Merge pull request 'release: v2.7.1 — privacy-respecting crash reporting' (#9) from feat/crash-report into main

Reviewed-on: #9

.gitea/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,23 @@
+---
+name: Bug report
+about: Something doesn't work the way it should
+title: ""
+labels:
+  - bug
+---
+
+### What happened
+
+
+### What you expected
+
+
+### Steps to reproduce
+1.
+2.
+3.
+
+### Environment
+- Calendula version: <!-- Settings → bottom of the screen -->
+- Android version:
+- Device:

.gitea/ISSUE_TEMPLATE/crash_report.md

@@ -0,0 +1,26 @@
+---
+name: Crash report
+about: Report a crash. Calendula can capture this for you (Settings → Report a problem, or the prompt after a crash) — it copies the report to your clipboard and prefills this form.
+title: "Crash: "
+labels:
+  - bug
+  - crash
+---
+
+<!--
+Thanks for reporting a crash in Calendula!
+
+If the app prefilled this for you, the crash report is already below — just add
+what you were doing and submit. Otherwise, paste the report from your clipboard
+into the code block. The report contains only app/Android/device versions and the
+stack trace — no personal data or calendar content.
+-->
+
+### What happened
+
+
+### Crash report
+
+```
+(paste the crash report here)
+```

.gitea/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,16 @@
+---
+name: Feature request
+about: Suggest an idea or improvement
+title: ""
+labels:
+  - enhancement
+---
+
+### What would you like Calendula to do?
+
+
+### Why — what problem does it solve?
+
+
+### Anything else
+<!-- mockups, examples from other apps, alternatives you considered -->

.gitea/workflows/ci.yaml

@@ -1,18 +1,23 @@
 name: CI
 
+# One gate per pull request. Branch pushes no longer trigger CI on their own,
+# so a change is built once on its PR (covering feature -> release/* and
+# release/* -> main) instead of once per push and again on the merge to main.
+# The merge itself is handled by release.yaml, which only does heavy work when
+# the merge actually cuts a release.
 on:
-  push:
-    branches:
-      - '**'
-    tags-ignore:
-      - '**'
+  pull_request:
 
-# Cancel superseded runs on the same branch.
+# Cancel superseded runs for the same PR.
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
+  # Single job named `ci` so the required "CI" status check is always reported,
+  # even for docs-only PRs: those just skip the Android build and the job still
+  # succeeds (fast green check) instead of being filtered out and leaving the
+  # required check pending forever.
   ci:
     runs-on: docker
     env:
@@ -21,14 +26,37 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # Full history so the base..HEAD diff below has a merge-base.
+          fetch-depth: 0
+
+      # Decide whether anything that affects the app build changed. Docs,
+      # F-Droid metadata and the licence don't, so those PRs skip the SDK +
+      # Gradle work below but still report a green `ci`.
+      - name: Classify change scope
+        id: scope
+        run: |
+          set -e
+          BASE="${{ github.base_ref }}"
+          git fetch --no-tags --depth=1 origin "$BASE"
+          CHANGED=$(git diff --name-only "origin/$BASE...HEAD")
+          echo "Changed files:"; echo "$CHANGED"
+          if echo "$CHANGED" | grep -vE '(\.md$|^docs/|^fdroid-metadata/|^LICENSE$)' | grep -q .; then
+            echo "code=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "code=false" >> "$GITHUB_OUTPUT"
+            echo "Docs/metadata-only change — skipping the Android build."
+          fi
 
       - name: Setup Java
+        if: steps.scope.outputs.code == 'true'
         uses: actions/setup-java@v4
         with:
           distribution: 'zulu'
           java-version: '17'
 
       - name: Setup Android SDK
+        if: steps.scope.outputs.code == 'true'
         uses: android-actions/setup-android@v3
         with:
           # Default ("tools platform-tools") drags in the Android Emulator
@@ -36,12 +64,14 @@ jobs:
           packages: ''
 
       - name: Setup Android SDK cache
+        if: steps.scope.outputs.code == 'true'
         uses: actions/cache@v4
         with:
           path: /opt/android-sdk
           key: ${{ runner.os }}-android-sdk-37-36.0.0
 
       - name: Install Android SDK packages
+        if: steps.scope.outputs.code == 'true'
         run: |
           yes | sdkmanager --licenses >/dev/null || true
           sdkmanager \
@@ -50,6 +80,7 @@ jobs:
             "build-tools;36.0.0"
 
       - name: Setup Gradle cache
+        if: steps.scope.outputs.code == 'true'
         uses: actions/cache@v4
         with:
           path: |
@@ -60,21 +91,25 @@ jobs:
             ${{ runner.os }}-gradle-
 
       - name: Grant execute permission for gradlew
+        if: steps.scope.outputs.code == 'true'
         run: chmod +x ./gradlew
 
       # No --no-daemon: the daemon lives only as long as this job container
       # and lets the following steps skip JVM startup + reconfiguration.
       - name: Lint (debug variant only)
+        if: steps.scope.outputs.code == 'true'
         run: ./gradlew lintDebug
 
       - name: Unit tests
+        if: steps.scope.outputs.code == 'true'
         run: ./gradlew testDebugUnitTest
 
       - name: Assemble debug APK
+        if: steps.scope.outputs.code == 'true'
         run: ./gradlew assembleDebug
 
       - name: Trivy filesystem scan
-        if: github.ref == 'refs/heads/main'
+        if: steps.scope.outputs.code == 'true'
         run: |
           set -e
           SUDO=""

.gitea/workflows/release.yaml

@@ -1,75 +1,84 @@
 name: Release — F-Droid repo + Gitea release
 
+# A release is cut by merging a release branch into main with a bumped
+# versionName (see docs/RELEASING.md). This workflow reads that versionName and,
+# if no matching tag exists yet, runs tests, builds + signs the APK, publishes
+# it to the F-Droid repo, and only then creates the vX.Y.Z tag + Gitea release
+# itself — the tag is an output of the pipeline, not its trigger. Ordinary
+# merges (no version bump) fall through `detect` and do nothing.
+#
+# A manual workflow_dispatch (from a branch) runs the re-sign-only recovery
+# path: it re-signs the existing F-Droid index with the repo key and re-uploads,
+# without building an APK or creating a release. Used for key rotation / repo
+# recovery.
 on:
   push:
-    tags:
-      - '*'
+    branches: [main]
   workflow_dispatch:
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 jobs:
-  ci:
+  # Cheap gate: resolve the version from the committed build.gradle and decide
+  # whether this push actually cuts a new release (no tag for it yet). Keeps the
+  # heavy job from running on every merge to main.
+  detect:
     runs-on: docker
-    env:
-      ANDROID_HOME: /opt/android-sdk
-      ANDROID_SDK_ROOT: /opt/android-sdk
+    outputs:
+      is_release: ${{ steps.v.outputs.is_release }}
+      version: ${{ steps.v.outputs.version }}
+      version_code: ${{ steps.v.outputs.version_code }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Setup Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: 'zulu'
-          java-version: '17'
-
-      - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
-        with:
-          packages: ''
-
-      - name: Setup Android SDK cache
-        uses: actions/cache@v4
-        with:
-          path: /opt/android-sdk
-          key: ${{ runner.os }}-android-sdk-37-36.0.0
-
-      - name: Install Android SDK packages
+      - name: Resolve version and whether it is a new release
+        id: v
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
         run: |
-          yes | sdkmanager --licenses >/dev/null || true
-          sdkmanager \
-            "platform-tools" \
-            "platforms;android-37.0" \
-            "build-tools;36.0.0"
+          set -e
+          VERSION=$(grep -oP 'versionName\s*=\s*"\K[^"]+' app/build.gradle.kts)
+          if [ -z "$VERSION" ]; then echo "No versionName in app/build.gradle.kts" >&2; exit 1; fi
+          MAJOR=$(echo "$VERSION" | cut -d. -f1); MINOR=$(echo "$VERSION" | cut -d. -f2); PATCH=$(echo "$VERSION" | cut -d. -f3)
+          MAJOR=${MAJOR:-0}; MINOR=${MINOR:-0}; PATCH=${PATCH:-0}
+          VERSION_CODE=$(( MAJOR * 10000 + MINOR * 100 + PATCH ))
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "version_code=$VERSION_CODE" >> "$GITHUB_OUTPUT"
+          echo "Resolved version $VERSION (code $VERSION_CODE)"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "Manual dispatch — re-sign path, not a release."
+            echo "is_release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          # A tag for this version already existing means the release shipped on
+          # an earlier push; do nothing. Absent => this merge cuts the release.
+          STATUS=$(curl -s -o /dev/null -w '%{http_code}' \
+            -H "Authorization: token $TOKEN" "$API/git/refs/tags/v$VERSION")
+          if [ "$STATUS" = "200" ]; then
+            echo "Tag v$VERSION already exists — nothing to release."
+            echo "is_release=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "No tag for v$VERSION yet — cutting the release."
+            echo "is_release=true" >> "$GITHUB_OUTPUT"
+          fi
 
