@@ -79,7 +79,7 @@ jobs:
           # Firebase config).  Scoped to this step so SonarCloud and other
           # third-party actions never see them.
           FIREBASE_CONSOLE_URL: ${{ secrets.FIREBASE_CONSOLE_URL }}
-          SENTRY_DSN_DEBUG: ${{ secrets.SENTRY_DSN_DEBUG }}
+          GLITCHTIP_DSN: ${{ secrets.GLITCHTIP_DSN }}
         run: |
           echo "gradle_time_start=$(date +%s)" >> $GITHUB_ENV
           flox activate -d flox/base -- ./gradlew :app:assembleV8Debug --no-daemon
@@ -104,7 +104,7 @@ jobs:
           # The Gradle build also drives Sentry/Firebase configuration during
           # the unit-test compile path.
           FIREBASE_CONSOLE_URL: ${{ secrets.FIREBASE_CONSOLE_URL }}
-          SENTRY_DSN_DEBUG: ${{ secrets.SENTRY_DSN_DEBUG }}
+          GLITCHTIP_DSN: ${{ secrets.GLITCHTIP_DSN }}
         run: flox activate -d flox/base -- ./gradlew :testing:tooling:assemble :testing:common:assemble sonarqube --info --no-build-cache -x lint --continue
 
       - name: Upload JaCoCo report
 
@@ -4,6 +4,7 @@ permissions:
   id-token: write
   contents: read
   actions: write
+  pull-requests: read
 
 on:
   push:
@@ -27,7 +28,7 @@ env:
   ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.MVN_SIGNING_KEY_ID }}
   ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.MVN_SIGNING_KEY_PASSWORD }}
   FIREBASE_CONSOLE_URL: ${{ secrets.FIREBASE_CONSOLE_URL }}
-  SENTRY_DSN_DEBUG: ${{ secrets.SENTRY_DSN_DEBUG }}
+  GLITCHTIP_DSN: ${{ secrets.GLITCHTIP_DSN }}
 
 jobs:
   check_changes:
@@ -70,11 +71,73 @@ jobs:
             echo "must_build=true" >> $GITHUB_OUTPUT
           fi
 
+  validate_branch:
+    name: Validate branch and Jira ticket
+    runs-on: self-hosted
+    outputs:
+      branch_type: ${{ steps.classify.outputs.branch_type }}
+      jira_ticket: ${{ steps.classify.outputs.jira_ticket }}
+    steps:
+      - name: Classify branch
+        id: classify
+        run: |
+          BRANCH_NAME=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
+          echo "Branch name: $BRANCH_NAME"
+
+          JIRA_TICKET=""
+          if [[ "$BRANCH_NAME" == community/* ]]; then
+            BRANCH_TYPE="community"
+            echo "Community contribution branch detected, Jira steps will be skipped"
+          else
+            JIRA_TICKET=$(echo "$BRANCH_NAME" | grep -o 'ADFA-[0-9]\+' | head -1)
+
+            if [ -n "$JIRA_TICKET" ]; then
+              BRANCH_TYPE="jira"
+              echo "Jira branch detected with ticket $JIRA_TICKET"
+            else
+              BRANCH_TYPE="internal"
+              echo "Internal branch detected, proceeding with current automation"
+            fi
+          fi
+
+          echo "branch_type=$BRANCH_TYPE" >> $GITHUB_OUTPUT
+          echo "jira_ticket=$JIRA_TICKET" >> $GITHUB_OUTPUT
+
+      - name: Fail fast on nonexistent Jira ticket
+        if: steps.classify.outputs.branch_type == 'jira'
+        env:
+          JIRA_EMAIL: ${{ secrets.JIRA_EMAIL }}
+          JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+          JIRA_TICKET: ${{ steps.classify.outputs.jira_ticket }}
+        run: |
+          if [ -z "$JIRA_EMAIL" ] || [ -z "$JIRA_API_TOKEN" ]; then
+            echo "::warning::Jira credentials are not configured; skipping validation of $JIRA_TICKET"
+            exit 0
+          fi
+
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            -u "$JIRA_EMAIL:$JIRA_API_TOKEN" \
+            -H "Accept: application/json" \
+            "https://appdevforall.atlassian.net/rest/api/3/issue/${JIRA_TICKET}?fields=summary") || HTTP_STATUS="000"
+
+          if [ "$HTTP_STATUS" -eq 404 ]; then
+            echo "::error::Jira ticket $JIRA_TICKET does not exist. Rename the branch to reference a real ticket, or use the community/ prefix for contributions without Jira access."
+            exit 1
+          fi
+
+          # Only a definitive 404 blocks the build; outages or auth issues must not
+          if [ "$HTTP_STATUS" -ne 200 ]; then
+            echo "::warning::Could not validate Jira ticket $JIRA_TICKET (HTTP $HTTP_STATUS); proceeding"
+            exit 0
+          fi
+
+          echo "Jira ticket $JIRA_TICKET exists"
+
   build_apk:
     name: Build Universal APK
     runs-on: self-hosted
     timeout-minutes: 60
-    needs: check_changes
+    needs: [ check_changes, validate_branch ]
     if: needs.check_changes.outputs.must_build == 'true'
     env:
       INCLUDE_LLAMA_ASSETS: "false"
@@ -134,12 +197,6 @@ jobs:
         run: |
           flox activate -d flox/base -- ./gradlew :plugin-api:apiCheck --no-daemon
 
