From de4bd473f9553400939e1a2c27778ef1a5929c9c Mon Sep 17 00:00:00 2001
From: austinried <4966622+austinried@users.noreply.github.com>
Date: Thu, 8 Oct 2026 19:51:03 +0000
Subject: [PATCH] ci: upload the nightly APKs as separate raw artifacts

archive: false only supports a single file, so upload each of the two
APKs and SHA256SUMS as its own unzipped artifact instead of one zip.
---
 .github/workflows/ci.yml | 17 ++++++++++++-----
 AGENTS.md                |  2 +-
 signing/README.md        |  2 +-
 3 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e5bd758f..4896e9c5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,11 +35,18 @@ jobs:
       - uses: actions/upload-artifact@v7
         if: github.ref == 'refs/heads/main'
         with:
-          name: subtracks-nightly
-          path: |
-            subtracks-nightly.apk
-            subtracks-nightly-debug.apk
-            SHA256SUMS
+          path: subtracks-nightly.apk
+          archive: false
+      - uses: actions/upload-artifact@v7
+        if: github.ref == 'refs/heads/main'
+        with:
+          path: subtracks-nightly-debug.apk
+          archive: false
+      - uses: actions/upload-artifact@v7
+        if: github.ref == 'refs/heads/main'
+        with:
+          path: SHA256SUMS
+          archive: false
       - uses: actions/cache@v6
         with:
           path: .integration/music
diff --git a/AGENTS.md b/AGENTS.md
index 7734a2a6..5e3b046a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -34,7 +34,7 @@ Everything comes from the Nix flake devshell; do not install toolchains by hand.
 
 ## CI
 
-- Forgejo Actions, `.forgejo/workflows/ci.yml`, a single `ci` job that runs lint, the unit tests, the debug and nightly assembles and the integration suite (one cache restore/save and Gradle warm-up instead of several); the GitHub copy uploads the debug and nightly APKs as the `subtracks-nightly` artifact on a push to `main`.
+- Forgejo Actions, `.forgejo/workflows/ci.yml`, a single `ci` job that runs lint, the unit tests, the debug and nightly assembles and the integration suite (one cache restore/save and Gradle warm-up instead of several); the GitHub copy uploads the debug and nightly APKs and the checksums as separate artifacts on a push to `main`.
 - Runs on the `nix-docker` runner (the `localhost/nix-ci` image built by the separate `nix-home` repo) inside the devshell, restoring the Nix store via `cache-nix-action` and caching Gradle and the integration test music.
 - The `nix-docker` and `bookworm` runner labels, their images and the runner's networking are defined in the separate `nix-home` repo (`hosts-incus/git-runner.nix`).
 - Pull requests from a fork need approval before the workflow runs.
diff --git a/signing/README.md b/signing/README.md
index ee36d9a9..67e3fb6a 100644
--- a/signing/README.md
+++ b/signing/README.md
@@ -41,7 +41,7 @@ keytool -printcert -jarfile app-release.aab
 
 ## `nightly` builds
 
-The signing key is the committed [`app/debug.keystore`](../app/debug.keystore) (a public key: alias `androiddebugkey`, password `android`). The `subtracks-nightly` artifact contains `subtracks-nightly.apk` (minified) and `subtracks-nightly-debug.apk` (debuggable), both `com.subtracks.nightly`. Certificate SHA-256:
+The signing key is the committed [`app/debug.keystore`](../app/debug.keystore) (a public key: alias `androiddebugkey`, password `android`). The nightly build uploads `subtracks-nightly.apk` (minified) and `subtracks-nightly-debug.apk` (debuggable), both `com.subtracks.nightly`, as separate artifacts, along with `SHA256SUMS`. Certificate SHA-256:
 
 ```
 # keytool format