address review: persist nightly checksums, guard the changelog, tidy CI

- write SHA256SUMS into the subtracks-nightly artifact
- assert at least one changelog exists in the metadata test
- drop the unused assembleDebug from the Forgejo CI
- only claim the AAB was uploaded to Play for stable releases
- clean up the export-certificate keystore with a trap

.github/workflows/ci.yml

@@ -31,7 +31,7 @@ jobs:
           cp app/build/outputs/apk/nightly/app-nightly.apk subtracks-nightly.apk
       - name: Checksums
         if: github.ref == 'refs/heads/main'
-        run: sha256sum subtracks-nightly.apk subtracks-nightly-debug.apk
+        run: sha256sum subtracks-nightly.apk subtracks-nightly-debug.apk | tee SHA256SUMS
       - uses: actions/upload-artifact@v7
         if: github.ref == 'refs/heads/main'
         with:
@@ -39,6 +39,7 @@ jobs:
           path: |
             subtracks-nightly.apk
             subtracks-nightly-debug.apk
+            SHA256SUMS
       - uses: actions/cache@v6
         with:
           path: .integration/music

.github/workflows/release.yml

@@ -36,10 +36,10 @@ jobs:
           KEYSTORE_PASSWORD: ${{ secrets.SUBTRACKS_UPLOAD_STORE_PASSWORD }}
         run: |
           umask 077
+          trap 'rm -f "$RUNNER_TEMP/keystore"' EXIT
           echo "$KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/keystore"
           alias=$(printf '%s' "$KEYPROPERTIES_BASE64" | base64 -d | sed -n 's/^keyAlias=//p' | tr -d '\r')
           nix develop --command keytool -exportcert -rfc -keystore "$RUNNER_TEMP/keystore" -alias "$alias" -storepass "$KEYSTORE_PASSWORD" -file app/build/outputs/release-certificate.pem
-          rm -f "$RUNNER_TEMP/keystore"
       - uses: actions/upload-artifact@v7
         with:
           name: release
@@ -112,7 +112,12 @@ jobs:
             echo
             echo "Signing certificate SHA-256: \`${{ steps.checksums.outputs.fingerprint }}\`"
             echo
-            echo 'The signing certificate is attached as `release-certificate.pem`. The `.aab` is the exact bundle uploaded to Google Play; the `.apk` is the universal APK for sideloading.'
+            echo 'The signing certificate is attached as `release-certificate.pem`.'
+            if [ "${{ steps.stable.outputs.value }}" = "true" ]; then
+              echo 'The `.aab` is the exact bundle uploaded to Google Play; the `.apk` is the universal APK for sideloading.'
+            else
+              echo 'The `.aab` is the built app bundle (this pre-release was not uploaded to Google Play); the `.apk` is the universal APK for sideloading.'
+            fi
           } > release-notes.md
       - name: Create GitHub release
         env:

app/src/test/kotlin/com/subtracks/metadata/MetadataConstraintsTest.kt

@@ -45,11 +45,9 @@ class MetadataConstraintsTest {
     @Test
     fun changelogsFitStoreLimit() {
         localeFiles("changelogs").forEach { dir ->
-            dir
+            val changelogs = dir.listFiles().orEmpty().filter { it.isFile && it.extension == "txt" }
-                .listFiles()
+            assertTrue("no changelogs found in ${dir.path}", changelogs.isNotEmpty())
-                .orEmpty()
+            changelogs.forEach { assertAtMost(it, CHANGELOG_LIMIT) }
-                .filter { it.isFile && it.extension == "txt" }
-                .forEach { assertAtMost(it, CHANGELOG_LIMIT) }
         }
     }
 

signing/README.md

@@ -27,7 +27,7 @@ keytool -printcert -jarfile subtracks.aab                 # the AAB
 keytool -printcert -file release-certificate.pem          # prints its SHA-256
 ```
 
-The `.aab` is the exact bundle uploaded to Google Play (install it by generating device APKs with [bundletool](https://github.com/google/bundletool)); the `.apk` is the universal APK for sideloading. The signing certificate SHA-256 is also listed in the release notes.
+The `.aab` is the app bundle (the one uploaded to Google Play for stable releases; install it by generating device APKs with [bundletool](https://github.com/google/bundletool)); the `.apk` is the universal APK for sideloading. The signing certificate SHA-256 is also listed in the release notes.
 
 ## Google Play