ci: pin toolchains and verify release artifacts

Checksum-pin every downloaded toolchain archive. Before publishing,
verify the APK was built from HEAD, the tag matches versionName,
apksigner passes, and the tree is clean; publish a sha256 sidecar
and treat published assets as immutable. Compare full unsigned APKs
in verify-repro and run the Android unit tests in CI.

1 files changed, 14 insertions, 10 deletions

diff --git a/ci/verify-repro.sh b/ci/verify-repro.sh
index d412713..580ccd0 100755
--- a/ci/verify-repro.sh
+++ b/ci/verify-repro.sh
@@ -1,22 +1,26 @@
 #!/bin/sh
-# Build the native libs twice and diff them, catching nondeterminism early.
-# Requires the Android NDK and Go.
+# Build the complete unsigned APK twice and compare it byte for byte.
 set -eu
 
 root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 a=$(mktemp -d)
 b=$(mktemp -d)
-trap 'rm -rf "$a" "$b"' EXIT
+trap 'rm -rf "$a" "$b"' 0
 
-make -C "$root" native
-cp -r "$root/app/src/main/jniLibs" "$a/jniLibs"
+[ ! -f "$root/keystore.properties" ] || {
+	echo "verify-repro: keystore.properties must be absent" >&2
+	exit 1
+}
+
+make -C "$root" app
+cp "$root/app/build/outputs/apk/release/app-release-unsigned.apk" "$a/app.apk"
 
-rm -rf "$root/app/src/main/jniLibs" "$root/rsync/work" "$root/out"
-make -C "$root" native
-cp -r "$root/app/src/main/jniLibs" "$b/jniLibs"
+rm -rf "$root/app/build" "$root/app/src/main/jniLibs" "$root/rsync/work" "$root/out"
+make -C "$root" app
+cp "$root/app/build/outputs/apk/release/app-release-unsigned.apk" "$b/app.apk"
 
-if diff -r "$a/jniLibs" "$b/jniLibs"; then
-	echo "verify-repro: native libs are bit-identical"
+if cmp "$a/app.apk" "$b/app.apk"; then
+	echo "verify-repro: APKs are bit-identical"
 else
 	echo "verify-repro: NONDETERMINISM detected" >&2
 	exit 1