Merge remote-tracking branch 'adfa/stage' into ADFA-4397

# Conflicts:
#	app/src/main/java/com/itsaky/androidide/app/DeviceProtectedApplicationLoader.kt

Author: alome007

.github/workflows/debug.yml

@@ -4,6 +4,7 @@ permissions:
   id-token: write
   contents: read
   actions: write
+  pull-requests: read
 
 on:
   push:
@@ -70,11 +71,73 @@ jobs:
             echo "must_build=true" >> $GITHUB_OUTPUT
           fi
 
+  validate_branch:
+    name: Validate branch and Jira ticket
+    runs-on: self-hosted
+    outputs:
+      branch_type: ${{ steps.classify.outputs.branch_type }}
+      jira_ticket: ${{ steps.classify.outputs.jira_ticket }}
+    steps:
+      - name: Classify branch
+        id: classify
+        run: |
+          BRANCH_NAME=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
+          echo "Branch name: $BRANCH_NAME"
+
+          JIRA_TICKET=""
+          if [[ "$BRANCH_NAME" == community/* ]]; then
+            BRANCH_TYPE="community"
+            echo "Community contribution branch detected, Jira steps will be skipped"
+          else
+            JIRA_TICKET=$(echo "$BRANCH_NAME" | grep -o 'ADFA-[0-9]\+' | head -1)
+
+            if [ -n "$JIRA_TICKET" ]; then
+              BRANCH_TYPE="jira"
+              echo "Jira branch detected with ticket $JIRA_TICKET"
+            else
+              BRANCH_TYPE="internal"
+              echo "Internal branch detected, proceeding with current automation"
+            fi
+          fi
+
+          echo "branch_type=$BRANCH_TYPE" >> $GITHUB_OUTPUT
+          echo "jira_ticket=$JIRA_TICKET" >> $GITHUB_OUTPUT
+
+      - name: Fail fast on nonexistent Jira ticket
+        if: steps.classify.outputs.branch_type == 'jira'
+        env:
+          JIRA_EMAIL: ${{ secrets.JIRA_EMAIL }}
+          JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+          JIRA_TICKET: ${{ steps.classify.outputs.jira_ticket }}
+        run: |
+          if [ -z "$JIRA_EMAIL" ] || [ -z "$JIRA_API_TOKEN" ]; then
+            echo "::warning::Jira credentials are not configured; skipping validation of $JIRA_TICKET"
+            exit 0
+          fi
+
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            -u "$JIRA_EMAIL:$JIRA_API_TOKEN" \
+            -H "Accept: application/json" \
+            "https://appdevforall.atlassian.net/rest/api/3/issue/${JIRA_TICKET}?fields=summary") || HTTP_STATUS="000"
+
+          if [ "$HTTP_STATUS" -eq 404 ]; then
+            echo "::error::Jira ticket $JIRA_TICKET does not exist. Rename the branch to reference a real ticket, or use the community/ prefix for contributions without Jira access."
+            exit 1
+          fi
+
+          # Only a definitive 404 blocks the build; outages or auth issues must not
+          if [ "$HTTP_STATUS" -ne 200 ]; then
+            echo "::warning::Could not validate Jira ticket $JIRA_TICKET (HTTP $HTTP_STATUS); proceeding"
+            exit 0
+          fi
+
+          echo "Jira ticket $JIRA_TICKET exists"
+
   build_apk:
     name: Build Universal APK
     runs-on: self-hosted
     timeout-minutes: 60
-    needs: check_changes
+    needs: [ check_changes, validate_branch ]
     if: needs.check_changes.outputs.must_build == 'true'
     env:
       INCLUDE_LLAMA_ASSETS: "false"
@@ -130,6 +193,10 @@ jobs:
           echo "$GOOGLE_SERVICES_JSON" > app/google-services.json
           echo "google-services.json created successfully"
 
