wtclaude
0df862a6af
All checks were successful
PR Checks / android-build (pull_request) Successful in 9m52s
Release-hardening pass (PLAN.md §9 M6, §10, §12). No architecture, data-flow, or endpoint changes; the app remains a pure API client. App icons (default brand assets): - New gateway-medallion launcher icon set (all densities, adaptive fg/bg, round, Play Store icon) + an RG notification icon staged for M7 push. - Replace the Image Asset wizard's default green-grid adaptive background with the deep-indigo brand fill (@color/ic_launcher_background #1B1033); recomposite the legacy square/round webps and the 512 Play icon over indigo so the whole set is coherent (the green never shipped). Restore the SPDX headers the wizard stripped; drop the orphaned placeholder foreground vector. No <monochrome> layer — the full-colour medallion has no clean silhouette, so themed mode falls back to the standard icon rather than a tinted blob. Version-mismatch guard (§3): - The connect probe now refuses a Runic Gateway backend whose API version this build can't speak (e.g. a future v2) with a clear "app out of date" message, instead of mis-rendering; lenient on a blank api (older backend). Decision logic extracted to a pure ConnectionRepository.evaluateVersion() with unit tests. Release build hardening (§7, §12): - Enable R8 full-mode minify + resource shrink for release (~31 MB debug -> 4.2 MB signed release). ProGuard keep-rules for kotlinx.serialization serializers + our wire DTOs, Retrofit service interfaces, and a -dontwarn for Tink's compile-only Error Prone annotations (EncryptedSharedPreferences). - Release signingConfig reads keystore material from a gitignored keystore.properties or env vars; absent -> unsigned (debug + PR gate unaffected). Keystore never in repo. - versionName/versionCode overridable via -P so the release tag + CI run number drive them (§10). CI: - release.yml: on a `v*` tag, build a SIGNED release APK (keystore from a base64 Gitea secret) and attach it + SHA256SUMS to a Gitea release; workflow_dispatch is a signing dry run. Mirrors pr-checks.yml's self-hosted-runner handling (apt JDK 17, explicit sdkmanager, in-step chmod +x gradlew). Co-Authored-By: Claude <noreply@anthropic.com>
60 lines
3.0 KiB
Prolog
60 lines
3.0 KiB
Prolog
# Runic Gateway Android app — ProGuard/R8 rules (release minify + resource shrink, M6).
|
|
#
|
|
# The dependency stack ships its own consumer rules that R8 applies automatically:
|
|
# Retrofit 2.11, OkHttp 4.12, kotlinx.serialization 1.7 (core), Hilt/Dagger, Coil 2.7.
|
|
# The rules below are defensive belt-and-suspenders for the areas full-mode R8 is
|
|
# most likely to over-strip in this app: the kotlinx.serialization generated
|
|
# serializers and our own @Serializable wire DTOs.
|
|
|
|
# ── kotlinx.serialization (canonical keep rules) ────────────────────────────
|
|
-keepattributes *Annotation*, InnerClasses
|
|
-dontnote kotlinx.serialization.**
|
|
|
|
# Keep the Companion of @Serializable classes so `.serializer()` resolves.
|
|
-if @kotlinx.serialization.Serializable class **
|
|
-keepclassmembers class <1> {
|
|
static <1>$Companion Companion;
|
|
}
|
|
-if @kotlinx.serialization.Serializable class ** {
|
|
static **$Companion Companion;
|
|
}
|
|
-keepclassmembers class <2>$Companion {
|
|
kotlinx.serialization.KSerializer serializer(...);
|
|
}
|
|
# Keep `INSTANCE.serializer()` of @Serializable objects.
|
|
-if @kotlinx.serialization.Serializable class ** {
|
|
public static ** INSTANCE;
|
|
}
|
|
-keepclassmembers class <1> {
|
|
public static <1> INSTANCE;
|
|
kotlinx.serialization.KSerializer serializer(...);
|
|
}
|
|
# Keep the synthesized $$serializer classes and their descriptor field.
|
|
-keepclassmembers class **$$serializer {
|
|
*** descriptor;
|
|
}
|
|
|
|
# ── Our wire DTOs ───────────────────────────────────────────────────────────
|
|
# All request/response models decoded by kotlinx.serialization. Keeping them
|
|
# (and their generated serializers) guarantees additive backend fields and
|
|
# @SerialName mappings survive minification. DTOs are small, so keeping them
|
|
# whole is cheap insurance against a full-mode strip.
|
|
-keep @kotlinx.serialization.Serializable class com.runicgateway.app.** { *; }
|
|
-keepclassmembers class com.runicgateway.app.data.api.dto.** { *; }
|
|
|
|
# ── Retrofit service interfaces ─────────────────────────────────────────────
|
|
# Retrofit reads method + parameter annotations reflectively; keep our API
|
|
# interfaces' generic signatures so return types (suspend .../Call<T>) resolve.
|
|
-keep,allowobfuscation interface com.runicgateway.app.data.api.*Api
|
|
-keepattributes Signature, Exceptions
|
|
|
|
# Kotlin metadata is needed for reflection over Kotlin types (serialization/Retrofit).
|
|
-keep class kotlin.Metadata { *; }
|
|
|
|
# ── Tink / EncryptedSharedPreferences (androidx.security-crypto) ─────────────
|
|
# Tink references Error Prone compile-only annotations that are absent at runtime;
|
|
# they are safe to ignore (they carry no runtime behaviour). Suppresses the R8
|
|
# "Missing class com.google.errorprone.annotations.*" errors.
|
|
-dontwarn com.google.errorprone.annotations.**
|
|
|