-      - name: Setup Gradle cache
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'gradle/libs.versions.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-gradle-
-
-      - name: Grant execute permission for gradlew
-        run: chmod +x ./gradlew
-
-      # Lint already enforced on every push to main via ci.yaml.
-      # Release sanity only re-runs tests + a debug build to catch
-      # any tag-resolved drift (e.g. version code substitution issues).
-
-      - name: Unit tests
-        run: ./gradlew testDebugUnitTest
-
-      - name: Assemble debug APK (sanity)
-        run: ./gradlew assembleDebug
-
-  build-and-deploy:
-    needs: ci
+  # Releases: build + sign + publish, then mint the tag and Gitea release.
+  # Also runs on manual dispatch, where it skips the build and just re-signs and
+  # re-uploads the existing index (recovery path).
+  release:
+    needs: detect
+    if: needs.detect.outputs.is_release == 'true' || github.event_name == 'workflow_dispatch'
     runs-on: docker
     env:
       ANDROID_HOME: /opt/android-sdk
       ANDROID_SDK_ROOT: /opt/android-sdk
+      VERSION: ${{ needs.detect.outputs.version }}
+      VERSION_CODE: ${{ needs.detect.outputs.version_code }}
+      IS_RELEASE: ${{ needs.detect.outputs.is_release }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -121,31 +130,26 @@ jobs:
             $SUDO apk add --no-cache jq
           fi
 
-      # Tag-only build steps. On a manual workflow_dispatch (ref = a branch,
-      # not a tag) these are skipped: the job then just re-signs the existing
-      # index with the configured repo key and re-uploads — used for key
-      # rotation / repo recovery without publishing a new APK.
-      - name: Set version from git tag
-        if: startsWith(github.ref, 'refs/tags/')
+      - name: Grant execute permission for gradlew
+        run: chmod +x ./gradlew
+
+      # The committed versionName is the source of truth. Pin versionCode to the
+      # value derived from it so the published APK's code is always
+      # MAJOR*10000 + MINOR*100 + PATCH even if the committed code was forgotten.
+      - name: Pin versionCode to versionName
+        if: env.IS_RELEASE == 'true'
         run: |
           set -e
-          RAW_TAG="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
-          VERSION="${RAW_TAG#v}"
-          MAJOR=$(echo "$VERSION" | cut -d. -f1)
-          MINOR=$(echo "$VERSION" | cut -d. -f2)
-          PATCH=$(echo "$VERSION" | cut -d. -f3)
-          MAJOR=${MAJOR:-0}; MINOR=${MINOR:-0}; PATCH=${PATCH:-0}
-          VERSION_CODE=$(( MAJOR * 10000 + MINOR * 100 + PATCH ))
-          echo "Version: $VERSION, VersionCode: $VERSION_CODE"
-          sed -i "s/versionName = \".*\"/versionName = \"$VERSION\"/" app/build.gradle.kts
           sed -i "s/versionCode = .*/versionCode = $VERSION_CODE/" app/build.gradle.kts
           grep -E 'versionName|versionCode' app/build.gradle.kts
-          # Export for later steps (F-Droid changelog, mapping asset name).
-          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
-          echo "VERSION_CODE=$VERSION_CODE" >> "$GITHUB_ENV"
+
+      # Test the exact commit being shipped (only on a real release).
+      - name: Unit tests
+        if: env.IS_RELEASE == 'true'
+        run: ./gradlew testDebugUnitTest
 
       - name: Setup Android Keystore
-        if: startsWith(github.ref, 'refs/tags/')
+        if: env.IS_RELEASE == 'true'
         env:
           KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
           KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
@@ -160,11 +164,8 @@ jobs:
           storeFile=upload-keystore.jks
           EOF
 
-      - name: Grant execute permission for gradlew
-        run: chmod +x ./gradlew
-
       - name: Build release APK
-        if: startsWith(github.ref, 'refs/tags/')
+        if: env.IS_RELEASE == 'true'
         run: ./gradlew assembleRelease
 
       - name: Setup F-Droid Server Tools
@@ -202,8 +203,7 @@ jobs:
           set -euo pipefail
           # Fail loudly if the repo key is not configured. NEVER auto-generate
           # one: a fresh key changes the repo fingerprint and breaks every
-          # user's pinned repo. (Replaces the old `fdroid update --create-key`
-          # path, which silently rotated the key on a wiped server.)
+          # user's pinned repo.
           if [ -z "${FDROID_KEYSTORE_BASE64:-}" ] || [ -z "${FDROID_CONFIG_BASE64:-}" ]; then
             echo "ERROR: FDROID_KEYSTORE_BASE64 / FDROID_CONFIG_BASE64 secrets are not set." >&2
             echo "Refusing to continue — will not auto-generate a new repo key." >&2
@@ -216,28 +216,23 @@ jobs:
           mkdir -p fdroid/repo/icons
 
       - name: Copy new APK to repo
-        if: startsWith(github.ref, 'refs/tags/')
+        if: env.IS_RELEASE == 'true'
         run: |
           set -e
           mkdir -p fdroid/repo
-          REF_NAME="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
-          SAFE_REF_NAME="$(echo "$REF_NAME" | tr '/ ' '__' | tr -cd '[:alnum:]_.-')"
-          if [ -z "$SAFE_REF_NAME" ]; then
-            SAFE_REF_NAME="${GITHUB_SHA:-manual}"
-          fi
-          cp app/build/outputs/apk/release/app-release.apk "fdroid/repo/calendula_${SAFE_REF_NAME}.apk"
+          cp app/build/outputs/apk/release/app-release.apk "fdroid/repo/calendula_v${VERSION}.apk"
 
       - name: Copy metadata to F-Droid repo
         run: |
           mkdir -p fdroid/metadata
           cp -r fdroid-metadata/* fdroid/metadata/
 
-      # Per-version "What's New" for F-Droid clients: the tag's CHANGELOG
+      # Per-version "What's New" for F-Droid clients: this version's CHANGELOG
       # section written to changelogs/<versionCode>.txt (same extraction as the
       # Gitea release notes). en-US only — F-Droid falls back to it for locales
       # without their own changelog. fdroid update bakes this into the index.
       - name: Generate F-Droid changelog for this version
-        if: startsWith(github.ref, 'refs/tags/')
+        if: env.IS_RELEASE == 'true'
         run: |
           set -e
           awk -v ver="$VERSION" '
@@ -272,97 +267,46 @@ jobs:
           SFTP
           # Publish the signed repo/ plus metadata/ (descriptions, screenshots,
           # per-version changelogs) so changelog history survives across
-          # releases. keystore.p12 and config.yml are NEVER uploaded, so they
-          # can't re-enter the web-served tree; nginx serves only repo/ anyway.
+          # releases. keystore.p12 and config.yml are NEVER uploaded.
           sshpass -p "$PASS" scp $SSH_OPTS -r fdroid/repo fdroid/metadata "$USER@$HOST:dev/fdroid/"
 