+      - name: Verify plugin-api binary compatibility
+        run: |
+          flox activate -d flox/base -- ./gradlew :plugin-api:apiCheck --no-daemon
+
       - name: Assemble Universal APK
         run: |
           echo "gradle_time_start=$(date +%s)" >> $GITHUB_ENV
@@ -149,6 +216,8 @@ jobs:
           
           if [[ "${BRANCH_NAME,,}" == "stage" ]]; then
             BUILD_TYPE="STAGE"
+          elif [[ "$BRANCH_NAME" == community/* ]]; then
+            BUILD_TYPE="COMMUNITY ($BRANCH_NAME)"
           else
             BUILD_TYPE="BRANCH ($BRANCH_NAME)"
           fi
@@ -181,12 +250,18 @@ jobs:
         id: extract_jira
         env:
           COMMIT_MSG: ${{ steps.pr_info.outputs.COMMIT_MSG }}
+          BRANCH_TYPE: ${{ needs.validate_branch.outputs.branch_type }}
         run: |
-          JIRA_TICKET=$(echo "$BRANCH_NAME" | grep -o 'ADFA-[0-9]\+' | head -1)
+          if [[ "$BRANCH_TYPE" == "community" ]]; then
+            echo "Community branch, skipping Jira ticket extraction"
+            JIRA_TICKET=""
+          else
+            JIRA_TICKET=$(echo "$BRANCH_NAME" | grep -o 'ADFA-[0-9]\+' | head -1)
 
-          # If no Jira ticket found in branch name, check the commit message
-          if [ -z "$JIRA_TICKET" ]; then
-            JIRA_TICKET=$(echo "$COMMIT_MSG" | grep -o 'ADFA-[0-9]\+' | head -1)
+            # If no Jira ticket found in branch name, check the commit message
+            if [ -z "$JIRA_TICKET" ]; then
+              JIRA_TICKET=$(echo "$COMMIT_MSG" | grep -o 'ADFA-[0-9]\+' | head -1)
+            fi
           fi
 
           if [ -n "$JIRA_TICKET" ]; then
@@ -303,6 +378,7 @@ jobs:
           JIRA_EMAIL: ${{ secrets.JIRA_EMAIL }}
           JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
           NEXT_RELEASE_VERSION: ${{ vars.NEXT_RELEASE_VERSION }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           # Try to get Jira ticket from extract_jira step output first (handles branch name and commit message)
           JIRA_TICKET="${{ steps.extract_jira.outputs.JIRA_TICKET }}"
@@ -314,6 +390,41 @@ jobs:
           fi
           
           if [ -z "$JIRA_TICKET" ] || [ "$JIRA_TICKET" == "N/A" ]; then
+            # The branch here is always stage, so identify the merged PR that
+            # introduced this commit to tell community merges from internal ones
+            PR_JSON=$(curl -s \
+              -H "Authorization: Bearer $GH_TOKEN" \
+              -H "Accept: application/vnd.github+json" \
+              "https://api.github.com/repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/pulls") || PR_JSON="[]"
+
+            MERGED_PR=$(echo "$PR_JSON" | jq -c 'if type == "array" then [.[] | select(.merged_at != null)][0] // {} else {} end')
+            HEAD_REF=$(echo "$MERGED_PR" | jq -r '.head.ref // ""')
+            HEAD_REPO=$(echo "$MERGED_PR" | jq -r '.head.repo.full_name // ""')
+            AUTHOR_ASSOCIATION=$(echo "$MERGED_PR" | jq -r '.author_association // ""')
+            echo "Merged PR head: ${HEAD_REPO}:${HEAD_REF} (author association: ${AUTHOR_ASSOCIATION:-unknown})"
+
+            if [[ "$HEAD_REF" == community/* ]]; then
+              echo "::warning::Community branch merged without a Jira ticket; skipping fix version update"
+              exit 0
+            fi
+
+            # Author association is the primary community signal; the fork check
+            # only decides when no association is available
+            case "$AUTHOR_ASSOCIATION" in
+              MEMBER|OWNER|COLLABORATOR)
+                ;;
+              "")
+                if [ -n "$HEAD_REPO" ] && [ "$HEAD_REPO" != "$GITHUB_REPOSITORY" ]; then
+                  echo "::warning::Fork contribution merged without a Jira ticket; skipping fix version update"
+                  exit 0
+                fi
+                ;;
+              *)
+                echo "::warning::External contribution merged without a Jira ticket; skipping fix version update"
+                exit 0
+                ;;
+            esac
+
             echo "ERROR: No Jira ticket found in branch name, commit message, or merge commit"
             echo "Branch name or commit message must contain a Jira ticket in format ADFA-XXXX"
             exit 1
@@ -373,11 +484,14 @@ jobs:
             exit 1
           fi
 
