ci: the full release pipeline, Codeberg-canonical from commit one

Both siblings' pipelines are near-identical; the real difference between them
is which forge is canonical. This is Agendula's spine — it pushes the tag to
Codeberg itself and flags pre-1.0 releases as pre-releases — with Calendula's
`play` job grafted on unchanged.

Taking Agendula's spine means there is no Gitea-canonical phase to migrate out
of later, which is the one thing Agendula had to unwind.

The Codeberg publish step stays NOT continue-on-error, inherited that way
deliberately: in Agendula it reported green through five consecutive releases
while never once publishing, which is how a crash-fix release reached F-Droid
but not the users who needed it. Comments that recount that history now name
Agendula, so an inherited scar isn't misread as ours.

The `play` job runs last and isolated, and skips cleanly until
PLAY_SERVICE_ACCOUNT_JSON exists — so it stays dormant through the whole
pre-1.0 run, which is the correct behaviour anyway.

Templates, the contributing guide and verify-release.sh are rewritten for this
app's domain rather than renamed: the architectural rule here is that Room
types stay in the data layer, and the on-device release check is an alarm that
survives a lock screen and a reboot, not a task list that loads.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L94fydiJC37LtxVusNQBDy

scripts/check_reproducible_release.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# Reproducibility guard for the official F-Droid repo (de.jeanlucmakiola.clockula).
+#
+# F-Droid only republishes OUR signed binary if a from-source build reproduces it
+# byte-for-byte and the binary carries no extra signing blocks. If any invariant
+# below regresses, the official repo silently stalls on the last good version
+# (fails safe — but you'd be stuck on an old release without noticing). So fail
+# loudly here, on every PR.
+#
+# Each invariant guards against a known fdroiddata CI rejection cause (learned on
+# the sibling Calendula repo's official-repo submission):
+#   1. vcsInfo { include = false }          — else AGP embeds env-dependent git
+#      metadata (META-INF/version-control-info.textproto) -> not reproducible.
+#   2. no foojay toolchain resolver         — F-Droid's offline source scanner
+#      rejects org.gradle.toolchains.foojay-resolver (it can fetch a JDK over
+#      the network at build time).
+#   3. dependenciesInfo { includeInApk = false } — else AGP embeds a "Dependency
+#      metadata" block (id 0x504b4453) in the APK Signing Block, which F-Droid's
+#      binary scanner rejects as an extra signing block.
+set -euo pipefail
+
+APP="app/build.gradle.kts"
+SETTINGS="settings.gradle.kts"
+fail=0
+
+# 1. AGP VCS-info must be disabled on the release build. -z reads the whole file
+#    as one record so the match can span newlines; [^}] keeps it inside the block.
+if grep -Pzoq 'vcsInfo\s*\{[^}]*include\s*=\s*false' "$APP"; then
+  echo "OK: vcsInfo { include = false } — no env-dependent VCS metadata embedded."
+else
+  echo "ERROR: '$APP' release build is missing 'vcsInfo { include = false }'." >&2
+  echo "       AGP would embed version-control-info.textproto, breaking reproducibility." >&2
+  fail=1
+fi
+
+# 2. The foojay toolchain resolver must not be present in any Gradle script.
+#    This includes the floret-kit submodule: it's an included build (composite
+#    build via `includeBuild`), so F-Droid evaluates its Gradle scripts too when
+#    building from source — the same offline-scanner bar applies to it.
+gradle_files=("$SETTINGS" "$APP")
+[ -f build.gradle.kts ] && gradle_files+=(build.gradle.kts)
+if [ -d floret-kit ]; then
+  while IFS= read -r f; do gradle_files+=("$f"); done \
+    < <(find floret-kit -name '*.gradle.kts' -not -path '*/build/*')
+fi
+if grep -qi 'foojay' "${gradle_files[@]}"; then
+  echo "ERROR: foojay toolchain resolver found in: $(grep -li foojay "${gradle_files[@]}" | tr '\n' ' ')" >&2
+  echo "       F-Droid's source scanner rejects org.gradle.toolchains.foojay-resolver" >&2
+  echo "       (it can fetch a JDK over the network). Remove the plugin." >&2
+  fail=1
+else
+  echo "OK: no foojay toolchain resolver — offline build scanner stays happy."
+fi
+
+# 3. AGP dependency-metadata block must not be embedded in the APK.
+if grep -Pzoq 'dependenciesInfo\s*\{[^}]*includeInApk\s*=\s*false' "$APP"; then
+  echo "OK: dependenciesInfo { includeInApk = false } — no extra APK signing block."
+else
+  echo "ERROR: '$APP' is missing 'dependenciesInfo { includeInApk = false }'." >&2
+  echo "       AGP would embed a 'Dependency metadata' block (0x504b4453) in the APK" >&2
+  echo "       Signing Block, which F-Droid's binary scanner rejects." >&2
+  fail=1
+fi
+
+if [ "$fail" -ne 0 ]; then
+  echo >&2
+  echo "Reproducible-release invariant(s) violated — official F-Droid publishing would" >&2
+  echo "stall. Fix the above before merging." >&2
+  exit 1
+fi
+echo "All reproducible-release invariants hold."