-      # Archive the R8 mapping so user crash stacktraces stay deobfuscatable.
-      # Attached to the Gitea release (it's not an APK, so it fits the
-      # no-binaries rule). Best-effort: never fail a release over it.
-      - name: Attach R8 mapping to Gitea release
-        if: startsWith(github.ref, 'refs/tags/')
-        continue-on-error: true
+      # The APK is published and the index re-signed — now record the release.
+      # Creating it with target_commitish makes Gitea create the vX.Y.Z tag at
+      # this commit, so the tag only ever marks a fully-shipped release (and a
+      # failure before here leaves no tag, so re-running the workflow retries).
+      - name: Create tag + Gitea release
+        if: env.IS_RELEASE == 'true'
         env:
           TOKEN: ${{ secrets.GITHUB_TOKEN }}
           API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+          SHA: ${{ github.sha }}
         run: |
           set -e
-          MAP="app/build/outputs/mapping/release/mapping.txt"
-          if [ ! -f "$MAP" ]; then echo "No mapping.txt (R8 off?) — skipping."; exit 0; fi
-          TAG="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
-          ASSET="mapping-${VERSION:-$TAG}.txt.gz"
-          gzip -c "$MAP" > "/tmp/$ASSET"
-          # The release is created by the gitea-release job; ensure it exists
-          # (idempotent) so this job doesn't race it to a 404.
-          ID=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" | jq -r '.id // empty')
-          if [ -z "$ID" ]; then
-            ID=$(curl -s -X POST -H "Authorization: token $TOKEN" \
-              -H "Content-Type: application/json" \
-              -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\"}" \
-              "$API/releases" | jq -r '.id // empty')
-          fi
-          if [ -z "$ID" ]; then echo "Could not resolve release id — skipping."; exit 0; fi
-          # Replace any prior asset of the same name (re-run safe).
-          OLD=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/$ID/assets" \
-            | jq -r --arg n "$ASSET" '.[] | select(.name==$n) | .id')
-          [ -n "$OLD" ] && curl -s -X DELETE -H "Authorization: token $TOKEN" "$API/releases/$ID/assets/$OLD" >/dev/null || true
-          curl -s -X POST -H "Authorization: token $TOKEN" \
-            -F "attachment=@/tmp/$ASSET" \
-            "$API/releases/$ID/assets?name=$ASSET" -o /dev/null -w "asset upload HTTP %{http_code}\n"
-
-  # A Gitea release per tag, carrying the tag's CHANGELOG section as its
-  # notes. Deliberately no APK assets — distribution stays with the F-Droid
-  # repo; the release is the human-readable record. Gated on the tests-only
-  # ci job (not the deploy) so notes appear even if the F-Droid upload has
-  # an infrastructure hiccup.
-  gitea-release:
-    needs: ci
-    if: startsWith(github.ref, 'refs/tags/')
-    runs-on: docker
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Extract changelog section for this tag
-        run: |
-          set -e
-          TAG="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
-          VERSION="${TAG#v}"
-          # Everything between "## [<version>]" and the next "## [" heading.
+          TAG="v$VERSION"
+          # Notes = this version's CHANGELOG section.
           awk -v ver="$VERSION" '
             $0 ~ "^## \\[" ver "\\]" { flag = 1; next }
             /^## \[/ { flag = 0 }
             flag' CHANGELOG.md > release-notes.md
-          # Trim leading blank lines.
           sed -i -e '/./,$!d' release-notes.md
           if [ ! -s release-notes.md ]; then
             echo "_No changelog entry for ${VERSION} — see CHANGELOG.md._" > release-notes.md
           fi
-          echo "--- release notes ---"
-          cat release-notes.md
-
-      - name: Create Gitea release
-        env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
-        run: |
-          set -e
-          TAG="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
-          python3 - "$TAG" <<'PY' > payload.json
+          python3 - "$TAG" "$SHA" <<'PY' > payload.json
           import json, sys
           print(json.dumps({
               "tag_name": sys.argv[1],
+              "target_commitish": sys.argv[2],
               "name": sys.argv[1],
               "body": open("release-notes.md").read(),
               "draft": False,
               "prerelease": False,
           }))
           PY
-          # Upsert: the build-and-deploy job may have created a bare release
-          # first (to attach the mapping asset), so PATCH the notes if it
-          # exists, otherwise POST a new one. Both paths are re-run safe.
+          # Upsert (re-run safe): PATCH if a release for the tag already exists,
+          # else POST a new one (which also creates the tag at target_commitish).
           curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" > existing.json
-          ID=$(python3 -c "import json,sys; d=json.load(open('existing.json')); print(d.get('id',''))" 2>/dev/null || true)
+          ID=$(jq -r '.id // empty' existing.json 2>/dev/null || true)
           if [ -n "$ID" ]; then
             CODE=$(curl -s -o response.json -w '%{http_code}' -X PATCH \
               -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
@@ -376,6 +320,33 @@ jobs:
           fi
           cat response.json
           if [ "$CODE" != "$OK" ]; then
-            echo "Release upsert failed with HTTP $CODE (expected $OK)"
+            echo "Release upsert failed with HTTP $CODE (expected $OK)" >&2
             exit 1
           fi
+          echo "Created/updated release $TAG at $SHA"
+
+      # Archive the R8 mapping so user crash stacktraces stay deobfuscatable.
+      # Attached to the release (it's not an APK, so it fits the no-binaries
+      # rule). Best-effort: never fail a release over it.
+      - name: Attach R8 mapping to Gitea release
+        if: env.IS_RELEASE == 'true'
+        continue-on-error: true
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+        run: |
+          set -e
+          MAP="app/build/outputs/mapping/release/mapping.txt"
+          if [ ! -f "$MAP" ]; then echo "No mapping.txt (R8 off?) — skipping."; exit 0; fi
+          TAG="v$VERSION"
+          ASSET="mapping-${VERSION}.txt.gz"
+          gzip -c "$MAP" > "/tmp/$ASSET"
+          ID=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" | jq -r '.id // empty')
+          if [ -z "$ID" ]; then echo "Could not resolve release id — skipping."; exit 0; fi
+          # Replace any prior asset of the same name (re-run safe).
+          OLD=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/$ID/assets" \
+            | jq -r --arg n "$ASSET" '.[] | select(.name==$n) | .id')
+          [ -n "$OLD" ] && curl -s -X DELETE -H "Authorization: token $TOKEN" "$API/releases/$ID/assets/$OLD" >/dev/null || true
+          curl -s -X POST -H "Authorization: token $TOKEN" \
+            -F "attachment=@/tmp/$ASSET" \
+            "$API/releases/$ID/assets?name=$ASSET" -o /dev/null -w "asset upload HTTP %{http_code}\n"

.gitea/workflows/translations.yaml

@@ -4,11 +4,7 @@ name: Translations
 # only touch values-*/strings.xml) get quick feedback without the full Android
 # build. The deeper checks still run in CI via lintDebug (ExtraTranslation).
 on:
-  push:
-    branches:
-      - '**'
-    tags-ignore:
-      - '**'
+  pull_request:
     paths:
       - 'app/src/main/res/values*/strings.xml'
       - 'app/src/main/res/xml/locales_config.xml'

CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.7.2] — 2026-06-21
+
+### Added
+- Crash reporting you control. If Calendula closes unexpectedly, it now captures
+  a technical report and, on the next launch, offers to send it as an issue on
+  the project's tracker. Nothing is uploaded automatically — the report stays on
+  your device until you choose to share it, it contains no personal data or
+  calendar content (only the app, Android and device versions plus the stack
+  trace), and you see the full text before sending. There's also a "Report a
+  problem" entry in Settings, and if the app ever fails to start repeatedly, a
+  minimal recovery screen still lets you send the report.
+
+## [2.7.1] — 2026-06-21
+
+### Fixed
+- Fixed the app crashing immediately on launch whenever calendar access hadn't
+  been granted yet (a fresh install, or after revoking the permission). The app
+  set up its live calendar-change listener before the permission screen could
+  appear, which newer Android versions reject outright — so the app died before
+  you could grant access. The listener now waits for the permission and attaches
+  itself the moment it's granted.
+
 ## [2.7.0] — 2026-06-18
 
 ### Added

app/build.gradle.kts

@@ -23,13 +23,13 @@ android {
         applicationId = "de.jeanlucmakiola.calendula"
         minSdk = 29
         targetSdk = 36
-        // The git tag is the single source of truth for released builds: at
-        // release time .gitea/workflows/release.yaml derives both fields from
-        // the tag, with versionCode = MAJOR*10000 + MINOR*100 + PATCH
-        // (e.g. v2.0.0 -> 20000). These committed values are the dev/local
-        // default; keep them matching the latest released tag. See docs/RELEASING.md.
-        versionCode = 20700
-        versionName = "2.7.0"
+        // These committed values ARE the source of truth for a release: merging
+        // a bumped versionName into main triggers .gitea/workflows/release.yaml,
+        // which builds this version and then creates the matching vX.Y.Z tag +
+        // release itself (versionCode is pinned to MAJOR*10000 + MINOR*100 +
+        // PATCH from versionName, e.g. 2.7.2 -> 20702). See docs/RELEASING.md.
+        versionCode = 20702
+        versionName = "2.7.2"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }
@@ -61,6 +61,21 @@ android {
             applicationIdSuffix = ".debug"
             isMinifyEnabled = false
         }
+        // A locally-installable twin of `release`: same R8 shrinking + obfuscation
+        // and resource shrinking, but debug-signed and given its own applicationId
+        // suffix so it installs alongside both the production app (signed with the
+        // real key) and the debug build. Used to smoke-test a release candidate on
+        // a real device before tagging — R8-only breakage and first-run/permission
+        // states don't surface in the unminified debug build, nor on a device that
+        // already holds the permission. Never published. See docs/RELEASING.md.
+        create("releaseTest") {
+            initWith(getByName("release"))
+            applicationIdSuffix = ".releasetest"
+            signingConfig = signingConfigs.getByName("debug")
+            isMinifyEnabled = true
+            isShrinkResources = true
+            matchingFallbacks += "release"
+        }
     }
 
     compileOptions {

app/src/main/AndroidManifest.xml

@@ -68,6 +68,15 @@
                 android:resource="@xml/shortcuts" />
         </activity>
 
+        <!-- Standalone surface for a captured crash report. MainActivity routes
+             here on a startup crash-loop, so it stays clear of the app's Hilt
+             graph and Compose content. Not exported: launched only by us. -->
+        <activity
+            android:name=".ui.crash.CrashReportActivity"
+            android:exported="false"
+            android:excludeFromRecents="true"
+            android:launchMode="singleTask" />
+
         <!-- The provider broadcasts EVENT_REMINDER at reminder time but posts
              no notification itself — a calendar app must (v1.4, Etar model).
              Exported: the broadcast arrives from the provider's process. -->

app/src/main/java/de/jeanlucmakiola/calendula/CalendulaApp.kt

@@ -2,10 +2,19 @@ package de.jeanlucmakiola.calendula
 
 import android.app.Application
 import dagger.hilt.android.HiltAndroidApp
+import de.jeanlucmakiola.calendula.data.crash.CrashReporter
 
