build(android): release keystore signing, gradle migrator flags, image-audit tool #696

Merged

raisondetredev merged 3 commits from refs/pull/696/head into main

2026-06-26 16:26:27 +02:00

raisondetredev commented

2026-06-26 16:25:46 +02:00

(Migrated from codeberg.org)

What

Three independent build/tooling changes that had accumulated in the working tree, none related to any feature:

Android release signing — a real PKCS12 release signing config sourced from $HALKYON_KEYSTORE_PASSWORD and ~/secrets/halkyon-release.p12, replacing the debug-key fallback. A release build with the password unset now fails loudly with a GradleException instead of silently signing with the debug key. Adds signing/secret patterns to .gitignore (*.p12, *.jks, *.keystore, key.properties, .env*) while keeping .env.example tracked.
Gradle migrator flags — android.builtInKotlin=false / android.newDsl=false, written by the Flutter Gradle migrator.
External-image audit tool — read-only SQL that lists every image block referencing a host outside our own Supabase storage, so external-CDN dependencies can be tracked and re-hosted. Also ignores the local tool/path_variability.json output.

Also fixes a malformed .gitignore line where !.env.example and tool/path_variability.json had been concatenated onto one line (and restores the missing trailing newline).

Commits

build(android): sign release builds with an env-provided keystore
chore(android): apply Flutter migrator gradle flags
chore(tooling): add external-image audit query

⚠️ Build note

Release builds now require $HALKYON_KEYSTORE_PASSWORD and ~/secrets/halkyon-release.p12. Debug and IDE builds are unaffected. CI and the build docs should provide the env var, e.g.:

pass-cli run --env-file ./env/.env.build -- fvm flutter build apk --release

Notes

No app code touched — lib/ and test/ are untouched, so no test impact.
Independent of feat/streak-counts-flashcard-authoring; this PR can merge in any order relative to it.

## What Three independent build/tooling changes that had accumulated in the working tree, none related to any feature: 1. **Android release signing** — a real PKCS12 release signing config sourced from `$HALKYON_KEYSTORE_PASSWORD` and `~/secrets/halkyon-release.p12`, replacing the debug-key fallback. A release build with the password unset now fails loudly with a `GradleException` instead of silently signing with the debug key. Adds signing/secret patterns to `.gitignore` (`*.p12`, `*.jks`, `*.keystore`, `key.properties`, `.env*`) while keeping `.env.example` tracked. 2. **Gradle migrator flags** — `android.builtInKotlin=false` / `android.newDsl=false`, written by the Flutter Gradle migrator. 3. **External-image audit tool** — read-only SQL that lists every `image` block referencing a host outside our own Supabase storage, so external-CDN dependencies can be tracked and re-hosted. Also ignores the local `tool/path_variability.json` output. Also fixes a malformed `.gitignore` line where `!.env.example` and `tool/path_variability.json` had been concatenated onto one line (and restores the missing trailing newline). ## Commits - `build(android): sign release builds with an env-provided keystore` - `chore(android): apply Flutter migrator gradle flags` - `chore(tooling): add external-image audit query` ## ⚠️ Build note Release builds now **require** `$HALKYON_KEYSTORE_PASSWORD` and `~/secrets/halkyon-release.p12`. Debug and IDE builds are unaffected. CI and the build docs should provide the env var, e.g.: ``` pass-cli run --env-file ./env/.env.build -- fvm flutter build apk --release ``` ## Notes - No app code touched — `lib/` and `test/` are untouched, so no test impact. - Independent of `feat/streak-counts-flashcard-authoring`; this PR can merge in any order relative to it.