scripts/check_translations.py

@@ -0,0 +1,94 @@
+#!/usr/bin/env python3
+"""Validate Android translation resources against the base strings.xml.
+
+Community translations live in ``app/src/main/res/values-<locale>/strings.xml``
+and are produced via Weblate. This guard keeps incoming translation PRs honest:
+
+  * every translation file must be well-formed XML;
+  * a translation must not define keys absent from the base — those are stale
+    keys left behind after a rename/removal upstream;
+  * a translation must not translate strings marked ``translatable="false"`` in
+    the base (URLs, IDs and the like).
+
+Missing keys are *allowed* and only reported as coverage: a missing string
+falls back to the English base at runtime, so partial translations are fine
+(this mirrors the lint config, which downgrades ``MissingTranslation``).
+
+Exits non-zero if any error is found. Errors are emitted as Gitea/GitHub
+Actions ``::error`` annotations so they surface inline on the PR.
+"""
+from __future__ import annotations
+
+import sys
+import xml.etree.ElementTree as ET
+from pathlib import Path
+
+RES_DIR = Path("app/src/main/res")
+BASE = RES_DIR / "values" / "strings.xml"
+RESOURCE_TAGS = ("string", "plurals", "string-array")
+
+
+def entries(path: Path) -> dict[str, bool]:
+    """Map resource name -> is-translatable for every entry in ``path``."""
+    root = ET.parse(path).getroot()
+    return {
+        el.attrib["name"]: el.attrib.get("translatable", "true") != "false"
+        for el in root
+        if el.tag in RESOURCE_TAGS and "name" in el.attrib
+    }
+
+
+def main() -> int:
+    if not BASE.exists():
+        print(f"::error::base resource file {BASE} not found", file=sys.stderr)
+        return 1
+
+    base = entries(BASE)
+    base_keys = set(base)
+    nontranslatable = {name for name, ok in base.items() if not ok}
+    translatable_total = len(base_keys - nontranslatable)
+
+    files = sorted(RES_DIR.glob("values-*/strings.xml"))
+    if not files:
+        print("No translation files found (values-*/strings.xml).")
+        return 0
+
+    errors = 0
+    for path in files:
+        locale = path.parent.name[len("values-"):]
+        try:
+            translated = entries(path)
+        except ET.ParseError as exc:
+            print(f"::error file={path}::{locale}: malformed XML: {exc}")
+            errors += 1
+            continue
+
+        keys = set(translated)
+        stale = sorted(keys - base_keys)
+        translated_fixed = sorted(keys & nontranslatable)
+        missing = base_keys - nontranslatable - keys
+
+        for name in stale:
+            print(f"::error file={path}::{locale}: stale key '{name}' is not in the base strings.xml")
+            errors += 1
+        for name in translated_fixed:
+            print(
+                f"::error file={path}::{locale}: key '{name}' is translatable=\"false\" "
