From 4bea164906dab51092da8491eefaa3b91a79bfdf Mon Sep 17 00:00:00 2001
From: austinried <4966622+austinried@users.noreply.github.com>
Date: Thu, 8 Oct 2026 19:21:26 +0000
Subject: [PATCH] release: split the Play key write, guard the tag and attach
 the mapping

- write the Play service account in its own step so fastlane never has
  the secret in its environment (only the 0600 file path)
- fail the build when the tag does not match versionName
- serialize releases with a concurrency group
- attach the R8 mapping.txt to the GitHub release
---
 .github/workflows/release.yml | 21 +++++++++++++++++++--
 signing/README.md             |  2 +-
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 45945be2..14fb2f9e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,10 @@ on:
     tags:
       - "v*"
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
@@ -20,6 +24,16 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
+      - name: Check tag matches versionName
+        run: |
+          version=$(grep -oP 'versionName = "\K[^"]+' app/build.gradle.kts)
+          case "$GITHUB_REF_NAME" in
+            "v$version" | "v$version"-*) ;;
+            *)
+              echo "tag $GITHUB_REF_NAME does not match versionName $version" >&2
+              exit 1
+              ;;
+          esac
       - id: build
         uses: ./.github/actions/build
         with:
@@ -70,13 +84,16 @@ jobs:
           fi
       - name: Check release notes exist
         run: test -f "metadata/en-US/changelogs/${{ needs.build.outputs.version-code }}.txt"
-      - name: Upload to Google Play
+      - name: Write Play service account
         if: steps.stable.outputs.value == 'true'
         env:
           PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
         run: |
           umask 077
           printf '%s' "$PLAY_SERVICE_ACCOUNT_JSON" > "$RUNNER_TEMP/play.json"
+      - name: Upload to Google Play
+        if: steps.stable.outputs.value == 'true'
+        run: |
           nix develop .#release --command fastlane supply \
             --aab dist/bundle/release/app-release.aab \
             --package_name com.subtracks \
@@ -127,4 +144,4 @@ jobs:
           if [ "${{ steps.stable.outputs.value }}" != "true" ]; then
             args+=(--prerelease)
           fi
-          gh release create "$GITHUB_REF_NAME" subtracks.apk subtracks.aab SHA256SUMS dist/release-certificate.pem "${args[@]}"
+          gh release create "$GITHUB_REF_NAME" subtracks.apk subtracks.aab SHA256SUMS dist/release-certificate.pem dist/mapping/release/mapping.txt "${args[@]}"
diff --git a/signing/README.md b/signing/README.md
index 31ad5c46..4f6e44db 100644
--- a/signing/README.md
+++ b/signing/README.md
@@ -18,7 +18,7 @@ The APK and the AAB are signed with the release key. Certificate SHA-256:
 02da2cb7b8214e53bdbfb455698dcb965222f91c954b5210aeac96fe329c8f01
 ```
 
-Each release attaches the APK, the AAB, the checksums and the certificate (committed here as [`release-certificate.pem`](release-certificate.pem)):
+Each release attaches the APK, the AAB, the checksums, the certificate (committed here as [`release-certificate.pem`](release-certificate.pem)) and the R8 `mapping.txt`:
 
 ```sh
 sha256sum -c SHA256SUMS