Production release: build and ship a non-debuggable release APK

release.yml shipped app-debug.apk, so production was debuggable. It now runs
assembleRelease, signed with the same keystore (identical certificate, so
updates still install over existing ones), with isDebuggable = false.
Minification stays off: R8 cannot be tried on a device here.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01TWwLCrXa9aFVg8dZsCdLBZ

.github/workflows/release.yml

@@ -49,8 +49,8 @@ jobs:
       - name: Set up Android SDK
         uses: android-actions/setup-android@v4
 
-      - name: Build debug APK
-        run: ./gradlew assembleDebug --no-daemon --stacktrace
+      - name: Build release APK
+        run: ./gradlew assembleRelease --no-daemon --stacktrace
 
       - name: Stage APK for release
         id: stage
@@ -65,7 +65,7 @@ jobs:
           test -n "$offset"
           # Same arithmetic as build.gradle.kts, so the tag names the APK's own number.
           version="v${series}.$(( ${{ github.run_number }} + offset ))"
-          src="app/build/outputs/apk/debug/app-debug.apk"
+          src="app/build/outputs/apk/release/app-release.apk"
           dest="ProLibertateGames-${version}.apk"
           cp "$src" "$dest"
           # The same build again under a name that never changes. GitHub's

app/build.gradle.kts

@@ -104,6 +104,11 @@ android {
 
     buildTypes {
         release {
+            // Signed with the same key as the debug builds, so a release installs
+            // over what is already on a device; a different key would make the
+            // updater's installs fail with a signature mismatch.
+            signingConfig = signingConfigs.getByName("debug")
+            isDebuggable = false
             isMinifyEnabled = false
             proguardFiles(
                 getDefaultProguardFile("proguard-android-optimize.txt"),