 /**
  * Application entry point. Registered as android:name=".CalendulaApp"
  * in AndroidManifest.xml. Hilt initializes its component graph here.
  */
 @HiltAndroidApp
-class CalendulaApp : Application()
+class CalendulaApp : Application() {
+
+    override fun onCreate() {
+        super.onCreate()
+        // Install first thing so startup crashes are captured too (privacy-
+        // respecting, on-device; the user submits the report by hand).
+        CrashReporter.install(this)
+    }
+}

app/src/main/java/de/jeanlucmakiola/calendula/MainActivity.kt

@@ -18,9 +18,13 @@ import androidx.core.net.toUri
 import androidx.hilt.navigation.compose.hiltViewModel
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import dagger.hilt.android.AndroidEntryPoint
+import de.jeanlucmakiola.calendula.data.crash.CrashReporter
 import de.jeanlucmakiola.calendula.data.prefs.ThemeMode
 import de.jeanlucmakiola.calendula.ui.RootScreen
 import de.jeanlucmakiola.calendula.ui.WidgetNavRequest
+import de.jeanlucmakiola.calendula.ui.crash.CrashReportActivity
+import de.jeanlucmakiola.calendula.ui.crash.CrashReportDialog
+import de.jeanlucmakiola.calendula.ui.crash.submitCrashReport
 import de.jeanlucmakiola.calendula.ui.settings.SettingsViewModel
 import de.jeanlucmakiola.calendula.ui.theme.CalendulaTheme
 import kotlinx.datetime.LocalDate
@@ -41,12 +45,31 @@ class MainActivity : AppCompatActivity() {
     // by CalendarHost's import flow.
     private var requestedImportUri by mutableStateOf<Uri?>(null)
 
+    // A captured crash report awaiting the user's decision, surfaced as a dialog
+    // over the calendar on the next launch (the single-crash path). A startup
+    // crash-loop is handled out of band, before setContent — see below.
+    private var pendingCrashReport by mutableStateOf<String?>(null)
+
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
+
+        // If the app keeps crashing as it starts, the main UI can't be trusted
+        // to come up — route to the standalone report screen instead of
+        // re-entering the crashing graph.
+        if (CrashReporter.isCrashLoop(this)) {
+            startActivity(
+                Intent(this, CrashReportActivity::class.java)
+                    .addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK),
+            )
+            finish()
+            return
+        }
+
         enableEdgeToEdge()
         requestedDetailKey = intent.detailKeyOrNull()
         requestedNav = intent.navRequestOrNull()
         requestedImportUri = intent.importUriOrNull()
+        if (CrashReporter.shouldPrompt(this)) pendingCrashReport = CrashReporter.pendingReport(this)
         setContent {
             // One activity-scoped SettingsViewModel drives both the theme here
             // and the Settings screen, so a theme change applies app-wide at once.
@@ -70,10 +93,32 @@ class MainActivity : AppCompatActivity() {
                     requestedImportUri = requestedImportUri,
                     onImportConsumed = { requestedImportUri = null },
                 )
+                pendingCrashReport?.let { report ->
+                    CrashReportDialog(
+                        report = report,
+                        onSend = {
+                            submitCrashReport(this@MainActivity, report)
+                            CrashReporter.clearReport(this@MainActivity)
+                            pendingCrashReport = null
+                        },
+                        onDismiss = {
+                            // Keep the report (Settings can still reach it); just
+                            // stop it popping on every launch.
+                            CrashReporter.dismissPrompt(this@MainActivity)
+                            pendingCrashReport = null
+                        },
+                    )
+                }
             }
         }
     }
 
+    override fun onResume() {
+        super.onResume()
+        // Reaching a running UI means startup succeeded; reset the loop trail.
+        CrashReporter.markHealthy(this)
+    }
+
     override fun onNewIntent(intent: Intent) {
         super.onNewIntent(intent)
         intent.detailKeyOrNull()?.let { requestedDetailKey = it }

app/src/main/java/de/jeanlucmakiola/calendula/data/calendar/CalendarDataSource.kt

@@ -1,9 +1,11 @@
 package de.jeanlucmakiola.calendula.data.calendar
 
+import android.Manifest
 import android.content.ContentResolver
 import android.content.ContentUris
 import android.content.ContentValues
 import android.content.Context
+import android.content.pm.PackageManager
 import android.database.ContentObserver
 import android.database.Cursor
 import android.net.Uri
@@ -11,6 +13,7 @@ import android.os.Handler
 import android.os.Looper
 import android.provider.CalendarContract
 import android.util.Log
+import androidx.core.content.ContextCompat
 import dagger.hilt.android.qualifiers.ApplicationContext
 import de.jeanlucmakiola.calendula.domain.Attendee
 import de.jeanlucmakiola.calendula.domain.CalendarSource
@@ -162,14 +165,52 @@ class AndroidCalendarDataSource @Inject constructor(
 ) : CalendarDataSource {
 
     private val resolver: ContentResolver get() = context.contentResolver
-    private val observers = mutableMapOf<() -> Unit, ContentObserver>()
 
-    override fun calendars(): List<CalendarSource> = resolver.query(
-        CalendarContract.Calendars.CONTENT_URI,
-        CalendarProjection.COLUMNS,
-        null, null,
-        CalendarContract.Calendars.CALENDAR_DISPLAY_NAME + " ASC",
-    )?.use { it.mapAll(::toCalendarSource) } ?: emptyList()
+    // All access to these two collections is guarded by [observerLock] because
+    // listeners are registered on the main thread (repository init, via ViewModel
+    // creation) while [ensureObserversRegistered] runs on the IO dispatcher.
+    private val observerLock = Any()
+    private val observers = mutableMapOf<() -> Unit, ContentObserver>()
+    private val registeredObservers = mutableSetOf<ContentObserver>()
+
+    private fun hasCalendarPermission(): Boolean =
+        ContextCompat.checkSelfPermission(context, Manifest.permission.READ_CALENDAR) ==
+            PackageManager.PERMISSION_GRANTED
+
+    /**
+     * Attach any not-yet-registered observers to the provider, but only once the
+     * calendar permission is held. Registering a ContentObserver on the calendar
+     * provider without that permission throws SecurityException on newer Android
+     * (it used to silently no-op), which crashed the app at launch — the repo
+     * registers its observer eagerly, before the permission gate. Called from the
+     * observed reads ([calendars]/[instances]) so the observer re-attaches the
+     * first time a screen queries after the permission is granted.
+     */
+    private fun ensureObserversRegistered() {
+        if (!hasCalendarPermission()) return
+        synchronized(observerLock) {
+            if (registeredObservers.size == observers.size) return
+            observers.values.forEach(::registerObserverLocked)
+        }
+    }
+
+    private fun registerObserverLocked(obs: ContentObserver) {
+        if (obs in registeredObservers || !hasCalendarPermission()) return
+        runCatching {
+            resolver.registerContentObserver(CalendarContract.CONTENT_URI, true, obs)
+        }.onSuccess { registeredObservers += obs }
+            .onFailure { Log.w(TAG, "Calendar observer registration skipped", it) }
+    }
+
+    override fun calendars(): List<CalendarSource> {
+        ensureObserversRegistered()
+        return resolver.query(
+            CalendarContract.Calendars.CONTENT_URI,
+            CalendarProjection.COLUMNS,
+            null, null,
+            CalendarContract.Calendars.CALENDAR_DISPLAY_NAME + " ASC",
+        )?.use { it.mapAll(::toCalendarSource) } ?: emptyList()
+    }
 
     /**
      * Calendar-row writes must address the provider as a sync adapter and name
@@ -204,7 +245,8 @@ class AndroidCalendarDataSource @Inject constructor(
             putDescription(description)
         }
         val uri = resolver.insert(localCalendarsUri(), values)
-            ?: throw WriteFailedException("create local calendar '$name'")
+            // No calendar name in the message — it can reach a crash report.
+            ?: throw WriteFailedException("create local calendar")
         return ContentUris.parseId(uri)
     }
 
