feat: signed android build

.github/scripts/publish-release.sh

@@ -3,7 +3,7 @@ set -euo pipefail
 
 required_env_vars=(GH_TOKEN TAG COMMIT REPOSITORY)
 required_assets=(
-  anagram-android-debug-test-only.apk
+  anagram-android-release.apk
   anagram-linux.AppImage
   anagram-linux.deb
   anagram-linux.rpm
@@ -45,13 +45,13 @@ Automated binary release for ${TAG}.
 
 Commit: ${COMMIT}
 
-Android test-only artifact:
+Android production artifact:
 
-**anagram-android-debug-test-only.apk is a DEBUG build provided only for direct-install testing. It is not a production Android release, is not the F-Droid package, and is not intended for normal user installation or updates. Production Android distribution will be through F-Droid. If Android rejects an update because the debug signing key changed, uninstall the previous test build first.**
+**anagram-android-release.apk is the production signed Android release APK.**
 
 Versioned asset URLs:
 
-- Android debug APK (TEST ONLY): https://github.com/${REPOSITORY}/releases/download/${TAG}/anagram-android-debug-test-only.apk
+- Android release APK: https://github.com/${REPOSITORY}/releases/download/${TAG}/anagram-android-release.apk
 - Linux AppImage: https://github.com/${REPOSITORY}/releases/download/${TAG}/anagram-linux.AppImage
 - Linux DEB: https://github.com/${REPOSITORY}/releases/download/${TAG}/anagram-linux.deb
 - Linux RPM: https://github.com/${REPOSITORY}/releases/download/${TAG}/anagram-linux.rpm
@@ -60,7 +60,7 @@ Versioned asset URLs:
 
 Latest asset URLs:
 
-- Android debug APK (TEST ONLY): https://github.com/${REPOSITORY}/releases/latest/download/anagram-android-debug-test-only.apk
+- Android release APK: https://github.com/${REPOSITORY}/releases/latest/download/anagram-android-release.apk
 - Linux AppImage: https://github.com/${REPOSITORY}/releases/latest/download/anagram-linux.AppImage
 - Linux DEB: https://github.com/${REPOSITORY}/releases/latest/download/anagram-linux.deb
 - Linux RPM: https://github.com/${REPOSITORY}/releases/latest/download/anagram-linux.rpm

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-name: Release desktop binaries and Android test build
+name: Publish desktop and signed Android binaries
 
 on:
   push:
@@ -31,7 +31,7 @@ jobs:
         run: bash .github/scripts/validate-release-tag.sh
 
   build-android:
-    name: Build Android Debug APK (TEST ONLY)
+    name: Build signed Android release APK
     needs: validate-tag
     runs-on: ubuntu-latest
 
@@ -42,17 +42,35 @@ jobs:
         with:
           node-version: 24.x
 
-      - name: Build Android Debug APK (TEST ONLY)
-        run: npm run build:android:apk:debug
+      - name: Restore Android release keystore
+        shell: bash
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+        run: |
+          printf '%s' "$ANDROID_KEYSTORE_BASE64" |
+            base64 --decode > "$RUNNER_TEMP/anagram-release.jks"
+          chmod 600 "$RUNNER_TEMP/anagram-release.jks"
 
-      - name: Stage Android test-only asset
+      - name: Build signed Android release APK
+        env:
+          ANDROID_KEYSTORE_PATH: ${{ runner.temp }}/anagram-release.jks
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: npm run build:android:apk:release
+
+      - name: Stage Android release asset
         shell: bash
-        run: bash .github/scripts/stage-release-asset.sh dist/capacitor/android/apk/debug '*.apk' release-assets/anagram-android-debug-test-only.apk
+        run: |
+          bash .github/scripts/stage-release-asset.sh \
+            dist/capacitor/android/apk/release \
+            '*.apk' \
+            release-assets/anagram-android-release.apk
 
       - uses: actions/upload-artifact@v6
         with:
-          name: release-android-debug-test-only
-          path: release-assets/anagram-android-debug-test-only.apk
+          name: release-android
+          path: release-assets/anagram-android-release.apk
           if-no-files-found: error
 
   build-linux:

.gitignore

@@ -77,6 +77,7 @@ web_modules/
 .env
 .env.*
 !.env.example
+*.jks
 
 # parcel-bundler cache (https://parceljs.org/)
 .cache

fastlane/metadata/android/en-US/changelogs/10.txt

@@ -0,0 +1,4 @@
+Version 0.7.3
+
+- Added signed Android release builds.
+- No application behavior changes.

package.json

@@ -1,7 +1,7 @@
 {
   "name": "anagram",
   "productName": "Anagram",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "Anagram is a desktop and web private messaging client for Nostr.",
   "author": "LNbits",
   "homepage": "https://github.com/lnbits/anagram/",

src-capacitor/package.json

@@ -1,7 +1,7 @@
 {
   "name": "anagram",
-  "version": "0.7.2",
-  "androidVersionCode": 9,
+  "version": "0.7.3",
+  "androidVersionCode": 10,
   "description": "Anagram is a desktop and web private messaging client for Nostr.",
   "private": true,
   "scripts": {