-      - name: Clean build cache before assembly
-        run: |
-          echo "Cleaning stale build artifacts..."
-          rm -rf app/build/
-          echo "Build cache cleaned successfully"
-
       - name: Assemble Universal APK
         run: |
           echo "gradle_time_start=$(date +%s)" >> $GITHUB_ENV
@@ -159,6 +216,8 @@ jobs:
           
           if [[ "${BRANCH_NAME,,}" == "stage" ]]; then
             BUILD_TYPE="STAGE"
+          elif [[ "$BRANCH_NAME" == community/* ]]; then
+            BUILD_TYPE="COMMUNITY ($BRANCH_NAME)"
           else
             BUILD_TYPE="BRANCH ($BRANCH_NAME)"
           fi
@@ -191,12 +250,18 @@ jobs:
         id: extract_jira
         env:
           COMMIT_MSG: ${{ steps.pr_info.outputs.COMMIT_MSG }}
+          BRANCH_TYPE: ${{ needs.validate_branch.outputs.branch_type }}
         run: |
-          JIRA_TICKET=$(echo "$BRANCH_NAME" | grep -o 'ADFA-[0-9]\+' | head -1)
+          if [[ "$BRANCH_TYPE" == "community" ]]; then
+            echo "Community branch, skipping Jira ticket extraction"
+            JIRA_TICKET=""
+          else
+            JIRA_TICKET=$(echo "$BRANCH_NAME" | grep -o 'ADFA-[0-9]\+' | head -1)
 
-          # If no Jira ticket found in branch name, check the commit message
-          if [ -z "$JIRA_TICKET" ]; then
-            JIRA_TICKET=$(echo "$COMMIT_MSG" | grep -o 'ADFA-[0-9]\+' | head -1)
+            # If no Jira ticket found in branch name, check the commit message
+            if [ -z "$JIRA_TICKET" ]; then
+              JIRA_TICKET=$(echo "$COMMIT_MSG" | grep -o 'ADFA-[0-9]\+' | head -1)
+            fi
           fi
 
           if [ -n "$JIRA_TICKET" ]; then
@@ -313,6 +378,7 @@ jobs:
           JIRA_EMAIL: ${{ secrets.JIRA_EMAIL }}
           JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
           NEXT_RELEASE_VERSION: ${{ vars.NEXT_RELEASE_VERSION }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           # Try to get Jira ticket from extract_jira step output first (handles branch name and commit message)
           JIRA_TICKET="${{ steps.extract_jira.outputs.JIRA_TICKET }}"
@@ -324,6 +390,41 @@ jobs:
           fi
           
           if [ -z "$JIRA_TICKET" ] || [ "$JIRA_TICKET" == "N/A" ]; then
+            # The branch here is always stage, so identify the merged PR that
+            # introduced this commit to tell community merges from internal ones
+            PR_JSON=$(curl -s \
+              -H "Authorization: Bearer $GH_TOKEN" \
+              -H "Accept: application/vnd.github+json" \
+              "https://api.github.com/repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/pulls") || PR_JSON="[]"
+
+            MERGED_PR=$(echo "$PR_JSON" | jq -c 'if type == "array" then [.[] | select(.merged_at != null)][0] // {} else {} end')
+            HEAD_REF=$(echo "$MERGED_PR" | jq -r '.head.ref // ""')
+            HEAD_REPO=$(echo "$MERGED_PR" | jq -r '.head.repo.full_name // ""')
+            AUTHOR_ASSOCIATION=$(echo "$MERGED_PR" | jq -r '.author_association // ""')
+            echo "Merged PR head: ${HEAD_REPO}:${HEAD_REF} (author association: ${AUTHOR_ASSOCIATION:-unknown})"
+
+            if [[ "$HEAD_REF" == community/* ]]; then
+              echo "::warning::Community branch merged without a Jira ticket; skipping fix version update"
+              exit 0
+            fi
+
+            # Author association is the primary community signal; the fork check
+            # only decides when no association is available
+            case "$AUTHOR_ASSOCIATION" in
+              MEMBER|OWNER|COLLABORATOR)
+                ;;
+              "")
+                if [ -n "$HEAD_REPO" ] && [ "$HEAD_REPO" != "$GITHUB_REPOSITORY" ]; then
+                  echo "::warning::Fork contribution merged without a Jira ticket; skipping fix version update"
+                  exit 0
+                fi
+                ;;
+              *)
+                echo "::warning::External contribution merged without a Jira ticket; skipping fix version update"
+                exit 0
+                ;;
+            esac
+
             echo "ERROR: No Jira ticket found in branch name, commit message, or merge commit"
             echo "Branch name or commit message must contain a Jira ticket in format ADFA-XXXX"
             exit 1
@@ -383,11 +484,14 @@ jobs:
             exit 1
           fi
 