@@ -242,6 +284,7 @@ class AndroidCalendarDataSource @Inject constructor(
     }
 
     override fun instances(beginMillis: Long, endMillis: Long): List<EventInstance> {
+        ensureObserversRegistered()
         val uri = CalendarContract.Instances.CONTENT_URI.buildUpon().apply {
             ContentUris.appendId(this, beginMillis)
             ContentUris.appendId(this, endMillis)
@@ -685,7 +728,8 @@ class AndroidCalendarDataSource @Inject constructor(
                     is String -> cv.put(column, value)
                     is Long -> cv.put(column, value)
                     is Int -> cv.put(column, value)
-                    else -> error("Unsupported value for $column: $value")
+                    // Only the type, never the value — a cell value can be event content.
+                    else -> error("Unsupported value type for column '$column': ${value::class.simpleName}")
                 }
             }
         }
@@ -718,16 +762,20 @@ class AndroidCalendarDataSource @Inject constructor(
                 listener()
             }
         }
-        observers[listener] = obs
-        resolver.registerContentObserver(
-            CalendarContract.CONTENT_URI,
-            /* notifyForDescendants = */ true,
-            obs,
-        )
+        synchronized(observerLock) {
+            observers[listener] = obs
+            // Attach now if we already hold the permission; otherwise it stays
+            // pending and re-attaches on the first read after the grant.
+            registerObserverLocked(obs)
+        }
     }
 
     override fun unregisterChangeListener(listener: () -> Unit) {
-        observers.remove(listener)?.let { resolver.unregisterContentObserver(it) }
+        synchronized(observerLock) {
+            observers.remove(listener)?.let { obs ->
+                if (registeredObservers.remove(obs)) resolver.unregisterContentObserver(obs)
+            }
+        }
     }
 
     private fun queryAttendees(eventId: Long): List<Attendee> = resolver.query(

app/src/main/java/de/jeanlucmakiola/calendula/data/crash/CrashReporter.kt

@@ -0,0 +1,188 @@
+package de.jeanlucmakiola.calendula.data.crash
+
+import android.content.Context
+import android.content.pm.PackageInfo
+import android.os.Build
+import androidx.core.content.pm.PackageInfoCompat
+import java.io.File
+import java.io.PrintWriter
+import java.io.StringWriter
+import java.time.Instant
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+import java.util.Locale
+
+/**
+ * Privacy-respecting crash capture (prod-readiness item 10). On an uncaught
+ * exception it writes a self-contained report to the app's private storage and
+ * then chains to the platform's default handler, so the process still dies
+ * normally (and the OS shows its own "stopped" dialog). Nothing is uploaded —
+ * the app holds no `INTERNET` permission. The user submits the report later,
+ * by hand, as a Gitea issue (see the ui/crash surfaces).
+ *
+ * The report is built from a fixed [CrashContext] allowlist — app/Android/device
+ * version, locale, time, and the stack trace — and **nothing else**: no device
+ * identifiers, no account names, no calendar/event content, no logcat. The user
+ * is always shown the full text before it leaves the device.
+ */
+object CrashReporter {
+
+    /**
+     * Install the handler. Called first thing in `CalendulaApp.onCreate()` so it
+     * also catches crashes during startup. The handler swallows nothing — it
+     * persists, then delegates to the previously-registered handler.
+     */
+    fun install(context: Context) {
+        val appContext = context.applicationContext
+        val previous = Thread.getDefaultUncaughtExceptionHandler()
+        Thread.setDefaultUncaughtExceptionHandler { thread, throwable ->
+            // Capturing must never mask the original crash, so guard every step.
+            runCatching {
+                val now = System.currentTimeMillis()
+                writeReport(appContext, buildCrashReport(CrashContext.from(appContext), throwable, now))
+                recordCrashTime(appContext, now)
+            }
+            previous?.uncaughtException(thread, throwable)
+        }
+    }
+
+    /** The persisted report from the last crash, or null if there is none. */
+    fun pendingReport(context: Context): String? {
+        val file = reportFile(context)
+        return if (file.exists()) runCatching { file.readText() }.getOrNull()?.takeIf { it.isNotBlank() } else null
+    }
+
+    /**
+     * Whether to surface the report unprompted (on the next launch): a report
+     * exists and the user hasn't already waved this one away. Settings reaches
+     * the report via [pendingReport] regardless, so "Not now" only stops the
+     * auto-prompt — it doesn't discard the report.
+     */
+    fun shouldPrompt(context: Context): Boolean =
+        reportFile(context).exists() && !dismissedFile(context).exists()
+
+    /** Stop auto-prompting for the current report without discarding it. */
+    fun dismissPrompt(context: Context) {
+        runCatching { dismissedFile(context).apply { parentFile?.mkdirs() }.writeText("") }
+    }
+
+    /** Drop the persisted report once the user has reported it (or from Settings). */
+    fun clearReport(context: Context) {
+        runCatching { reportFile(context).delete() }
+        runCatching { dismissedFile(context).delete() }
+    }
+
+    /**
+     * Whether the app appears to be in a startup crash-loop: at least
+     * [LOOP_THRESHOLD] crashes inside [LOOP_WINDOW_MS]. In that case the main UI
+     * can't be trusted to start, so the caller routes straight to the standalone
+     * report screen instead of re-entering the crashing graph.
+     */
+    fun isCrashLoop(context: Context): Boolean {
+        val times = readCrashTimes(context)
+        if (times.size < LOOP_THRESHOLD) return false
+        val recent = times.sortedDescending()
+        return recent[0] - recent[LOOP_THRESHOLD - 1] <= LOOP_WINDOW_MS
+    }
+
+    /**
+     * Mark the app as having started successfully, resetting the loop counter so
+     * an ordinary single crash much later never trips loop detection. The
+     * pending report itself is kept — only the timing trail is cleared.
+     */
+    fun markHealthy(context: Context) {
+        runCatching { timesFile(context).delete() }
+    }
+
+    // --- persistence -------------------------------------------------------
+
+    private fun writeReport(context: Context, report: String) {
+        val file = reportFile(context).apply { parentFile?.mkdirs() }
+        file.writeText(report.take(MAX_REPORT_CHARS))
+        // A fresh crash should prompt again, even if the previous one was waved away.
+        runCatching { dismissedFile(context).delete() }
+    }
+
+    private fun recordCrashTime(context: Context, nowMillis: Long) {
+        val kept = (readCrashTimes(context) + nowMillis).takeLast(MAX_TIMES)
+        timesFile(context).apply { parentFile?.mkdirs() }
+            .writeText(kept.joinToString("\n"))
+    }
+
+    private fun readCrashTimes(context: Context): List<Long> {
+        val file = timesFile(context)
+        if (!file.exists()) return emptyList()
+        return runCatching { file.readLines().mapNotNull { it.trim().toLongOrNull() } }.getOrDefault(emptyList())
+    }
+
+    private fun crashDir(context: Context) = File(context.filesDir, CRASH_DIR)
+    private fun reportFile(context: Context) = File(crashDir(context), REPORT_FILE)
+    private fun timesFile(context: Context) = File(crashDir(context), TIMES_FILE)
+    private fun dismissedFile(context: Context) = File(crashDir(context), DISMISSED_FILE)
+
+    private const val CRASH_DIR = "crash"
+    private const val REPORT_FILE = "last_crash.txt"
+    private const val TIMES_FILE = "crash_times.txt"
+    private const val DISMISSED_FILE = "dismissed"
+    private const val MAX_TIMES = 5
+    private const val MAX_REPORT_CHARS = 64 * 1024
+    private const val LOOP_THRESHOLD = 2
+    private const val LOOP_WINDOW_MS = 10_000L
+}
+
+/**
+ * The allowlist of non-personal facts that go into a crash report. Built from
+ * [Build] and the app's own [PackageInfo]; deliberately holds no identifiers.
+ */
+data class CrashContext(
+    val appVersionName: String,
+    val appVersionCode: Long,
+    val sdkInt: Int,
+    val androidRelease: String,
+    val manufacturer: String,
+    val model: String,
+    val locale: String,
+) {
+    companion object {
+        fun from(context: Context): CrashContext {
+            val pkg = runCatching {
+                context.packageManager.getPackageInfo(context.packageName, 0)
+            }.getOrNull()
+            return CrashContext(
+                appVersionName = pkg?.versionName ?: "?",
+                appVersionCode = pkg?.let { PackageInfoCompat.getLongVersionCode(it) } ?: 0L,
+                sdkInt = Build.VERSION.SDK_INT,
+                androidRelease = Build.VERSION.RELEASE ?: "?",
+                manufacturer = Build.MANUFACTURER ?: "?",
+                model = Build.MODEL ?: "?",
+                locale = Locale.getDefault().toLanguageTag(),
+            )
+        }
+    }
+}
+
+/**
+ * Render a crash report from the [ctx] allowlist, the [throwable]'s full stack
+ * trace, and the crash [nowMillis]. Pure (no Android, no I/O) so it is unit
+ * tested. The leading marker doubles as the file's sanity check in
+ * [CrashReporter.pendingReport].
+ */
+fun buildCrashReport(ctx: CrashContext, throwable: Throwable, nowMillis: Long): String {
+    val trace = StringWriter().also { throwable.printStackTrace(PrintWriter(it)) }.toString().trim()
+    val time = runCatching {
+        Instant.ofEpochMilli(nowMillis).atZone(ZoneId.systemDefault()).format(TIME_FORMAT)
+    }.getOrDefault(nowMillis.toString())
+    return buildString {
+        appendLine("Calendula crash report")
+        appendLine("App version: ${ctx.appVersionName} (${ctx.appVersionCode})")
+        appendLine("Android: ${ctx.androidRelease} (API ${ctx.sdkInt})")
+        appendLine("Device: ${ctx.manufacturer} ${ctx.model}")
+        appendLine("Locale: ${ctx.locale}")
+        appendLine("Time: $time")
+        appendLine()
+        appendLine("Stack trace:")
+        append(trace)
+    }
+}
+
+private val TIME_FORMAT = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss")

app/src/main/java/de/jeanlucmakiola/calendula/data/ics/IcsExporter.kt

@@ -24,7 +24,8 @@ class IcsExporter @Inject constructor(
     fun writeDocument(uri: Uri, content: String) {
         context.contentResolver.openOutputStream(uri)?.use { out ->
             out.write(content.toByteArray(Charsets.UTF_8))
-        } ?: throw IOException("Could not open $uri for writing")
+            // Only the scheme — the full Uri can embed the user's chosen filename.
+        } ?: throw IOException("Could not open output stream for export (scheme=${uri.scheme})")
     }
 
