Prefer Gitea for Android builds

.gitea/workflows/android.yaml

@@ -1,4 +1,4 @@
-name: Gitea Android Compile Check
+name: Gitea Android APK
 
 on: [push]
 
@@ -6,9 +6,13 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - name: Compile Android APK
+      - name: Build Android APK
         env:
           CLONE_TOKEN: ${{ secrets.TMUX_GITEA_TOKEN }}
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
         run: |
           set -eu
 
@@ -26,8 +30,12 @@ jobs:
           rm -rf "${WORKDIR}"
           SERVER_URL="${GITHUB_SERVER_URL:-https://gitea.neatcn.com}"
           REPOSITORY="${GITHUB_REPOSITORY:-tmux/tmux-browser-android}"
-          AUTH_SERVER_URL="$(printf '%s' "${SERVER_URL}" | sed "s#https://#https://gouki:${CLONE_TOKEN}@#")"
+          if [ -n "${CLONE_TOKEN:-}" ]; then
-          git clone "${AUTH_SERVER_URL}/${REPOSITORY}.git" "${WORKDIR}"
+            AUTH_SERVER_URL="$(printf '%s' "${SERVER_URL}" | sed "s#https://#https://gouki:${CLONE_TOKEN}@#")"
+            git clone "${AUTH_SERVER_URL}/${REPOSITORY}.git" "${WORKDIR}"
+          else
+            git clone "${SERVER_URL}/${REPOSITORY}.git" "${WORKDIR}"
+          fi
           cd "${WORKDIR}"
           git checkout "${GITHUB_SHA:-main}"
 
@@ -53,17 +61,105 @@ jobs:
           yes | sdkmanager --licenses >/dev/null || true
           sdkmanager "platforms;android-35" "build-tools;35.0.0" "platform-tools"
 
-          VERSION_NAME="0.1.${GITHUB_RUN_NUMBER:-0}"
+          REF="${GITHUB_REF:-}"
-          VERSION_CODE=$((2000 + ${GITHUB_RUN_NUMBER:-0}))
+          REF_NAME="${GITHUB_REF_NAME:-}"
-          gradle :app:assembleDebug \
+          if [ -z "${REF_NAME}" ]; then
+            REF_NAME="${REF##*/}"
+          fi
+          PUBLISH_RELEASE=0
+          if [ "${REF#refs/tags/v}" != "${REF}" ]; then
+            PUBLISH_RELEASE=1
+            VERSION_NAME="${REF_NAME#v}"
+            MAJOR="$(printf '%s' "${VERSION_NAME}" | cut -d. -f1)"
+            MINOR="$(printf '%s' "${VERSION_NAME}" | cut -d. -f2)"
+            PATCH="$(printf '%s' "${VERSION_NAME}" | cut -d. -f3)"
+            VERSION_CODE=$((MAJOR * 1000000 + MINOR * 1000 + PATCH))
+          else
+            VERSION_NAME="0.1.${GITHUB_RUN_NUMBER:-0}"
+            VERSION_CODE=$((3000 + ${GITHUB_RUN_NUMBER:-0}))
+          fi
+
+          SIGNED=false
+          if [ -n "${ANDROID_KEYSTORE_BASE64:-}" ]; then
+            echo "${ANDROID_KEYSTORE_BASE64}" | base64 -d > release.jks
+            {
+              echo "storeFile=release.jks"
+              echo "storePassword=${ANDROID_KEYSTORE_PASSWORD}"
+              echo "keyAlias=${ANDROID_KEY_ALIAS}"
+              echo "keyPassword=${ANDROID_KEY_PASSWORD}"
+            } > signing.properties
+            SIGNED=true
+          fi
+
+          if [ "${PUBLISH_RELEASE}" = "1" ] && [ "${SIGNED}" != "true" ]; then
+            echo "Gitea release publishing requires ANDROID_KEYSTORE_BASE64 and signing secrets." >&2
+            exit 1
+          fi
+          if [ "${PUBLISH_RELEASE}" = "1" ] && [ -z "${CLONE_TOKEN:-}" ]; then
+            echo "Gitea release publishing requires TMUX_GITEA_TOKEN." >&2
+            exit 1
+          fi
+
+          if [ "${SIGNED}" = "true" ]; then
+            BUILD_TASK=":app:assembleRelease"
+          else
+            BUILD_TASK=":app:assembleDebug"
+          fi
+          gradle "${BUILD_TASK}" \
             -PversionCode="${VERSION_CODE}" \
             -PversionName="${VERSION_NAME}" \
             -PrepoSlug="neatstudio/tmux-browser-android"
 
