From 2aa6920fb1568249d2466fa1b13760d1a51c0e8f Mon Sep 17 00:00:00 2001
From: Lena <lena@omega>
Date: Wed, 1 Jul 2026 00:00:00 +0000
Subject: ci: pin toolchains and verify release artifacts

Checksum-pin every downloaded toolchain archive. Before publishing,
verify the APK was built from HEAD, the tag matches versionName,
apksigner passes, and the tree is clean; publish a sha256 sidecar
and treat published assets as immutable. Compare full unsigned APKs
in verify-repro and run the Android unit tests in CI.
---
 app/build.gradle | 1 +
 1 file changed, 1 insertion(+)

(limited to 'app/build.gradle')

diff --git a/app/build.gradle b/app/build.gradle
index 5cc640d..599b419 100644
--- a/app/build.gradle
+++ b/app/build.gradle
@@ -11,6 +11,7 @@ def keystoreProps = rootProject.file('keystore.properties')
 android {
     namespace 'invalid.lena.rsend'
     compileSdk 35
+    buildToolsVersion '35.0.0'
 
     defaultConfig {
         applicationId 'invalid.lena.rsend'
-- 
cgit v1.2.3