fix: sign release APKs with stable keystore from secrets

.github/workflows/release.yml

@@ -103,10 +103,21 @@ jobs:
           echo "code=$CODE" >> "$GITHUB_OUTPUT"
           echo "Release: tag=$TAG version=$VERSION code=$CODE"
 
+      - name: Decode release keystore
+        env:
+          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
+        run: |
+          echo "$KEYSTORE_BASE64" | base64 -d > hermes-control-release.keystore.jks
+          ls -lh hermes-control-release.keystore.jks
+
       - name: Build Release APK
         env:
           VERSION_NAME: ${{ steps.version.outputs.version }}
           VERSION_CODE: ${{ steps.version.outputs.code }}
+          KEYSTORE_PATH: ${{ github.workspace }}/hermes-control-release.keystore.jks
+          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
         run: |
           ./gradlew assembleRelease \
             -PversionName="$VERSION_NAME" \

.gitignore

@@ -1,15 +1,14 @@
-*.iml
+# Release keystore (local copy — stored as GitHub secret)
-.gradle
+hermes-control-release.keystore.jks
-.gradle-home
+
-$PWD
+# Android / Gradle
-.agents
+build/
-*.log
+.gradle/
-/local.properties
-/.idea
-.DS_Store
-/build
-/captures
-.externalNativeBuild
-.cxx
 local.properties
-*.apk
+*.iml
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo

app/build.gradle.kts

@@ -21,12 +21,21 @@ android {
         versionName = (project.findProperty("versionName") as? String) ?: "1.0-dev"
     }
 
+    signingConfigs {
+        create("release") {
+            storeFile = file(System.getenv("KEYSTORE_PATH") ?: "hermes-control-release.keystore.jks")
+            storePassword = System.getenv("KEYSTORE_PASSWORD") ?: "hermes_release"
+            keyAlias = System.getenv("KEY_ALIAS") ?: "hermes-control-release"
+            keyPassword = System.getenv("KEY_PASSWORD") ?: "hermes_release"
+        }
+    }
+
     buildTypes {
         release {
             isMinifyEnabled = true
             isShrinkResources = true
             proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
-            signingConfig = signingConfigs.getByName("debug")
+            signingConfig = signingConfigs["release"]
         }
     }
     compileOptions {