address review: persist nightly checksums, guard the changelog, tidy CI

- write SHA256SUMS into the subtracks-nightly artifact
- assert at least one changelog exists in the metadata test
- drop the unused assembleDebug from the Forgejo CI
- only claim the AAB was uploaded to Play for stable releases
- clean up the export-certificate keystore with a trap
This commit is contained in:
austinried
2026-10-08 19:12:56 +00:00
parent 323bfde41b
commit 9d43b6d104
4 changed files with 13 additions and 9 deletions
+1 -1
View File
@@ -27,7 +27,7 @@ keytool -printcert -jarfile subtracks.aab # the AAB
keytool -printcert -file release-certificate.pem # prints its SHA-256
```
The `.aab` is the exact bundle uploaded to Google Play (install it by generating device APKs with [bundletool](https://github.com/google/bundletool)); the `.apk` is the universal APK for sideloading. The signing certificate SHA-256 is also listed in the release notes.
The `.aab` is the app bundle (the one uploaded to Google Play for stable releases; install it by generating device APKs with [bundletool](https://github.com/google/bundletool)); the `.apk` is the universal APK for sideloading. The signing certificate SHA-256 is also listed in the release notes.
## Google Play