           mkdir -p release
           APK_PATH="$(find app/build/outputs/apk -name '*.apk' | sort | tail -n 1)"
-          cp "${APK_PATH}" release/tmux-android-gitea-compile-check.apk
+          cp "${APK_PATH}" release/tmux-android.apk
-          ls -lh release/tmux-android-gitea-compile-check.apk
+          cp "${APK_PATH}" "release/tmux-android-${VERSION_NAME}.apk"
-          sha256sum release/tmux-android-gitea-compile-check.apk
+          SHA256="$(sha256sum release/tmux-android.apk | awk '{print $1}')"
-          echo "Gitea-built APK is a compile check only."
+          TAG="v${VERSION_NAME}"
-          echo "Do not publish it as a release asset; release APKs are GitHub-built and mirrored byte-for-byte to Gitea."
+          APK_URL="https://gitea.neatcn.com/tmux/tmux-browser-android/releases/download/${TAG}/tmux-android.apk"
+          RELEASE_PAGE_URL="https://gitea.neatcn.com/tmux/tmux-browser-android/releases/tag/${TAG}"
+          cat > release/latest.json << JSON
+          {
+            "versionCode": ${VERSION_CODE},
+            "versionName": "${VERSION_NAME}",
+            "apkUrl": "${APK_URL}",
+            "sha256": "${SHA256}",
+            "releasePageUrl": "${RELEASE_PAGE_URL}",
+            "minSdk": 26
+          }
+          JSON
+          ls -lh release/tmux-android.apk release/latest.json
+          sha256sum release/tmux-android.apk
+
+          if [ "${PUBLISH_RELEASE}" != "1" ]; then
+            echo "Gitea main build completed as compile check."
+            exit 0
+          fi
+
+          API_ROOT="https://gitea.neatcn.com/api/v1/repos/tmux/tmux-browser-android"
+          RELEASE_BODY='{"tag_name":"'"${TAG}"'","target_commitish":"main","name":"tmux Android '"${VERSION_NAME}"'","body":"Android APK for tmux-ui remote testing.","draft":false,"prerelease":false}'
+          if ! curl -fsSL -X POST \
+            -H "Authorization: token ${CLONE_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "${RELEASE_BODY}" \
+            "${API_ROOT}/releases" \
+            -o /tmp/gitea-release.json; then
+            curl -fsSL -H "Authorization: token ${CLONE_TOKEN}" \
+              "${API_ROOT}/releases/tags/${TAG}" \
+              -o /tmp/gitea-release.json
+          fi
+          RELEASE_ID="$(sed -n 's/.*"id":\([0-9][0-9]*\).*/\1/p' /tmp/gitea-release.json | head -1)"
+          if [ -z "${RELEASE_ID}" ]; then
+            echo "Cannot resolve Gitea release id." >&2
+            cat /tmp/gitea-release.json >&2
+            exit 1
+          fi
+          curl -fsSL -X POST -H "Authorization: token ${CLONE_TOKEN}" \
+            -F "attachment=@release/tmux-android.apk;type=application/vnd.android.package-archive" \
+            "${API_ROOT}/releases/${RELEASE_ID}/assets?name=tmux-android.apk" \
+            -o /tmp/gitea-apk-asset.json
+          curl -fsSL -X POST -H "Authorization: token ${CLONE_TOKEN}" \
+            -F "attachment=@release/latest.json;type=application/json" \
+            "${API_ROOT}/releases/${RELEASE_ID}/assets?name=latest.json" \
+            -o /tmp/gitea-latest-asset.json
+          echo "Published Gitea release ${TAG}."

.github/workflows/android.yml

@@ -2,8 +2,6 @@ name: Android APK
 
 on:
   push:
-    branches:
-      - main
     tags:
       - "v*"
   pull_request:
@@ -27,10 +25,12 @@ jobs:
         run: |
           if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
             VERSION_NAME="${GITHUB_REF_NAME#v}"
+            IFS='.' read -r MAJOR MINOR PATCH <<< "${VERSION_NAME}"
+            VERSION_CODE=$((MAJOR * 1000000 + MINOR * 1000 + PATCH))
           else
             VERSION_NAME="0.1.${GITHUB_RUN_NUMBER}"
+            VERSION_CODE=$((1000 + GITHUB_RUN_NUMBER))
           fi
-          VERSION_CODE=$((1000 + GITHUB_RUN_NUMBER))
           echo "VERSION_NAME=${VERSION_NAME}" >> "${GITHUB_ENV}"
           echo "VERSION_CODE=${VERSION_CODE}" >> "${GITHUB_ENV}"
 

README.md

@@ -88,31 +88,32 @@ base64 -w 0 tmux-android-release.jks
 Branch builds and manual workflow runs create Actions artifacts only. Use them
 to verify grouped changes before publishing.
 
