Merge branch 'stage' into ADFA-5446-Extension-Manager-uninstall-broken

Author: jimturner-adfa

.github/workflows/analyze.yml

@@ -105,6 +105,12 @@ jobs:
           # the unit-test compile path.
           FIREBASE_CONSOLE_URL: ${{ secrets.FIREBASE_CONSOLE_URL }}
           GLITCHTIP_DSN: ${{ secrets.GLITCHTIP_DSN }}
+          # The aapt2/d8/Compose regression tests (ADFA-4128 bugs 5/6/8) are
+          # assumption-guarded, so on a runner without an Android SDK they would skip
+          # green and take that coverage with them. This turns an absent toolchain
+          # into a hard failure instead. The runner does have an SDK - Assemble V8
+          # Debug above could not run otherwise.
+          REQUIRE_BUILD_TOOLCHAIN: "1"
         run: flox activate -d flox/base -- ./gradlew :testing:tooling:assemble :testing:common:assemble sonarqube --info --no-build-cache -x lint --continue
 
       - name: Upload JaCoCo report

.github/workflows/debug.yml

@@ -466,15 +466,15 @@ jobs:
           
           echo "Found Jira ticket: $JIRA_TICKET"
           
-          # Validate NEXT_RELEASE_VERSION exists and exactly two digits, dot, two digits
+          # Validate NEXT_RELEASE_VERSION format
           if [ -z "$NEXT_RELEASE_VERSION" ]; then
             echo "ERROR: NEXT_RELEASE_VERSION variable is not set"
             exit 1
           fi
           
-          if [[ ! "$NEXT_RELEASE_VERSION" =~ ^[0-9]{2}\.[0-9]{2}$ ]]; then
+          if [[ ! "$NEXT_RELEASE_VERSION" =~ ^[0-9]{2}\.[0-9]{2}(\.[0-9]+)?$ ]]; then
             echo "ERROR: NEXT_RELEASE_VERSION format is invalid: $NEXT_RELEASE_VERSION"
-            echo "Expected format: YY.ww (two digits, dot, two digits, e.g., 25.50)"
+            echo "Expected format: YY.ww[.patch] (e.g., 25.50 or 25.50.1)"
             exit 1
           fi
           

.github/workflows/release.yml

@@ -9,6 +9,11 @@ on:
   schedule:
     - cron: '0 12 * * *'  # Daily at 12:00 PM UTC
   workflow_dispatch:
+    inputs:
+      hotfix_version:
+        description: 'Version stamp for an off-cycle release (e.g. 26.38.1). Still merges stage into main and builds main.'
+        required: false
+        type: string
 
 env:
   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -485,15 +490,15 @@ jobs:
 
       - name: Validate release version
         env:
-          NEXT_RELEASE_VERSION: ${{ vars.NEXT_RELEASE_VERSION }}
+          NEXT_RELEASE_VERSION: ${{ github.event.inputs.hotfix_version || vars.NEXT_RELEASE_VERSION }}
         run: |
           if [ -z "$NEXT_RELEASE_VERSION" ]; then
             echo "ERROR: NEXT_RELEASE_VERSION variable is not set"
             exit 1
           fi
-          if [[ ! "$NEXT_RELEASE_VERSION" =~ ^[0-9]{2}\.[0-9]{2}$ ]]; then
+          if [[ ! "$NEXT_RELEASE_VERSION" =~ ^[0-9]{2}\.[0-9]{2}(\.[0-9]+)?$ ]]; then
             echo "ERROR: NEXT_RELEASE_VERSION format is invalid: $NEXT_RELEASE_VERSION"
-            echo "Expected format: YY.ww (two digits, dot, two digits, e.g., 25.50)"
+            echo "Expected format: YY.ww[.patch] (e.g., 25.50 or 25.50.1)"
             exit 1
           fi
           echo "Validated NEXT_RELEASE_VERSION: $NEXT_RELEASE_VERSION"
@@ -505,7 +510,7 @@ jobs:
       - name: Assemble Release APK
         env:
           INCLUDE_LLAMA_ASSETS: "true"
-          NEXT_RELEASE_VERSION: ${{ vars.NEXT_RELEASE_VERSION }}
+          NEXT_RELEASE_VERSION: ${{ github.event.inputs.hotfix_version || vars.NEXT_RELEASE_VERSION }}
         run: |
           variant_upper=$(echo "${{ matrix.variant }}" | tr '[:lower:]' '[:upper:]')
           flox activate -d flox/base -- ./gradlew :app:assemble${variant_upper}Release --no-daemon \

.github/workflows/spotless-apply.yml

@@ -0,0 +1,73 @@
+name: Spotless apply
+
+# For contributors without a shell (e.g. editing in the GitHub web UI): runs spotlessApply on a
+# branch and appends the result as a standalone commit. The push uses GITHUB_TOKEN, so it does not
+# start other workflows.
+
+permissions:
+  contents: write
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: 'Branch to format (not stage or main)'
+        required: true
+        type: string
+
+concurrency:
+  group: spotless-apply-${{ inputs.branch }}
+  cancel-in-progress: false
+
+jobs:
+  spotless_apply:
+    name: Run spotlessApply and commit
+    runs-on: self-hosted
+    timeout-minutes: 30
+    env:
+      BRANCH: ${{ inputs.branch }}
+
+    steps:
+      - name: Refuse protected branches
+        run: |
+          case "$BRANCH" in
+            stage|main)
+              echo "::error::Refusing to push to '$BRANCH'."
+              exit 1
+              ;;
+          esac
+
+      # fetch-depth 0: the Spotless ratchet compares against origin/stage.
+      - name: Checkout branch
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.branch }}
+          fetch-depth: 0
+
+      - name: Check if Nix is installed
+        run: |
+          if command -v nix >/dev/null 2>&1; then
+            echo "nix_installed=true" >> $GITHUB_ENV
+          else
+            echo "nix_installed=false" >> $GITHUB_ENV
+          fi
+
+      - name: Install Flox
+        if: env.nix_installed == 'false'
+        uses: flox/install-flox-action@v2
+
+      - name: Run spotlessApply
+        run: |
+          flox activate -d flox/base -- ./gradlew spotlessApply --no-daemon
+
+      - name: Commit and push
+        run: |
+          if git diff --quiet; then
+            echo "::notice::Already formatted. Nothing to commit."
+            exit 0
+          fi
+          git config user.name "ADFA"
+          git config user.email "dev-team@appdevforall.org"
+          git commit -am "style: spotless reformat, no functional change"
+          git push origin "HEAD:refs/heads/$BRANCH"
+          echo "::notice::Pushed $(git rev-parse --short HEAD) to $BRANCH."