+                "in the base and must not be translated"
+            )
+            errors += 1
+
+        covered = translatable_total - len(missing)
+        pct = covered * 100 // translatable_total if translatable_total else 100
+        verdict = "OK" if not (stale or translated_fixed) else "FAIL"
+        print(f"{locale:<10} {covered}/{translatable_total} keys ({pct}%) — {verdict}")
+
+    if errors:
+        print(f"\n{errors} translation error(s) found.", file=sys.stderr)
+        return 1
+    print("\nAll translation files are consistent with the base.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/fastlane_to_fdroid_localized.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Single source of truth: fastlane/metadata/android/<locale>/ feeds BOTH the
+# official F-Droid repo (harvested from source automatically) and the
+# self-hosted repo. This script transforms the fastlane layout into the F-Droid
+# "localized" layout that the self-hosted `fdroid update` consumes, so we don't
+# maintain two copies.
+#
+#   usage: fastlane_to_fdroid_localized.sh <fastlane_android_dir> <out_localized_dir>
+#   e.g.   scripts/fastlane_to_fdroid_localized.sh \
+#              fastlane/metadata/android \
+#              fdroid/metadata/de.jeanlucmakiola.clockula
+#
+# Mapping (fastlane -> F-Droid repo localized):
+#   short_description.txt        -> summary.txt
+#   full_description.txt         -> description.txt
+#   title.txt                    -> name.txt
+#   images/icon.png              -> icon.png
+#   images/phoneScreenshots/*    -> phoneScreenshots/*
+#   changelogs/<versionCode>.txt -> changelogs/<versionCode>.txt
+# (changelogs are seeded into the fastlane tree by
+#  scripts/sync_changelog_to_fastlane.sh.)
+set -euo pipefail
+
+SRC="${1:?need fastlane android dir, e.g. fastlane/metadata/android}"
+OUT="${2:?need output localized dir, e.g. fdroid/metadata/<appid>}"
+
+shopt -s nullglob
+for locdir in "$SRC"/*/; do
+  loc="$(basename "$locdir")"
+  dst="$OUT/$loc"
+  mkdir -p "$dst"
+  [ -f "$locdir/short_description.txt" ] && cp "$locdir/short_description.txt" "$dst/summary.txt"
+  [ -f "$locdir/full_description.txt"  ] && cp "$locdir/full_description.txt"  "$dst/description.txt"
+  [ -f "$locdir/title.txt"             ] && cp "$locdir/title.txt"             "$dst/name.txt"
+  [ -f "$locdir/images/icon.png"       ] && cp "$locdir/images/icon.png"       "$dst/icon.png"
+  if [ -d "$locdir/images/phoneScreenshots" ]; then
+    mkdir -p "$dst/phoneScreenshots"
+    cp "$locdir"images/phoneScreenshots/* "$dst/phoneScreenshots/"
+  fi
+  # Per-version changelogs live in the same fastlane tree (see
+  # scripts/sync_changelog_to_fastlane.sh) and map straight across.
+  if [ -d "$locdir/changelogs" ]; then
+    mkdir -p "$dst/changelogs"
+    cp "$locdir"changelogs/* "$dst/changelogs/"
+  fi
+done
+
+echo "Built F-Droid localized metadata in '$OUT' from '$SRC'"