     /**

app/src/main/java/de/jeanlucmakiola/calendula/ui/crash/CrashReportActivity.kt

@@ -0,0 +1,59 @@
+package de.jeanlucmakiola.calendula.ui.crash
+
+import android.os.Bundle
+import androidx.activity.ComponentActivity
+import androidx.activity.compose.setContent
+import androidx.activity.enableEdgeToEdge
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
+import androidx.compose.ui.Modifier
+import de.jeanlucmakiola.calendula.data.crash.CrashReporter
+import de.jeanlucmakiola.calendula.ui.theme.CalendulaTheme
+
+/**
+ * A deliberately minimal, standalone surface for a captured crash report.
+ * `MainActivity` routes here when it detects a startup crash-loop (see
+ * [CrashReporter.isCrashLoop]): the main UI can't be trusted to start, so this
+ * screen stays clear of the app's Hilt graph, DataStore-backed theme and
+ * Compose content — it only reads the report file and shows the report dialog.
+ * Plain [CalendulaTheme] defaults (follow-system, dynamic colour) avoid touching
+ * anything that might be the cause of the crash.
+ */
+class CrashReportActivity : ComponentActivity() {
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        val report = CrashReporter.pendingReport(this)
+        if (report == null) {
+            finish()
+            return
+        }
+        enableEdgeToEdge()
+        setContent {
+            CalendulaTheme {
+                // Opaque backdrop so the dialog doesn't float over a bare task.
+                Surface(Modifier.fillMaxSize(), color = MaterialTheme.colorScheme.surface) {}
+                CrashReportDialog(
+                    report = report,
+                    onSend = {
+                        submitCrashReport(this, report)
+                        CrashReporter.clearReport(this)
+                        finish()
+                    },
+                    onDismiss = {
+                        CrashReporter.clearReport(this)
+                        finish()
+                    },
+                )
+            }
+        }
+    }
+
+    override fun onResume() {
+        super.onResume()
+        // Reaching this screen breaks the loop; reset the timing trail so a
+        // later ordinary crash isn't mistaken for a loop.
+        CrashReporter.markHealthy(this)
+    }
+}

app/src/main/java/de/jeanlucmakiola/calendula/ui/crash/CrashReportDialog.kt

@@ -0,0 +1,75 @@
+package de.jeanlucmakiola.calendula.ui.crash
+
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.BugReport
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.Icon
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.unit.dp
+import de.jeanlucmakiola.calendula.R
+
+/**
+ * Asks the user to send a captured crash report as an issue. The full report is
+ * shown verbatim in a scrollable panel — the user sees exactly what will leave
+ * the device before choosing to share it (the privacy backstop). [onSend] hands
+ * off to [submitCrashReport]; [onDismiss] declines.
+ */
+@Composable
+fun CrashReportDialog(
+    report: String,
+    onSend: () -> Unit,
+    onDismiss: () -> Unit,
+) {
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        icon = { Icon(Icons.Default.BugReport, contentDescription = null) },
+        title = { Text(stringResource(R.string.crash_dialog_title)) },
+        text = {
+            Column {
+                Text(
+                    text = stringResource(R.string.crash_dialog_message),
+                    style = MaterialTheme.typography.bodyMedium,
+                )
+                Spacer(Modifier.height(12.dp))
+                Surface(
+                    color = MaterialTheme.colorScheme.surfaceContainerHighest,
+                    shape = RoundedCornerShape(12.dp),
+                    modifier = Modifier.fillMaxWidth(),
+                ) {
+                    Text(
+                        text = report,
+                        style = MaterialTheme.typography.bodySmall,
+                        fontFamily = FontFamily.Monospace,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        modifier = Modifier
+                            .heightIn(max = 220.dp)
+                            .verticalScroll(rememberScrollState())
+                            .padding(12.dp),
+                    )
+                }
+            }
+        },
+        confirmButton = {
+            TextButton(onClick = onSend) { Text(stringResource(R.string.crash_dialog_report)) }
+        },
+        dismissButton = {
+            TextButton(onClick = onDismiss) { Text(stringResource(R.string.crash_dialog_dismiss)) }
+        },
+    )
+}

app/src/main/java/de/jeanlucmakiola/calendula/ui/crash/CrashReportSubmit.kt

@@ -0,0 +1,61 @@
+package de.jeanlucmakiola.calendula.ui.crash
+
+import android.content.ClipData
+import android.content.ClipboardManager
+import android.content.Context
+import android.content.Intent
+import android.widget.Toast
+import androidx.core.net.toUri
+import de.jeanlucmakiola.calendula.R
+
+/**
+ * Hand the captured crash report off to the user's chosen channel: the report
+ * is copied to the clipboard (the reliable path for a full stack trace) and the
+ * project's Gitea "new issue" page is opened with the body prefilled. Nothing is
+ * sent automatically — the app has no network access; the user reviews and
+ * submits the issue themselves.
+ */
+fun submitCrashReport(context: Context, report: String) {
+    copyReportToClipboard(context, report)
+    val opened = runCatching {
+        context.startActivity(Intent(Intent.ACTION_VIEW, buildIssueUri(context, report)))
+    }.isSuccess
+    val message = if (opened) R.string.crash_report_copied else R.string.crash_report_open_failed
+    Toast.makeText(context, message, Toast.LENGTH_LONG).show()
+}
+
+/** Open the issue tracker's template chooser for a manual (non-crash) report. */
+fun openIssueTracker(context: Context) {
+    val uri = context.getString(R.string.report_issue_choose_url).toUri()
+    runCatching { context.startActivity(Intent(Intent.ACTION_VIEW, uri)) }
+}
+
+private fun copyReportToClipboard(context: Context, report: String) {
+    val clipboard = context.getSystemService(Context.CLIPBOARD_SERVICE) as? ClipboardManager ?: return
+    val label = context.getString(R.string.crash_report_clip_label)
+    clipboard.setPrimaryClip(ClipData.newPlainText(label, report))
+}
+
+/**
+ * The Gitea `issues/new` URL with `title` and `body` prefilled. A full report
+ * can blow past URL-length limits, so an over-long one is left out of the link
+ * (with a "paste from clipboard" placeholder) — the clipboard copy is the
+ * source of truth in that case.
+ */
+private fun buildIssueUri(context: Context, report: String) =
+    context.getString(R.string.report_issue_url).toUri().buildUpon()
+        .appendQueryParameter("title", context.getString(R.string.crash_report_issue_title))
+        .appendQueryParameter("body", buildIssueBody(context, report))
+        .build()
+
+private fun buildIssueBody(context: Context, report: String): String {
+    val block = if (report.length > MAX_URL_REPORT_CHARS) {
+        context.getString(R.string.crash_report_body_paste)
+    } else {
+        "```\n$report\n```"
+    }
+    return context.getString(R.string.crash_report_body_template, block)
+}
+
+/** Keep the prefilled body comfortably under common URL-length ceilings. */
+private const val MAX_URL_REPORT_CHARS = 6_000

app/src/main/java/de/jeanlucmakiola/calendula/ui/settings/SettingsScreen.kt

@@ -33,6 +33,7 @@ import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.BugReport
 import androidx.compose.material.icons.filled.CalendarMonth
 import androidx.compose.material.icons.filled.Check
 import androidx.compose.material.icons.filled.ExpandLess
@@ -73,10 +74,14 @@ import androidx.lifecycle.LifecycleEventObserver
 import androidx.lifecycle.compose.LocalLifecycleOwner
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import de.jeanlucmakiola.calendula.R
+import de.jeanlucmakiola.calendula.data.crash.CrashReporter
 import de.jeanlucmakiola.calendula.data.prefs.CalendarReminderOverride
 import de.jeanlucmakiola.calendula.data.prefs.ThemeMode
 import de.jeanlucmakiola.calendula.data.prefs.WeekStartPref
 import de.jeanlucmakiola.calendula.domain.EventFormField
+import de.jeanlucmakiola.calendula.ui.crash.CrashReportDialog
+import de.jeanlucmakiola.calendula.ui.crash.openIssueTracker
+import de.jeanlucmakiola.calendula.ui.crash.submitCrashReport
 import de.jeanlucmakiola.calendula.ui.common.CollapsingScaffold
 import de.jeanlucmakiola.calendula.ui.common.GroupedRow
 import de.jeanlucmakiola.calendula.ui.common.CalendarColorChip
@@ -196,12 +201,48 @@ private fun SettingsHub(
             leading = { CategoryIcon(Icons.Default.CalendarMonth, ChipAccent.Tertiary) },
             onClick = onManageCalendars,
         )
-        LanguageRow(position = Position.Bottom)
+        LanguageRow(position = Position.Middle)
+        ReportProblemRow(position = Position.Bottom)
 