.github/workflows/weekly-release.yml

@@ -2,6 +2,11 @@ name: Weekly release (manual)
 
 on:
   workflow_dispatch:
+    inputs:
+      hotfix_version:
+        description: 'Version for an off-cycle release (e.g. 26.38.1). Publishes the current build under this version instead of the CalVer week.'
+        required: false
+        type: string
 
 permissions:
   contents: read
@@ -27,12 +32,26 @@ jobs:
 
       - name: Compute CalVer version
         id: compute
+        env:
+          HOTFIX_VERSION: ${{ github.event.inputs.hotfix_version }}
         run: |
-          VERSION=$(date -u +%g.%V)
+          if [[ -n "$HOTFIX_VERSION" ]]; then
+            if [[ ! "$HOTFIX_VERSION" =~ ^[0-9]{2}\.[0-9]{2}(\.[0-9]+)?$ ]]; then
+              echo "::error::Invalid hotfix version format: $HOTFIX_VERSION"
+              exit 1
+            fi
+            VERSION="$HOTFIX_VERSION"
+          else
+            VERSION=$(date -u +%g.%V)
+          fi
           NEXT_VERSION=$(date -u -d "+7 days" +%g.%V)
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "next_version=$NEXT_VERSION" >> "$GITHUB_OUTPUT"
-          echo "Releasing $VERSION (next will be $NEXT_VERSION)"
+          if [[ -n "$HOTFIX_VERSION" ]]; then
+            echo "Releasing hotfix $VERSION (NEXT_RELEASE_VERSION left unchanged)"
+          else
+            echo "Releasing $VERSION (next will be $NEXT_VERSION)"
+          fi
 
       - name: Look up previous CalVer tag
         id: previous
@@ -41,7 +60,7 @@ jobs:
         shell: flox activate -d flox/base -- bash -eo pipefail {0}
         run: |
           PREVIOUS_TAG=$(gh release list --json tagName \
-              --jq '[.[] | select(.tagName | test("^[0-9]+\\.[0-9]+$"))] | .[0].tagName // ""')
+              --jq '[.[] | select(.tagName | test("^[0-9]+\\.[0-9]+(\\.[0-9]+)?$"))] | .[0].tagName // ""')
           echo "previous_tag=$PREVIOUS_TAG" >> "$GITHUB_OUTPUT"
           echo "Previous CalVer tag: ${PREVIOUS_TAG:-none}"
 
@@ -198,20 +217,20 @@ jobs:
             exit 0
           fi
 
+          # A hotfix cut against a superseded release must not steal the "Latest"
+          # badge from the newer release that is already published.
+          IS_LATEST=true
+          if [[ -n "$PREVIOUS_TAG" ]] \
+              && [[ "$(printf '%s\n%s\n' "$VERSION" "$PREVIOUS_TAG" | sort -V | tail -n1)" != "$VERSION" ]]; then
+            IS_LATEST=false
+          fi
+          echo "Marking $VERSION as latest: $IS_LATEST (previous tag: ${PREVIOUS_TAG:-none})"
+
+          ARGS=(--target "$GITHUB_SHA" --latest="$IS_LATEST" --title "$VERSION" --generate-notes)
           if [[ -n "$PREVIOUS_TAG" && "$PREVIOUS_TAG" != "$VERSION" ]]; then
-            gh release create "$VERSION" \
-                --target "$GITHUB_SHA" \
-                --latest \
-                --title "$VERSION" \
-                --generate-notes \
-                --notes-start-tag "$PREVIOUS_TAG"
-          else
-            gh release create "$VERSION" \
-                --target "$GITHUB_SHA" \
-                --latest \
-                --title "$VERSION" \
-                --generate-notes
+            ARGS+=(--notes-start-tag "$PREVIOUS_TAG")
           fi
+          gh release create "$VERSION" "${ARGS[@]}"
 
   upload-r2:
     needs: [prepare, pull-apk]
@@ -294,6 +313,7 @@ jobs:
           private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
       - name: Set NEXT_RELEASE_VERSION repo variable
+        if: ${{ github.event.inputs.hotfix_version == '' }}
         env:
           GH_TOKEN:     ${{ steps.app-token.outputs.token }}
           NEXT_VERSION: ${{ needs.prepare.outputs.next_version }}

.gitignore

@@ -109,6 +109,8 @@ sentry.properties
 /composite-builds/build-deps/build/
 
 /app/google-services.json
+/app/keystore-debug.jks
+
 
 # Written by the gradle-plugin tests, not by a Gradle task: writeInitScript() in
 # gradle-plugin/src/test/.../utils.kt resolves FileProvider.testHomeDir() and creates