-      - name: Clean up build folder after upload
+      - name: Clean up APK output after upload
         run: |
-          echo "Cleaning up build folder after Firebase upload..."
-          rm -rf app/build/
-          echo "Build folder cleanup completed"
+          echo "Removing built APK(s) after Firebase upload..."
+          # Only remove the packaged APKs (prevents 'Find APK file' from picking a
+          # stale APK on the next run). Compiled intermediates are preserved so the
+          # next build compiles :app incrementally instead of from scratch.
+          rm -rf app/build/outputs/apk/
+          echo "APK output cleanup completed"
 
       - name: Send Rich Slack Notification
         env:
 
@@ -0,0 +1,65 @@
+name: Lint Branch Name
+
+# Runs on pull_request_target so it can comment on pull requests from forks.
+# It must never check out or execute code from the pull request.
+on:
+  pull_request_target:
+    types: [ opened, reopened, synchronize ]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  lint_branch_name:
+    name: Check external PR branch name
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.head.repo.full_name != github.repository
+    steps:
+      - name: Ask external contributors to use the community/ prefix
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const branch = context.payload.pull_request.head.ref;
+            const association = context.payload.pull_request.author_association;
+
+            if (['MEMBER', 'OWNER', 'COLLABORATOR'].includes(association)) {
+              core.info(`PR author association is ${association}; internal branch conventions apply.`);
+              return;
+            }
+
+            if (branch.startsWith('community/') || !/adfa-\d+/i.test(branch)) {
+              core.info(`Branch name "${branch}" is valid for an external contribution.`);
+              return;
+            }
+
+            const marker = '<!-- lint-branch-name -->';
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              per_page: 100,
+            });
+
+            const alreadyCommented = comments.some(
+              comment => comment.body && comment.body.includes(marker)
+            );
+
+            if (!alreadyCommented) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number,
+                body: [
+                  marker,
+                  'Thanks for contributing to CodeOnTheGo!',
+                  '',
+                  `Your branch \`${branch}\` uses the \`ADFA-\` prefix, which is reserved for internal branches linked to our Jira board. External pull requests cannot be linked to Jira tickets, so our automation expects community branches to use the \`community/\` prefix instead.`,
+                  '',
+                  'Please rename your branch to start with `community/` (for example `community/fix-editor-crash`) and update this pull request.',
+                ].join('\n'),
+              });
+            }
+
+            core.setFailed(
+              `External contribution branch "${branch}" must not use the ADFA- prefix. Rename it to start with community/.`
+            );
@@ -25,10 +25,7 @@ env:
   ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.MVN_SIGNING_KEY_ID }}
   ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.MVN_SIGNING_KEY_PASSWORD }}
   FIREBASE_CONSOLE_URL: ${{ secrets.FIREBASE_CONSOLE_URL }}
-  SENTRY_DSN_RELEASE: ${{ secrets.SENTRY_DSN_RELEASE }}
-  SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
-  SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
-  SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+  GLITCHTIP_DSN: ${{ secrets.GLITCHTIP_DSN }}
 
 jobs:
   merge_stage_to_main:
 
@@ -10,7 +10,10 @@ agree to abide the terms specified in the [CODE OF CONDUCT](./CODE_OF_CONDUCT.md
 
 ## Git Pre-Commit Hook: Branch Name Enforcement
 
-This project enforces a strict branch naming policy using a Git pre-commit hook.
+This project enforces a strict branch naming policy using a Git pre-commit hook. These formats
+are for core-team contributions that reference an internal ticket. If you are a community
+contributor without access to that ticket system, use the `community/` prefix instead — see
+[Community contributions](#community-contributions).
 
 ### Allowed Branch Formats:
 - `ADFA-123` (3 to 5 digit number)
@@ -59,6 +62,22 @@ To contribute to this project,
 - Make your changes.
 - Create a pull request that includes a meaningful title and description.
 
+## Community contributions
+
+External contributors don't have access to our internal ticket system, so the `ADFA-` branch
+naming and ticket validation used by the core team don't apply to you.
+
+- After forking (see [Propose a change](#propose-a-change)), name your branch with the
+  `community/` prefix followed by a short, descriptive summary — for example
+  `community/fix-editor-crash`.
+- Do **not** use the `ADFA-` prefix. It is reserved for internal branches linked to a ticket.
+  When a pull request from a fork uses an `ADFA-` branch name, the **Lint Branch Name** check
+  comments on the pull request and fails until you rename the branch to start with `community/`.
+
+The branch-name pre-commit hook above enforces the `ADFA-` format, so it is meant for the core
+team — community contributors don't need to install it. On `community/` branches, our build
+pipeline automatically skips the ticket-specific steps and runs the rest of the checks as usual.
+
 ## Report issues 
 
 [Report issues and request features here](https://github.com/appdevforall/CodeOnTheGo/issues).