         AppVersionText()
     }
 }
 
+/**
+ * Opens the project's issue tracker to report a problem. If a crash report was
+ * captured (and not yet sent), it surfaces that report first via the same
+ * dialog the next-launch prompt uses; otherwise it opens the issue template
+ * chooser. No data leaves the device until the user submits the issue.
+ */
+@Composable
+private fun ReportProblemRow(position: Position) {
+    val context = LocalContext.current
+    var report by remember { mutableStateOf<String?>(null) }
+
+    GroupedRow(
+        title = stringResource(R.string.settings_report_problem),
+        summary = stringResource(R.string.settings_report_problem_hint),
+        position = position,
+        leading = { CategoryIcon(Icons.Default.BugReport, ChipAccent.Neutral) },
+        onClick = {
+            val pending = CrashReporter.pendingReport(context)
+            if (pending != null) report = pending else openIssueTracker(context)
+        },
+    )
+
+    report?.let { pending ->
+        CrashReportDialog(
+            report = pending,
+            onSend = {
+                submitCrashReport(context, pending)
+                CrashReporter.clearReport(context)
+                report = null
+            },
+            onDismiss = { report = null },
+        )
+    }
+}
+
 @Composable
 private fun LanguageRow(position: Position) {
     val context = LocalContext.current

app/src/main/res/values-de/strings.xml

@@ -282,6 +282,8 @@
     <string name="settings_about_source">Quellcode</string>
     <string name="settings_about_version">Version %1$s</string>
     <string name="settings_about_logo_desc">Calendula-App-Symbol</string>
+    <string name="settings_report_problem">Problem melden</string>
+    <string name="settings_report_problem_hint">Absturzbericht senden oder Issue-Tracker öffnen</string>
 
     <!-- Calendar manager -->
     <string name="calendars_title">Kalender</string>
@@ -337,4 +339,16 @@
         <item quantity="one">%d bereits in diesem Kalender übersprungen.</item>
         <item quantity="other">%d bereits in diesem Kalender übersprungen.</item>
     </plurals>
+
+    <!-- Absturzberichte: vom Nutzer selbst als Gitea-Issue einreichbar -->
+    <string name="crash_dialog_title">Calendula ist abgestürzt</string>
+    <string name="crash_dialog_message">Calendula wurde beim letzten Mal unerwartet beendet. Du kannst bei der Behebung helfen, indem du diesen Bericht als Issue sendest. Er bleibt auf deinem Gerät, bis du ihn teilst, und enthält keine persönlichen Daten oder Kalenderinhalte — nur die technischen Angaben unten.</string>
+    <string name="crash_dialog_report">Melden</string>
+    <string name="crash_dialog_dismiss">Nicht jetzt</string>
+    <string name="crash_report_issue_title">Absturzbericht</string>
+    <string name="crash_report_clip_label">Calendula-Absturzbericht</string>
+    <string name="crash_report_copied">Bericht in die Zwischenablage kopiert</string>
+    <string name="crash_report_open_failed">Der Issue-Tracker konnte nicht geöffnet werden. Der Bericht ist in deiner Zwischenablage.</string>
+    <string name="crash_report_body_template">Danke, dass du einen Absturz in Calendula meldest. Bitte ergänze, was du gerade getan hast, und sende dann ab.\n\n### Was ist passiert\n\n\n### Absturzbericht\n%1$s\n</string>
+    <string name="crash_report_body_paste">_(Der Bericht war zu lang für diesen Link — füge ihn aus deiner Zwischenablage hier ein.)_</string>
 </resources>

app/src/main/res/values/strings.xml

@@ -279,6 +279,8 @@
     <string name="settings_about_source">Source</string>
     <string name="settings_about_version">Version %1$s</string>
     <string name="settings_about_logo_desc">Calendula app icon</string>
+    <string name="settings_report_problem">Report a problem</string>
+    <string name="settings_report_problem_hint">Send a crash report or open the issue tracker</string>
 
     <!-- Calendar manager -->
     <string name="calendars_title">Calendars</string>
@@ -340,4 +342,19 @@
 
     <string name="about_source_url" translatable="false">https://gitea.jeanlucmakiola.de/makiolaj/calendula</string>
     <string name="about_license_url" translatable="false">https://gitea.jeanlucmakiola.de/makiolaj/calendula/src/branch/main/LICENSE</string>
+
+    <!-- Crash reporting: a captured report the user can submit, by hand, as a
+         Gitea issue (the app sends nothing automatically). -->
+    <string name="crash_dialog_title">Calendula crashed</string>
+    <string name="crash_dialog_message">Calendula closed unexpectedly last time. You can help fix it by sending this report as an issue. It stays on your device until you choose to share it, and includes no personal data or calendar content — only the technical details below.</string>
+    <string name="crash_dialog_report">Report</string>
+    <string name="crash_dialog_dismiss">Not now</string>
+    <string name="crash_report_issue_title">Crash report</string>
+    <string name="crash_report_clip_label">Calendula crash report</string>
+    <string name="crash_report_copied">Report copied to your clipboard</string>
+    <string name="crash_report_open_failed">Couldn\'t open the issue tracker. The report is on your clipboard.</string>
+    <string name="crash_report_body_template">Thanks for reporting a crash in Calendula. Please add anything you remember about what you were doing, then submit.\n\n### What happened\n\n\n### Crash report\n%1$s\n</string>
+    <string name="crash_report_body_paste">_(The report was too long for this link — paste it from your clipboard here.)_</string>
+    <string name="report_issue_url" translatable="false">https://gitea.jeanlucmakiola.de/makiolaj/calendula/issues/new</string>
+    <string name="report_issue_choose_url" translatable="false">https://gitea.jeanlucmakiola.de/makiolaj/calendula/issues/new/choose</string>
 </resources>

app/src/test/java/de/jeanlucmakiola/calendula/data/crash/CrashReportBuilderTest.kt

@@ -0,0 +1,56 @@
+package de.jeanlucmakiola.calendula.data.crash
+
+import com.google.common.truth.Truth.assertThat
+import org.junit.jupiter.api.Test
+
+class CrashReportBuilderTest {
+
+    private val context = CrashContext(
+        appVersionName = "2.7.0",
+        appVersionCode = 20700,
+        sdkInt = 34,
+        androidRelease = "14",
+        manufacturer = "Google",
+        model = "Pixel 7",
+        locale = "en-DE",
+    )
+
+    @Test
+    fun `report carries the allowlisted facts and the stack trace`() {
+        val report = buildCrashReport(context, IllegalStateException("boom"), nowMillis = 0L)
+
+        assertThat(report).startsWith("Calendula crash report")
+        assertThat(report).contains("App version: 2.7.0 (20700)")
+        assertThat(report).contains("Android: 14 (API 34)")
+        assertThat(report).contains("Device: Google Pixel 7")
+        assertThat(report).contains("Locale: en-DE")
+        // The exception type + message and a frame from this test are present.
+        assertThat(report).contains("IllegalStateException")
+        assertThat(report).contains("boom")
+        assertThat(report).contains("CrashReportBuilderTest")
+    }
+
+    @Test
+    fun `nested causes are included`() {
+        val cause = NullPointerException("inner")
+        val report = buildCrashReport(context, RuntimeException("outer", cause), nowMillis = 0L)
+
+        assertThat(report).contains("outer")
+        assertThat(report).contains("Caused by")
+        assertThat(report).contains("inner")
+    }
+
+    @Test
+    fun `report holds only the allowlisted lines before the stack trace`() {
+        val report = buildCrashReport(context, Exception("x"), nowMillis = 0L)
+        val header = report.substringBefore("Stack trace:").trim().lines()
+
+        // No identifiers, accounts, or extra fields ever creep into the header:
+        // it is exactly the six allowlisted lines plus the title.
+        assertThat(header).hasSize(6)
+        assertThat(header.first()).isEqualTo("Calendula crash report")
+        assertThat(header.map { it.substringBefore(":") }).containsExactly(
+            "Calendula crash report", "App version", "Android", "Device", "Locale", "Time",
+        ).inOrder()
+    }
+}

docs/ARCHITECTURE.md

@@ -143,5 +143,6 @@ JUnit 5 + Truth + Turbine on the JVM. The seams that make it work:
 `CalendarDataSource` is faked (`FakeCalendarDataSource` records writes),
 mappers parse `ColumnReader`/plain maps instead of cursors, domain logic
 (recurrence, validation, snapshots, write-value building) is pure. CI
-(Gitea Actions) runs `lint test assembleDebug` on every push; release tags
-additionally build, sign, and publish to the self-hosted F-Droid repo.
+(Gitea Actions) runs `lint test assembleDebug` once per pull request; merging a
+bumped `versionName` to `main` builds, signs, and publishes to the self-hosted
+F-Droid repo and then mints the `vX.Y.Z` tag + release. See docs/RELEASING.md.

docs/RELEASING.md

@@ -1,61 +1,90 @@
 # Releasing Calendula
 
-Calendula is distributed through a self-hosted F-Droid repository. Every
-release is built, signed, and published automatically by
-`.gitea/workflows/release.yaml` when a version tag is pushed.
+Calendula is distributed through a self-hosted F-Droid repository. A release is
+built, signed, and published automatically by `.gitea/workflows/release.yaml`
+when a **bumped `versionName` reaches `main`** — the pipeline then creates the
+matching `vX.Y.Z` tag and Gitea release itself.
 
