feat: sign Android releases with the release keyHEADmain

assembleRelease reads the key from ~/.gradle/gradle.properties and fails
without it instead of falling back to the debug key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 25 insertions, 4 deletions

diff --git a/packages/meshbay-android/app/build.gradle.kts b/packages/meshbay-android/app/build.gradle.kts
index 3f29ac0..8afbc1a 100644
--- a/packages/meshbay-android/app/build.gradle.kts
+++ b/packages/meshbay-android/app/build.gradle.kts
@@ -8,6 +8,9 @@ val packageVersion = (JsonSlurper().parse(rootDir.resolve("../meshbay-client/pac
     as Map<*, *>)["version"] as String
 val versionParts = packageVersion.split(".").map { it.toInt() }
 
+val releaseSigning = listOf("meshbayReleaseStoreFile", "meshbayReleaseStorePassword",
+                            "meshbayReleaseKeyAlias", "meshbayReleaseKeyPassword")
+
 android {
     namespace = "org.meshbay.client"
     compileSdk = 37
@@ -18,13 +21,21 @@ android {
         versionName = packageVersion
         versionCode = versionParts[0] * 10000 + versionParts[1] * 100 + versionParts[2]
     }
+    // The release key never enters the repository: its path and passwords come
+    // from ~/.gradle/gradle.properties. Without them a release build stops
+    // rather than signing with the debug key (see preReleaseBuild below).
+    if (releaseSigning.all { providers.gradleProperty(it).isPresent }) {
+        signingConfigs.create("release") {
+            storeFile = file(providers.gradleProperty("meshbayReleaseStoreFile").get())
+            storePassword = providers.gradleProperty("meshbayReleaseStorePassword").get()
+            keyAlias = providers.gradleProperty("meshbayReleaseKeyAlias").get()
+            keyPassword = providers.gradleProperty("meshbayReleaseKeyPassword").get()
+        }
+    }
     buildTypes {
         getByName("release") {
             isMinifyEnabled = false
-            // A stand-in until the release key exists (Stage D12): the debug
-            // key, so a release build installs over a debug one and back
-            // without losing the account. Not a key to publish anything with.
-            signingConfig = signingConfigs.getByName("debug")
+            signingConfig = signingConfigs.findByName("release")
         }
     }
     compileOptions {
@@ -81,6 +92,16 @@ val syncUi = tasks.register<SyncUi>("syncUi") {
     outputDir.set(layout.buildDirectory.dir("generated/ui-assets"))
 }
 
+// Checked when a release is built, not when the project is configured, so a
+// debug build and the unit tests need no key.
+tasks.configureEach {
+    if (name == "preReleaseBuild") doFirst {
+        val missing = releaseSigning.filter { !providers.gradleProperty(it).isPresent }
+        if (missing.isNotEmpty()) throw GradleException(
+            "no release key: set ${missing.joinToString()} in ~/.gradle/gradle.properties")
+    }
+}
+
 androidComponents {
     onVariants { variant ->
         variant.sources.assets?.addGeneratedSourceDirectory(syncUi, SyncUi::outputDir)