ci: route Android builds through BuildTool

BuildTool.sh

@@ -47,6 +47,9 @@ for arg in "$@"; do
   esac
 done
 
+CI_VERSION_CODE="${CI_VERSION_CODE:-}"
+CI_ARTIFACT_TIMESTAMP="${CI_ARTIFACT_TIMESTAMP:-}"
+
 need_cmd() {
   command -v "$1" >/dev/null 2>&1 || {
     echo "Missing required command: $1" >&2
@@ -111,6 +114,35 @@ gradle_no_daemon() {
   ./gradlew --no-daemon -Dorg.gradle.daemon=false "$@"
 }
 
+prepare_optional_release_signing() {
+  local required=(ANDROID_KEYSTORE_BASE64 ANDROID_KEYSTORE_PASSWORD ANDROID_KEY_ALIAS ANDROID_KEY_PASSWORD)
+  local missing=()
+  local key
+  for key in "${required[@]}"; do
+    if [[ -z "${!key:-}" ]]; then
+      missing+=("$key")
+    fi
+  done
+
+  if [[ ${#missing[@]} -eq ${#required[@]} ]]; then
+    return
+  fi
+
+  if [[ ${#missing[@]} -gt 0 ]]; then
+    printf 'Release signing secrets missing: %s\n' "${missing[*]}" >&2
+    exit 1
+  fi
+
+  mkdir -p .ci-secrets
+  printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 -d > .ci-secrets/release-keystore.jks
+  cat > keystore.properties <<EOF
+storeFile=.ci-secrets/release-keystore.jks
+storePassword=$ANDROID_KEYSTORE_PASSWORD
+keyAlias=$ANDROID_KEY_ALIAS
+keyPassword=$ANDROID_KEY_PASSWORD
+EOF
+}
+
 ensure_gitignore_entries() {
   touch .gitignore
   for entry in \
@@ -134,13 +166,14 @@ increment_versions() {
     exit 1
   fi
 
-  python3 - "$gradle_file" <<'PY'
+  python3 - "$gradle_file" "$CI_VERSION_CODE" <<'PY'
 import re
 import sys
 from pathlib import Path
 
 path = Path(sys.argv[1])
 text = path.read_text()
+ci_version_code = sys.argv[2].strip()
 
 m_code = re.search(r'\bversionCode\s*=\s*(\d+)', text)
 m_name = re.search(r'\bversionName\s*=\s*"(\d+(?:\.\d+)*)"', text)
@@ -151,7 +184,7 @@ if not m_name:
     raise SystemExit('versionName = "<number>" not found (must be numeric, e.g. "1" or "1.0")')
 
 old_code = int(m_code.group(1))
-new_code = old_code + 1
+new_code = int(ci_version_code) if ci_version_code else old_code + 1
 
 old_name = m_name.group(1)
 parts = old_name.split('.')
@@ -159,7 +192,8 @@ parts[-1] = str(int(parts[-1]) + 1)
 new_name = '.'.join(parts)
 
 text = re.sub(r'(\bversionCode\s*=\s*)\d+', r'\g<1>%d' % new_code, text, count=1)
-text = re.sub(r'(\bversionName\s*=\s*)"\d+(?:\.\d+)*"', r'\g<1>"%s"' % new_name, text, count=1)
+if not ci_version_code:
+    text = re.sub(r'(\bversionName\s*=\s*)"\d+(?:\.\d+)*"', r'\g<1>"%s"' % new_name, text, count=1)
 
 path.write_text(text)
 print(new_code)
@@ -193,8 +227,14 @@ copy_artifacts() {
       echo "Release AAB not found." >&2
       exit 1
     fi
-    cp "$release_aab" "$DIST_DIR/${APP_NAME}-v${version_code}-release.aab"
-    echo "Created: $DIST_DIR/${APP_NAME}-v${version_code}-release.aab"
+    local release_name
+    if [[ -n "$CI_ARTIFACT_TIMESTAMP" ]]; then
+      release_name="${APP_NAME}-${CI_ARTIFACT_TIMESTAMP}-release.aab"
+    else
+      release_name="${APP_NAME}-v${version_code}-release.aab"
+    fi
+    cp "$release_aab" "$DIST_DIR/$release_name"
+    echo "Created: $DIST_DIR/$release_name"
   fi
 }
 
@@ -233,6 +273,10 @@ main() {
     exit 0
   fi
 
+  if [[ "$WITH_AAB" == true ]]; then
+    prepare_optional_release_signing
+  fi
+
   local version_code
   version_code="$(increment_versions)"