-## Versioning — the git tag is the single source of truth
+## Versioning — the committed version is the source of truth
 
-A release is defined by its tag, `vMAJOR.MINOR.PATCH` (e.g. `v2.1.0`). At
-release time the workflow derives both Gradle fields from the tag:
+A release is defined by the `versionName`/`versionCode` committed in
+`app/build.gradle.kts`:
 
-- `versionName` = the tag without the leading `v` (`2.1.0`)
+- `versionName` = `MAJOR.MINOR.PATCH` (e.g. `2.1.0`)
 - `versionCode` = `MAJOR*10000 + MINOR*100 + PATCH` (`2.1.0` → `20100`)
 
-So `MINOR` and `PATCH` each have room for 0–99. The values committed in
-`app/build.gradle.kts` are only the dev/local default — CI overwrites them
-from the tag. Keep the committed `versionCode`/`versionName` matching the
-**latest released tag** so local builds are sanely versioned; the published
-value always comes from the tag.
+So `MINOR` and `PATCH` each have room for 0–99. The release pipeline reads
+`versionName`, pins `versionCode` to the derived value, builds, and — once the
+APK is published — creates the tag `v<versionName>` at that commit. The tag is
+an **output** of a successful release, not its trigger, so a tag always marks a
+fully-shipped version (and a failure before publish leaves no tag, so re-running
+the workflow safely retries).
 
 Published version codes so far: `v0.1.0`→100 … `v1.0.0`→10000 … `v2.0.0`→20000.
 
 ## Cutting a release
 
-1. Move the `## [Unreleased]` section of `CHANGELOG.md` under a new
+1. **Assemble the release branch.** Create `release/vX.Y.Z` and merge the
+   feature/fix branches that make up this release into it. This branch is the
+   release candidate — everything below happens on it, before it reaches `main`.
+2. Move the `## [Unreleased]` section of `CHANGELOG.md` under a new
    `## [X.Y.Z] — <date>` heading (Keep a Changelog format). The text between
    that heading and the next `## [` becomes both the Gitea release notes and
    the F-Droid per-version changelog.
-2. Optionally bump the committed `versionCode`/`versionName` in
-   `app/build.gradle.kts` to match the new version (keeps local builds tidy).
-3. Commit, then tag and push:
+3. Bump the committed `versionName` (and `versionCode`) in
+   `app/build.gradle.kts` to the new version. **This bump is what triggers the
+   release** when the branch merges to `main`.
+4. **Verify the release build on a real device** — the mandatory gate. The
+   shipped APK is R8-shrunk/obfuscated, and bugs that only appear there, or
+   only on first run, never show up in the debug build or on a device that
+   already granted the calendar permission (this is how the v2.7.0 launch
+   crash slipped through). Run:
    ```bash
-   git tag vX.Y.Z
-   git push origin vX.Y.Z
+   scripts/verify-release.sh
    ```
-4. The push triggers the release workflow. **Hold UI releases for on-device
-   review and explicit go-ahead before tagging.**
+   It builds the `releaseTest` variant (same R8 config as `release`, debug-signed
+   with a `.releasetest` suffix so it installs alongside the real app) and resets
+   it to a first-run state. Then, on the device:
+   - launch from a **clean / permission-not-granted** state — the permission
+     screen must appear, no crash;
+   - grant access — the calendar must load;
+   - add both home-screen **widgets** and confirm they render;
+   - exercise this release's headline changes.
+
+   Only proceed once all of that passes on-device.
+5. **Merge `release/vX.Y.Z` into `main`.** That's it — no manual tagging. The
+   merge triggers `release.yaml`, which detects the new version, builds, signs,
+   publishes to F-Droid, and creates the `vX.Y.Z` tag + Gitea release. **Hold UI
+   releases for on-device review and explicit go-ahead before merging.**
+
+> The `releaseTest` build type exists only for step 4 — it is never published.
+> The pipeline always builds and signs the real `release` variant.
 
 ## What the pipeline does
 
-`release.yaml` has three jobs:
+CI and release are split so a change is built once on its PR and only does
+release work when a merge actually cuts a release:
 
-- **ci** — unit tests + a debug assemble (sanity).
-- **build-and-deploy** — derives the version, builds & signs the release APK
-  with the app key, copies it into the F-Droid repo, generates the per-version
-  changelog, re-signs the F-Droid index with the **repo key**, uploads
-  `repo/` + `metadata/` to the box, and attaches the R8 `mapping.txt` to the
-  Gitea release (best-effort).
-- **gitea-release** — creates/updates the Gitea release carrying the tag's
-  CHANGELOG section as notes. Gated on `ci` only (not the deploy) so notes
-  publish even if the F-Droid upload hiccups.
+- **`ci.yaml`** (on `pull_request`) — lint + unit tests + a debug assemble (and
+  a Trivy scan), once per PR. Docs/metadata-only PRs skip the Android build but
+  still report a green `CI` check.
+- **`release.yaml`** (on push to `main`, plus `workflow_dispatch`) — a cheap
+  `detect` job reads `versionName` and checks whether a tag for it already
+  exists. Only when it doesn't does the `release` job run: unit tests on the
+  merged commit, build & sign the release APK with the **app key**, copy it into
+  the F-Droid repo, generate the per-version changelog, re-sign the index with
+  the **repo key**, upload `repo/` + `metadata/`, then create the `vX.Y.Z` tag +
+  Gitea release (CHANGELOG section as notes) and attach the R8 `mapping.txt`
+  (best-effort). Ordinary merges with no version bump fall through `detect` and
+  do nothing.
 
 ### Manual re-sign / recovery
 
-A manual `workflow_dispatch` of the release workflow **from a branch** (not a
-tag) runs a **re-sign-only** path: it skips the APK build and just re-signs
-the existing F-Droid index with the configured repo key and re-uploads. Use
-this for key rotation or repo recovery without publishing a new app version.
+A manual `workflow_dispatch` of the release workflow runs a **re-sign-only**
+path: `detect` reports it's not a release, so the `release` job skips the APK
+build, the version bump, and tag/release creation, and just re-signs the
+existing F-Droid index with the configured repo key and re-uploads. Use this
+for key rotation or repo recovery without publishing a new app version.
 
 ## Secrets (Gitea → repo Settings → Actions → Secrets)
 

scripts/verify-release.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+#
+# Build the release-candidate APK and install it on a connected device for the
+# mandatory pre-tag on-device check (see docs/RELEASING.md).
+#
+# It builds the `releaseTest` variant: the same R8 shrinking + obfuscation and
+# resource shrinking as the published `release` build, but debug-signed and
+# with a `.releasetest` applicationId suffix so it installs alongside the
+# production and debug apps. This is what surfaces release-only breakage (R8
+# stripping) and first-run states (permission not yet granted) that the
+# unminified debug build — or a device that already holds the permission —
+# silently hides.
+#
+# Usage: scripts/verify-release.sh
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+PKG="de.jeanlucmakiola.calendula.releasetest"
+APK="app/build/outputs/apk/releaseTest/app-releaseTest.apk"
+
+echo "==> Building release-candidate APK (releaseTest, R8 minified)…"
+./gradlew :app:assembleReleaseTest
+
+echo "==> Installing $PKG …"
+adb install -r "$APK"
+
+echo "==> Resetting to a first-run state (revoking calendar permission)…"
+# The release build crashed at launch precisely because this state was never
+# tested. Force it so the permission gate / onboarding is exercised every time.
+adb shell pm revoke "$PKG" android.permission.READ_CALENDAR  2>/dev/null || true
+adb shell pm revoke "$PKG" android.permission.WRITE_CALENDAR 2>/dev/null || true
+
+echo
+echo "Installed and reset. Now verify ON THE DEVICE before tagging:"
+echo "  1. Launch from a clean state — the permission screen must appear (no crash)."
+echo "  2. Grant calendar access — the calendar must load with events."
+echo "  3. Add both home-screen widgets and confirm they render (not a spinner)."
+echo "  4. Exercise the release's headline changes end to end."
+echo
+echo "Watch for crashes with:  adb logcat -b crash"
+echo "Only merge the release branch to main once all of the above pass on a device"
+echo "(the merge is what publishes the release — see docs/RELEASING.md)."