From 2275df40a834bbfb1cfbefc8ee9880594e0c962c Mon Sep 17 00:00:00 2001
From: Nils Pukropp <nils@narl.io>
Date: Sat, 3 Oct 2026 02:45:13 +0200
Subject: [PATCH] ci(android,release): publish the signed APK with each release

---
 .github/workflows/android.yml | 32 ++++++++++++++++++++++-----
 .github/workflows/release.yml | 41 ++++++++++++++++++++---------------
 docs/ANDROID.md               | 12 +++++-----
 3 files changed, 57 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 4981a70..20f7bd1 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -3,7 +3,15 @@ name: Android
 on:
   push:
     branches: [main]
-    tags: ['v*']
+  # A `v*` tag reaches this workflow through release.yml, which calls it and
+  # publishes the signed APK. Triggering on the tag here as well would build
+  # the release twice.
+  workflow_call:
+    inputs:
+      signed_release:
+        required: false
+        default: false
+        type: boolean
   pull_request:
     paths:
       - 'android/**'
@@ -188,10 +196,24 @@ jobs:
       - name: Build signed APK and AAB
         run: bash scripts/build-android.sh signed
 
+      # The APK bundles a GPL libmpv, so its corresponding source ships next to
+      # it. The AAB is for Play only and stays out of the GitHub release.
+      - name: Stage release files
+        run: |
+          version="$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -n1)"
+          mkdir -p dist/android
+          cp android/app/build/outputs/apk/release/app-release.apk \
+            "dist/android/proton-stream-$version-android.apk"
+          cp android/app/build/generated/mpv/mpv-android-source-*.tar.gz dist/android/
+
       - uses: actions/upload-artifact@v7
         with:
-          name: android-signed
-          path: |
-            android/app/build/outputs/apk/release/*.apk
-            android/app/build/outputs/bundle/release/*.aab
+          name: android
+          path: dist/android/*
+          if-no-files-found: error
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: android-bundle
+          path: android/app/build/outputs/bundle/release/*.aab
           if-no-files-found: error
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7880d72..a169402 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,9 +20,6 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
-  # Android remains a workflow artifact only until the native libmpv adapter,
-  # corresponding-source bundle, and on-device verification are complete.
-  ANDROID_PUBLIC_RELEASE_ENABLED: 'false'
 
 jobs:
   verify:
@@ -60,11 +57,6 @@ jobs:
           ! grep -q '^\[patch\.crates-io\]' Cargo.toml ||
             { echo "::error::Cargo.toml carries [patch.crates-io]; releases build against the registry"; exit 1; }
 
-      - name: Android publication remains blocked
-        run: |
-          test "$ANDROID_PUBLIC_RELEASE_ENABLED" = false
-          echo "Android APK/AAB publication is blocked until native playback is release-ready."
-
   linux:
     name: Linux artifacts
     needs: verify
@@ -148,25 +140,38 @@ jobs:
             dist/*.msi
           if-no-files-found: error
 
+  # The signed APK plus the corresponding source of the libmpv it bundles. The
+  # keystore and its passwords come from the ANDROID_RELEASE_* secrets.
+  android:
+    name: Android
+    needs: verify
+    uses: ./.github/workflows/android.yml
+    with:
+      signed_release: true
+    secrets: inherit
+
   publish:
-    name: Publish desktop artifacts
+    name: Publish
     if: startsWith(github.ref, 'refs/tags/')
-    needs: [linux, windows]
+    needs: [linux, windows, android]
     runs-on: ubuntu-24.04
     permissions:
       contents: write
     steps:
+      # By name: the Android workflow also uploads the AAB, which is for Play
+      # and does not belong on the release.
       - uses: actions/download-artifact@v8
         with:
+          name: linux
+          path: artifacts
+      - uses: actions/download-artifact@v8
+        with:
+          name: windows
+          path: artifacts
+      - uses: actions/download-artifact@v8
+        with:
+          name: android
           path: artifacts
-          merge-multiple: true
-
-      - name: Refuse mobile artifacts while Android publishing is blocked
-        run: |
-          if find artifacts -type f \( -name '*.apk' -o -name '*.aab' \) -print -quit | grep -q .; then
-            echo "::error::Android publishing is disabled while native playback remains incomplete"
-            exit 1
-          fi
 
       - name: Checksums
         run: |
diff --git a/docs/ANDROID.md b/docs/ANDROID.md
index 39b0680..2abbf9d 100644
--- a/docs/ANDROID.md
+++ b/docs/ANDROID.md
@@ -87,11 +87,13 @@ GitHub Actions expects the keystore itself as the base64-encoded
 Keep the keystore and passwords in a durable external secret manager; losing the
 key prevents users from upgrading an installed APK.
 
-Tagged workflows currently retain signed builds as workflow artifacts only.
-Publishing them to a GitHub release or Play remains disabled until the pinned
-libmpv build and resulting APK have passed the on-device playback matrix. The
-main release workflow publishes desktop artifacts only and fails if an APK or
-AAB enters its artifact set.
+A `v*` tag runs `release.yml`, which calls `android.yml` with
+`signed_release: true` and publishes the signed APK as
+`proton-stream-<version>-android.apk` next to the desktop artifacts, together
+with the `mpv-android-source-<rev>.tar.gz` corresponding source for the bundled
+libmpv. The AAB is kept as the `android-bundle` workflow artifact only; nothing
+uploads it to Play. A manual `android.yml` run with `signed_release` builds the
+same signed files without publishing them.
 
 ## Licensing and Native Playback