VERSION}"
 
 echo "ci: gofmt"
 unformatted=$(gofmt -l "$root/rsh")
@@ -40,4 +48,7 @@ echo "ci: go vet"
 echo "ci: go test"
 ( cd "$root/rsh" && go test ./... )
 
+echo "ci: Android unit tests"
+( cd "$root" && gradle :app:testReleaseUnitTest )
+
 echo "ci: ok"