-      - name: Clean up build folder after upload
+      - name: Clean up APK output after upload
         run: |
-          echo "Cleaning up build folder after Firebase upload..."
-          rm -rf app/build/
-          echo "Build folder cleanup completed"
+          echo "Removing built APK(s) after Firebase upload..."
+          # Only remove the packaged APKs (prevents 'Find APK file' from picking a
+          # stale APK on the next run). Compiled intermediates are preserved so the
+          # next build compiles :app incrementally instead of from scratch.
+          rm -rf app/build/outputs/apk/
+          echo "APK output cleanup completed"
 
       - name: Send Rich Slack Notification
         env:

.github/workflows/lint-branch-name.yml

@@ -0,0 +1,65 @@
+name: Lint Branch Name
+
+# Runs on pull_request_target so it can comment on pull requests from forks.
+# It must never check out or execute code from the pull request.
+on:
+  pull_request_target:
+    types: [ opened, reopened, synchronize ]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  lint_branch_name:
+    name: Check external PR branch name
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.head.repo.full_name != github.repository
+    steps:
+      - name: Ask external contributors to use the community/ prefix
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const branch = context.payload.pull_request.head.ref;
+            const association = context.payload.pull_request.author_association;
+
+            if (['MEMBER', 'OWNER', 'COLLABORATOR'].includes(association)) {
+              core.info(`PR author association is ${association}; internal branch conventions apply.`);
+              return;
+            }
+
+            if (branch.startsWith('community/') || !/adfa-\d+/i.test(branch)) {
+              core.info(`Branch name "${branch}" is valid for an external contribution.`);
+              return;
+            }
+
+            const marker = '<!-- lint-branch-name -->';
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              per_page: 100,
+            });
+
+            const alreadyCommented = comments.some(
+              comment => comment.body && comment.body.includes(marker)
+            );
+
+            if (!alreadyCommented) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number,
+                body: [
+                  marker,
+                  'Thanks for contributing to CodeOnTheGo!',
+                  '',
+                  `Your branch \`${branch}\` uses the \`ADFA-\` prefix, which is reserved for internal branches linked to our Jira board. External pull requests cannot be linked to Jira tickets, so our automation expects community branches to use the \`community/\` prefix instead.`,
+                  '',
+                  'Please rename your branch to start with `community/` (for example `community/fix-editor-crash`) and update this pull request.',
+                ].join('\n'),
+              });
+            }
+
+            core.setFailed(
+              `External contribution branch "${branch}" must not use the ADFA- prefix. Rename it to start with community/.`
+            );

.github/workflows/release.yml

@@ -483,12 +483,29 @@ jobs:
           echo "$GOOGLE_SERVICES_JSON" > app/google-services.json
           echo "google-services.json created successfully"
 
