claude 9268579c5f ci(release): make the release tag-driven (no push to protected main) ...

The push-to-main release model kept failing: the job builds the signed APK
fine, but the final `git push origin HEAD:main` (version-bump commit) is
rejected by main's branch protection — "pre-receive hook declined / Internal
Server Error" — across runs #187, #194. main is deliberately protected
(allowlist push, required approvals, required status checks), which is
fundamentally incompatible with a CI job pushing a fresh commit to it.

Flip the trigger: the workflow now runs on pushing a `v*` tag (or via
workflow_dispatch with a tag input). The tag *is* the release input, so:

- version/versionCode are derived from the tag name (no version-planning engine);
- app/build.gradle.kts is set for the build only, never committed back;
- no `git push` to main, no tag creation, no REGISTRY_USER needed —
  only REGISTRY_TOKEN, to create the Gitea release + upload the APK/SHA256SUMS.

To cut a release now: `git tag v0.1.0 && git push origin v0.1.0`.

Keeps the speed fixes from #13 (trimmed setup-android, no Gradle cache,
timeout-minutes). Changelog is still generated from conventional-commit
subjects since the previous tag.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-07-20 19:00:04 +00:00

..

workflows

ci(release): make the release tag-driven (no push to protected main)

2026-07-20 19:00:04 +00:00