-Publish a release build by pushing a `v*` tag. A tag should be reserved for a
+Gitea is the primary build and update channel. Normal `main` pushes run the
-coherent feature/test batch, not every small UI or text change. Tag publishing
+Gitea Android workflow for compile checks, while GitHub no longer builds every
-creates a GitHub Release with:
+main push. Publish a release build by pushing a `v*` tag after a coherent
+feature/test batch, not every small UI or text change.
+
+Tag publishing can create GitHub Release assets with:
 
 ```text
 https://github.com/neatstudio/tmux-browser-android/releases/latest/download/tmux-android.apk
 https://github.com/neatstudio/tmux-browser-android/releases/latest/download/latest.json
 ```
 
-Gitea is the app's default install/update channel because phones may not be able
+Gitea is also the app's default install/update channel because phones may not be
-to reach GitHub reliably. GitHub remains an optional public source. This Gitea
+able to reach GitHub reliably. GitHub remains an optional public source. This
-instance does not support the GitHub-style `/releases/latest/download/...` URL,
+Gitea instance does not support the GitHub-style
-so the app uses the Gitea Release API as the stable Gitea update entrypoint.
+`/releases/latest/download/...` URL, so the app uses the Gitea Release API as
+the stable Gitea update entrypoint.
 
-Release APKs must be identical on GitHub and Gitea. The canonical APK is the
+Release APKs on GitHub and Gitea should either be the exact same file or be
-GitHub Release asset built by `.github/workflows/android.yml`; publish to Gitea
+built from the same tag with the same signing keystore, `versionCode`, and
-by mirroring that same `tmux-android.apk` byte-for-byte and uploading a
+`versionName`. The Gitea workflow publishes release assets only when signing
-Gitea-specific `latest.json` whose `apkUrl` points at the Gitea asset but whose
+secrets are present. Unsigned Gitea builds remain compile checks and must not be
-`versionCode`, `versionName`, and `sha256` match the GitHub manifest. Do not use
+used for automatic in-place updates.
-a separately built Gitea APK as a release asset unless it is proven to have the
-same SHA-256 as the GitHub APK. This keeps Android signatures and update
-compatibility identical no matter which platform the phone can reach.
 
-Plain branch builds only create Actions artifacts; they are useful for CI
+Plain branch builds are useful for CI verification, but releases are the stable
-verification, but releases are the stable download/update channel.
+download/update channel.
 
 Unsigned/debug workflow artifacts are useful only for smoke testing install and
 launch. Automatic in-place updates require release APKs signed with the same
@@ -123,18 +124,16 @@ incompatible package.
 
 The terminal screen connects to `/ws/terminal` and sends the upstream protocol
 messages unchanged: `attach`, `input`, `resize`, `scroll`, and `clear-history`.
-The first Android UI renders terminal output as monospace text with basic ANSI
+The Android UI renders terminal output through a lightweight screen buffer with
-SGR color support. The terminal view stays bottom-aligned when output is short,
+cursor movement, line clearing, screen clearing, basic ANSI SGR color support,
-auto-scrolls as data arrives, and adjusts its bottom inset when the soft keyboard
+and throttled redraws. It is enough for shell-oriented remote testing, but it is
-opens. Rendering is throttled and the local terminal buffer is capped so opening
+not yet a complete xterm-compatible renderer for full-screen TUIs such as `vim`
-busy sessions does not block the UI thread. Input typed before the terminal
+or `top`.
-attach message is sent is queued and flushed after the WebSocket client is ready.
-It is enough for shell-oriented remote testing, but it is not yet a complete
-xterm-compatible renderer for full-screen TUIs such as `vim` or `top`.
 
-The terminal toolbar and shortcut row include tmux prefix helpers. The app sends
+The terminal input area is a native multi-line composer with a paged accessory
-the same control bytes a keyboard would send, for example `Ctrl+B`, `Ctrl+B d`,
+bar for editing keys, control keys, tmux prefix helpers, navigation keys, and
-`Ctrl+B c`, `Ctrl+B n`, and `Ctrl+B p`.
+common shell symbols. The app sends the same control bytes a keyboard would
+send, for example `Ctrl+B`, `Ctrl+B d`, `Ctrl+B c`, `Ctrl+B n`, and `Ctrl+B p`.
 
 All app features are native Android controls. Complex server objects such as
 preferences, timeline events, group messages, and image metadata currently use