scripts/sync_changelog_to_fastlane.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Write the current version's CHANGELOG.md section into the fastlane changelog
+# file that F-Droid harvests: fastlane/metadata/android/en-US/changelogs/<code>.txt
+# (en-US is F-Droid's fallback locale, so it covers every language).
+#
+# Run this when cutting a release (after editing CHANGELOG.md and bumping
+# versionName in app/build.gradle.kts) and COMMIT the result, so the OFFICIAL
+# F-Droid repo — which reads the changelog from the tagged source tree — shows
+# this version's "What's New". The self-hosted release pipeline also runs it so
+# its changelog never depends on the file having been committed. Idempotent.
+#
+# Extraction matches the awk used for the Gitea release notes so all three
+# (release notes, self-hosted changelog, official changelog) stay in sync.
+set -euo pipefail
+cd "$(dirname "$0")/.."   # repo root
+
+VERSION=$(grep -oP 'versionName\s*=\s*"\K[^"]+' app/build.gradle.kts)
+[ -n "$VERSION" ] || { echo "No versionName in app/build.gradle.kts" >&2; exit 1; }
+MAJOR=${VERSION%%.*}; rest=${VERSION#*.}; MINOR=${rest%%.*}; PATCH=${rest##*.}
+MAJOR=${MAJOR:-0}; MINOR=${MINOR:-0}; PATCH=${PATCH:-0}
+VERSION_CODE=$(( MAJOR * 10000 + MINOR * 100 + PATCH ))
+
+CL_DIR="fastlane/metadata/android/en-US/changelogs"
+mkdir -p "$CL_DIR"
+OUT="$CL_DIR/${VERSION_CODE}.txt"
+
+awk -v ver="$VERSION" '
+  $0 ~ "^## \\[" ver "\\]" { flag = 1; next }
+  /^## \[/ { flag = 0 }
+  flag' CHANGELOG.md > "$OUT"
+# Trim leading blank lines (same as the pipeline did).
+sed -i -e '/./,$!d' "$OUT"
+if [ ! -s "$OUT" ]; then
+  echo "See CHANGELOG.md for $VERSION." > "$OUT"
+fi
+
+CHARS=$(wc -m < "$OUT" | tr -d ' ')
+echo "Wrote $OUT (version $VERSION, code $VERSION_CODE, ${CHARS} chars)"
+if [ "$CHARS" -gt 500 ]; then
+  echo "  note: >500 chars — F-Droid may truncate this changelog in-client." >&2
+fi

scripts/verify-release.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+#
+# Build the release-candidate APK and install it on a connected device for the
+# mandatory pre-release on-device check (see docs/RELEASING.md).
+#
+# It builds the `releaseTest` variant: the same R8 shrinking + obfuscation and
+# resource shrinking as the published `release` build, but debug-signed and
+# with a `.releasetest` applicationId suffix so it installs alongside the
+# production and debug apps. This is what surfaces release-only breakage (R8
+# stripping) and first-run states (permission not yet granted) that the
+# unminified debug build — or a device that already holds the permission —
+# silently hides.
+#
+# Usage: scripts/verify-release.sh
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+PKG="de.jeanlucmakiola.clockula.releasetest"
+APK="app/build/outputs/apk/releaseTest/app-releaseTest.apk"
+
+echo "==> Building release-candidate APK (releaseTest, R8 minified)…"
+./gradlew :app:assembleReleaseTest
+
+echo "==> Installing $PKG …"
+adb install -r "$APK"
+
+echo "==> Resetting to a first-run state (revoking runtime permissions)…"
+# Force the permission-not-granted state so the onboarding path is exercised
+# every time — R8-only breakage and first-run crashes never show up in the
+# unminified debug build, nor on a device that already holds the permission.
+adb shell pm revoke "$PKG" android.permission.POST_NOTIFICATIONS 2>/dev/null || true
+
+echo
+echo "Installed and reset. Now verify ON THE DEVICE before releasing:"
+echo "  1. Launch from a clean state — no crash, notification permission is asked for."
+echo "  2. Set an alarm a minute out. Lock the device. It must ring, over the lock"
+echo "     screen, with sound and vibration, and snooze and dismiss must both work."
+echo "  3. Reboot with that alarm still armed — it must survive and still fire."
+echo "  4. Start a timer and a stopwatch, background the app, confirm both keep"
+echo "     time and stay controllable from the notification shade."
+echo "  5. Exercise the release's headline changes end to end."
+echo
+echo "Watch for crashes with:  adb logcat -b crash"
+echo "Only merge the release branch to main once all of the above pass on a device"
+echo "(the merge is what publishes the release — see docs/RELEASING.md)."