ci: route Android builds through project tooling

AndroidProjectTooling.sh

@@ -38,6 +38,9 @@ ANDROID_TOOLBIN="$ANDROID_NDK_DIR/toolchains/llvm/prebuilt/linux-x86_64/bin"
 STATE_TTL_SECONDS=86400
 HIDE_EMULATOR_WINDOW="false"
 QUIET_LOG_DIR="$PROJECT_DIR/build/reports/android-project-tooling"
+NO_COMMIT="false"
+CI_VERSION_CODE="${CI_VERSION_CODE:-}"
+CI_ARTIFACT_TIMESTAMP="${CI_ARTIFACT_TIMESTAMP:-}"
 
 log() {
   printf '\n[%s] %s\n' "tooling" "$1"
@@ -299,6 +302,7 @@ import re
 
 path = Path(r'''$gradle_file''')
 text = path.read_text()
+ci_version_code = r'''$CI_VERSION_CODE'''.strip()
 
 version_code_match = re.search(r'versionCode\s*=\s*(\d+)', text)
 version_name_match = re.search(r'versionName\s*=\s*"(\d+)\.(\d+)\.(\d+)"', text)
@@ -309,14 +313,15 @@ if not version_code_match or not version_name_match:
 current_code = int(version_code_match.group(1))
 major, minor, patch = map(int, version_name_match.groups())
 
-new_code = current_code + 1
+new_code = int(ci_version_code) if ci_version_code else current_code + 1
 new_name = f'{major}.{minor}.{patch + 1}'
 
 text = re.sub(r'versionCode\s*=\s*\d+', f'versionCode = {new_code}', text, count=1)
-text = re.sub(r'versionName\s*=\s*"\d+\.\d+\.\d+"', f'versionName = "{new_name}"', text, count=1)
+if not ci_version_code:
+    text = re.sub(r'versionName\s*=\s*"\d+\.\d+\.\d+"', f'versionName = "{new_name}"', text, count=1)
 
 path.write_text(text)
-print(f'Updated versionCode to {new_code} and versionName to {new_name}')
+print(f'Updated versionCode to {new_code}' + (f' and versionName to {new_name}' if not ci_version_code else ''))
 PY
 }
 
@@ -352,6 +357,34 @@ upload_build_artifact_if_possible() {
   bash "$UPLOAD_SCRIPT" "$artifact_path"
 }
 
+prepare_optional_release_signing() {
+  local required=(ANDROID_KEYSTORE_BASE64 ANDROID_KEYSTORE_PASSWORD ANDROID_KEY_ALIAS ANDROID_KEY_PASSWORD)
+  local missing=()
+  local key
+  for key in "${required[@]}"; do
+    if [ -z "${!key:-}" ]; then
+      missing+=("$key")
+    fi
+  done
+
+  if [ ${#missing[@]} -eq ${#required[@]} ]; then
+    return
+  fi
+  if [ ${#missing[@]} -gt 0 ]; then
+    printf 'Release signing secrets missing: %s\n' "${missing[*]}" >&2
+    exit 1
+  fi
+
+  mkdir -p "$PROJECT_DIR/.ci-secrets"
+  printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 -d > "$PROJECT_DIR/.ci-secrets/release-keystore.jks"
+  cat > "$PROJECT_DIR/keystore.properties" <<EOF_INNER
+storeFile=.ci-secrets/release-keystore.jks
+storePassword=$ANDROID_KEYSTORE_PASSWORD
+keyAlias=$ANDROID_KEY_ALIAS
+keyPassword=$ANDROID_KEY_PASSWORD
+EOF_INNER
+}
+
 setup_env() {
   setup_java_env
   export ANDROID_HOME="$SDK_DIR"
@@ -810,7 +843,11 @@ maybe_run_operation() {
         artifact_target="$PROJECT_DIR/app/build/outputs/apk/debug/githug-android-debug-v${version_code}.apk"
         ;;
       --build-release-aab)
-        artifact_target="$PROJECT_DIR/app/build/outputs/bundle/release/githug-android-release-v${version_code}.aab"
+        if [ -n "$CI_ARTIFACT_TIMESTAMP" ]; then
+          artifact_target="$PROJECT_DIR/app/build/outputs/bundle/release/Githug-Android-${CI_ARTIFACT_TIMESTAMP}-release.aab"
+        else
+          artifact_target="$PROJECT_DIR/app/build/outputs/bundle/release/githug-android-release-v${version_code}.aab"
+        fi
         ;;
     esac
   fi
@@ -818,6 +855,9 @@ maybe_run_operation() {
     build_host_git
     export GITHUG_TEST_GIT_BINARY="$HOST_GIT_BINARY"
   fi
+  if [ "$mode" = "--build-release-aab" ]; then
+    prepare_optional_release_signing
+  fi
   if [ "$should_compile_android_git" = "true" ]; then
     build_android_git
   fi
@@ -845,7 +885,7 @@ maybe_run_operation() {
     log "Expected build output not found for rename: ${artifact_source#$PROJECT_DIR/}"
   fi
 
-  if [ "$should_auto_commit" = "true" ]; then
+  if [ "$should_auto_commit" = "true" ] && [ "$NO_COMMIT" != "true" ]; then
     auto_commit_if_needed
   fi
 
@@ -893,6 +933,9 @@ validate_args() {
     case "$1" in
       --quiet)
         ;;
+      --no-commit)
+        NO_COMMIT="true"
+        ;;
       --hide-emulator-window)
         if [ "$mode" != "--test-emulator" ]; then
           echo "--hide-emulator-window can only be used with --test-emulator" >&2