Chore/audit hardening

.github/workflows/ci.yml

@@ -40,6 +40,9 @@ jobs:
       - name: Run unit tests
         run: ./gradlew testDebugUnitTest --no-daemon
 
+      - name: Run Android lint
+        run: ./gradlew lintDebug --no-daemon
+
       - name: Build debug APK
         run: ./gradlew assembleDebug --no-daemon
 
@@ -50,3 +53,32 @@ jobs:
           path: app/build/outputs/apk/debug/*.apk
           if-no-files-found: error
           retention-days: 14
+
+  instrumented-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: "21"
+          distribution: temurin
+          cache: gradle
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Grant execute permission for Gradle wrapper
+        run: chmod +x gradlew
+
+      - name: Run instrumented smoke tests
+        uses: reactivecircus/android-emulator-runner@v2
+        with:
+          api-level: 30
+          arch: x86_64
+          profile: pixel_6
+          script: ./gradlew connectedDebugAndroidTest --no-daemon

.github/workflows/release.yml

@@ -36,15 +36,23 @@ jobs:
         run: chmod +x gradlew
 
       - name: Decode release keystore
-        if: ${{ secrets.ANDROID_KEYSTORE_BASE64 != '' }}
         env:
           ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+          APP_VERSION_CODE: ${{ github.run_number }}
         run: |
+          if [ -z "$ANDROID_KEYSTORE_BASE64" ] || [ -z "$ANDROID_KEYSTORE_PASSWORD" ] || [ -z "$ANDROID_KEY_ALIAS" ] || [ -z "$ANDROID_KEY_PASSWORD" ]; then
+            echo "Release signing secrets are required for release builds." >&2
+            exit 1
+          fi
           echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > "${RUNNER_TEMP}/release.keystore"
           echo "ANDROID_KEYSTORE_PATH=${RUNNER_TEMP}/release.keystore" >> "$GITHUB_ENV"
-          echo "ANDROID_KEYSTORE_PASSWORD=${{ secrets.ANDROID_KEYSTORE_PASSWORD }}" >> "$GITHUB_ENV"
-          echo "ANDROID_KEY_ALIAS=${{ secrets.ANDROID_KEY_ALIAS }}" >> "$GITHUB_ENV"
-          echo "ANDROID_KEY_PASSWORD=${{ secrets.ANDROID_KEY_PASSWORD }}" >> "$GITHUB_ENV"
+          echo "ANDROID_KEYSTORE_PASSWORD=${ANDROID_KEYSTORE_PASSWORD}" >> "$GITHUB_ENV"
+          echo "ANDROID_KEY_ALIAS=${ANDROID_KEY_ALIAS}" >> "$GITHUB_ENV"
+          echo "ANDROID_KEY_PASSWORD=${ANDROID_KEY_PASSWORD}" >> "$GITHUB_ENV"
+          echo "APP_VERSION_CODE=${APP_VERSION_CODE}" >> "$GITHUB_ENV"
 
       - name: Build release APK
         run: ./gradlew assembleRelease --no-daemon

README.md

@@ -12,7 +12,7 @@ A native Android client for [Pledger.io](https://github.com/pledger-io) — a se
 | DI | Hilt (KSP) |
 | Networking | Retrofit + OkHttp + Moshi |
 | Images | Coil (authenticated via shared OkHttp client) |
-| Database | Room (offline cache, v3 schema) |
+| Database | Room (offline cache, v6 schema with explicit migrations) |
 | Async | Coroutines + Flow |
 | Navigation | Jetpack Navigation Compose |
 | Background work | WorkManager |
@@ -144,7 +144,7 @@ Requires **JDK 21**.
 
 | Workflow | Trigger | Result |
 |----------|---------|--------|
-| [CI](.github/workflows/ci.yml) | Push / PR to `main` or `master` | Unit tests + debug APK artifact |
+| [CI](.github/workflows/ci.yml) | Push / PR to `main` or `master` | Unit tests + lint + instrumented smoke test + debug APK artifact |
 | [Release](.github/workflows/release.yml) | **Publish** a GitHub Release, or manual run | Release APK attached to the release |
 
 **Distributing an APK on GitHub Release**
@@ -159,7 +159,7 @@ To test the release build without publishing: **Actions → Release → Run work
 
 Users can report problems from **Settings → About → Report a problem**. The app collects sanitized recent logs, prefills the org [bug report form](https://github.com/pledger-io/.github/issues/new?template=bug_report.yml) in the browser (summary, description, environment, logs), and the user taps **Submit** on GitHub — no app credentials required. Sign in to GitHub only if the repository requires it to open issues.
 
-**Optional production signing** — add these repository secrets; if omitted, CI signs the release APK with the debug keystore (fine for sideloading, not for Play Store):
+**Production signing is required for release builds** — configure these repository secrets:
 
 | Secret | Description |
 |--------|-------------|

app/build.gradle.kts

@@ -6,6 +6,25 @@ plugins {
     alias(libs.plugins.ksp)
 }
 
+val appVersionCode = System.getenv("APP_VERSION_CODE")?.toIntOrNull() ?: 1
+val releaseKeystorePath = System.getenv("ANDROID_KEYSTORE_PATH")
+val isCi = !System.getenv("CI").isNullOrBlank()
+val buildingReleaseTask = gradle.startParameter.taskNames.any { task ->
+    task.contains("Release", ignoreCase = true)
+}
+
+if (isCi && buildingReleaseTask && releaseKeystorePath.isNullOrBlank()) {
+    throw GradleException(
+        "Release signing is required in CI for release builds. Set ANDROID_KEYSTORE_PATH and signing env vars.",
+    )
+}
+
+ksp {
+    arg("room.schemaLocation", "$projectDir/schemas")
+    arg("room.incremental", "true")
+    arg("room.generateKotlin", "true")
+}
+
 android {
     namespace = "com.pledgerio.app"
     compileSdk = libs.versions.compileSdk.get().toInt()
@@ -14,17 +33,16 @@ android {
         applicationId = "com.pledgerio.app"
         minSdk = libs.versions.minSdk.get().toInt()
         targetSdk = libs.versions.targetSdk.get().toInt()
-        versionCode = 1
+        versionCode = appVersionCode
         versionName = "1.0.0"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }
 
     signingConfigs {
-        val keystorePath = System.getenv("ANDROID_KEYSTORE_PATH")
-        if (!keystorePath.isNullOrBlank()) {
+        if (!releaseKeystorePath.isNullOrBlank()) {
             create("release") {
-                storeFile = file(keystorePath)
+                storeFile = file(releaseKeystorePath)
                 storePassword = System.getenv("ANDROID_KEYSTORE_PASSWORD")
                 keyAlias = System.getenv("ANDROID_KEY_ALIAS")
                 keyPassword = System.getenv("ANDROID_KEY_PASSWORD")
@@ -41,7 +59,6 @@ android {
                 "proguard-rules.pro"
             )
             signingConfig = signingConfigs.findByName("release")
-                ?: signingConfigs.getByName("debug")
         }
     }
 
@@ -58,6 +75,10 @@ android {
         compose = true
         buildConfig = true
     }
+
+    lint {
+        baseline = file("lint-baseline.xml")
+    }
 }
 
 dependencies {