+      - name: Validate release version
+        env:
+          NEXT_RELEASE_VERSION: ${{ vars.NEXT_RELEASE_VERSION }}
+        run: |
+          if [ -z "$NEXT_RELEASE_VERSION" ]; then
+            echo "ERROR: NEXT_RELEASE_VERSION variable is not set"
+            exit 1
+          fi
+          if [[ ! "$NEXT_RELEASE_VERSION" =~ ^[0-9]{2}\.[0-9]{2}$ ]]; then
+            echo "ERROR: NEXT_RELEASE_VERSION format is invalid: $NEXT_RELEASE_VERSION"
+            echo "Expected format: YY.ww (two digits, dot, two digits, e.g., 25.50)"
+            exit 1
+          fi
+          echo "Validated NEXT_RELEASE_VERSION: $NEXT_RELEASE_VERSION"
+
       - name: Assemble Release APK
         env:
           INCLUDE_LLAMA_ASSETS: "true"
+          NEXT_RELEASE_VERSION: ${{ vars.NEXT_RELEASE_VERSION }}
         run: |
           variant_upper=$(echo "${{ matrix.variant }}" | tr '[:lower:]' '[:upper:]')
           flox activate -d flox/base -- ./gradlew :app:assemble${variant_upper}Release --no-daemon \
+            -Pnext_release_version="$NEXT_RELEASE_VERSION" \
             -Dorg.gradle.jvmargs="-Xmx10g -XX:MaxMetaspaceSize=2g -XX:+HeapDumpOnOutOfMemoryError --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED" \
             -Dandroid.aapt2.daemonHeapSize=4096M \
             -Dorg.gradle.workers.max=1 \

.gitignore

@@ -152,7 +152,6 @@ gradle-plugin/bin/
 logger/bin/
 lookup/bin/
 shared/bin/
-llama-api/bin/
 subprojects/**/bin/
 testing/**/bin/
 
@@ -165,3 +164,31 @@ compose-preview/src/main/assets/compose/
 # Generated stdlib index (generated at build time by :lsp:kotlin-stdlib-generator)
 lsp/kotlin/src/main/resources/stdlib-index.json
 
+# Large asset files (bootstrap, SDK archives, databases, dependencies)
+assets/bootstrap-*.zip
+assets/android-sdk-*.zip
+assets/release/**/data/**/*.zip.br
+assets/release/**/dynamic_libs/
+assets/documentation.db
+assets/localMvnRepository.zip
+assets/gradle-*.zip
+app/src/release/assets/database/documentation.db
+app/src/main/assets/database/documentation
+app/src/main/assets/database/documentation.db
+
+# AI plugin development artifacts (moved to plugin-examples repo)
+*.cgp
+*-logs.txt
+logs*.txt
+screenshot*.png
+agent-tab*.png
+ai-assistant-plugin.md
+agent-to-plugin-migration.md
+BUILD_*.md
+EMBEDDING_*.md
+LLAMA_*.md
+MACOS_*.md
+NATIVE_*.md
+TEST_*.md
+assets-*.zip
+dynamic_libs/*.aar.br

CONTRIBUTING.md

@@ -10,7 +10,10 @@ agree to abide the terms specified in the [CODE OF CONDUCT](./CODE_OF_CONDUCT.md
 
 ## Git Pre-Commit Hook: Branch Name Enforcement
 
-This project enforces a strict branch naming policy using a Git pre-commit hook.
+This project enforces a strict branch naming policy using a Git pre-commit hook. These formats
+are for core-team contributions that reference an internal ticket. If you are a community
+contributor without access to that ticket system, use the `community/` prefix instead — see
+[Community contributions](#community-contributions).
 
 ### Allowed Branch Formats:
 - `ADFA-123` (3 to 5 digit number)
@@ -59,6 +62,22 @@ To contribute to this project,
 - Make your changes.
 - Create a pull request that includes a meaningful title and description.
 
+## Community contributions
+
+External contributors don't have access to our internal ticket system, so the `ADFA-` branch
+naming and ticket validation used by the core team don't apply to you.
+
+- After forking (see [Propose a change](#propose-a-change)), name your branch with the
+  `community/` prefix followed by a short, descriptive summary — for example
+  `community/fix-editor-crash`.
+- Do **not** use the `ADFA-` prefix. It is reserved for internal branches linked to a ticket.
+  When a pull request from a fork uses an `ADFA-` branch name, the **Lint Branch Name** check
+  comments on the pull request and fails until you rename the branch to start with `community/`.
+
+The branch-name pre-commit hook above enforces the `ADFA-` format, so it is meant for the core
+team — community contributors don't need to install it. On `community/` branches, our build
+pipeline automatically skips the ticket-specific steps and runs the rest of the checks as usual.
+
 ## Report issues 
 
 [Report issues and request features here](https://github.com/appdevforall/CodeOnTheGo/issues).