From 2aa6920fb1568249d2466fa1b13760d1a51c0e8f Mon Sep 17 00:00:00 2001
From: Lena <lena@omega>
Date: Wed, 1 Jul 2026 00:00:00 +0000
Subject: ci: pin toolchains and verify release artifacts

Checksum-pin every downloaded toolchain archive. Before publishing,
verify the APK was built from HEAD, the tag matches versionName,
apksigner passes, and the tree is clean; publish a sha256 sidecar
and treat published assets as immutable. Compare full unsigned APKs
in verify-repro and run the Android unit tests in CI.
---
 ci/build.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'ci/build.sh')

diff --git a/ci/build.sh b/ci/build.sh
index 5afbfd4..c99ec5f 100755
--- a/ci/build.sh
+++ b/ci/build.sh
@@ -5,8 +5,8 @@ set -eu
 
 root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 
-make -C "$root" native
 make -C "$root" app
+git -C "$root" rev-parse HEAD > "$root/app/build/outputs/apk/release/.source-commit"
 
 echo "ci: APK at app/build/outputs/apk/release/"
-ls -l "$root"/app/build/outputs/apk/release/*.apk 2>/dev/null || true
+ls -l "$root"/app/build/outputs/apk/release/*.apk
-- 
cgit v1.2.3