ci: switch to signed release APK via build-apk.sh

Debug APK required Metro bundler at runtime. Switch to a signed release
build using a local keystore (same pattern as Postiz-Android): keystore
decoded from KEYSTORE_B64 secret, build-apk.sh patches build.gradle and
assembles a standalone APK.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/build-android.yml

@@ -1,9 +1,9 @@
-name: Build Android APK
+name: Release APK
 
 on:
   push:
     tags:
-      - 'v*'
+      - 'v*.*.*'
   workflow_dispatch:
 
 concurrency:
@@ -12,7 +12,9 @@ concurrency:
 
 jobs:
   build:
+    if: github.server_url == 'https://github.com'
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     permissions:
       contents: write
 
@@ -24,10 +26,14 @@ jobs:
           sudo rm -rf /usr/share/swift /usr/local/julia*
           sudo apt-get autoremove -y > /dev/null 2>&1
           sudo apt-get clean
-          df -h
 
       - uses: actions/checkout@v4
 
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
       - uses: actions/setup-node@v4
         with:
           node-version: '20'
@@ -36,10 +42,15 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - uses: actions/setup-java@v4
-        with:
-          java-version: '17'
-          distribution: 'temurin'
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Accept Android SDK licenses
+        run: yes | sdkmanager --licenses || true
+
+      - name: Install SDK components
+        run: |
+          sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"
 
       - name: Cache Gradle
         uses: actions/cache@v4
@@ -47,31 +58,65 @@ jobs:
           path: |
             ~/.gradle/caches
             ~/.gradle/wrapper
-          key: gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
-          restore-keys: gradle-
+          key: ${{ runner.os }}-gradle-${{ hashFiles('package.json') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-
 
-      - name: Generate Android native project
-        run: npx expo prebuild --platform android --clean
-
-      - name: Build debug APK
-        working-directory: android
+      - name: Decode keystore
         run: |
-          chmod +x gradlew
-          ./gradlew assembleDebug --no-daemon
+          mkdir -p ~/.config/sheethappens
+          echo "${{ secrets.KEYSTORE_B64 }}" | base64 -d > ~/.config/sheethappens/sheethappens.jks
+          cat > ~/.config/sheethappens/signing.env <<EOF
+          KEYSTORE_PATH=~/.config/sheethappens/sheethappens.jks
+          KEYSTORE_ALIAS=${{ secrets.KEYSTORE_ALIAS }}
+          KEYSTORE_STORE_PASSWORD=${{ secrets.KEYSTORE_STORE_PASSWORD }}
+          KEYSTORE_KEY_PASSWORD=${{ secrets.KEYSTORE_KEY_PASSWORD }}
+          EOF
+          chmod 600 ~/.config/sheethappens/signing.env ~/.config/sheethappens/sheethappens.jks
 
-      - name: Upload APK artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: SheetHappens-debug-${{ github.ref_name }}
-          path: android/app/build/outputs/apk/debug/app-debug.apk
-          retention-days: 30
+      - name: Build signed APK
+        run: ./build-apk.sh
+
+      - name: Find built APK
+        id: apk
+        run: |
+          APK=$(ls dist/*.apk | sort | tail -1)
+          echo "path=$APK" >> "$GITHUB_OUTPUT"
+
+      - name: Generate changelog
+        id: changelog
+        run: |
+          PREV_TAG=$(git tag --sort=-version:refname | grep -v "^${{ github.ref_name }}$" | head -1)
+          echo "Previous tag: $PREV_TAG"
+
+          FEATS=$(git log "${PREV_TAG}..HEAD" --pretty=format:"%s" --no-merges \
+            | grep -E "^feat(\([^)]+\))?: " \
+            | sed -E 's/^feat(\([^)]+\))?: //' \
+            | sed 's/^/- /')
+
+          FIXES=$(git log "${PREV_TAG}..HEAD" --pretty=format:"%s" --no-merges \
+            | grep -E "^fix(\([^)]+\))?: " \
+            | sed -E 's/^fix(\([^)]+\))?: //' \
+            | sed 's/^/- /')
+
+          {
+            echo "changelog<<CEOF"
+            [ -n "$FEATS" ] && printf "### What's New\n%s\n\n" "$FEATS"
+            [ -n "$FIXES" ] && printf "### Bug Fixes\n%s\n\n" "$FIXES"
+            echo "CEOF"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Create GitHub Release
-        if: startsWith(github.ref, 'refs/tags/')
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh release create ${{ github.ref_name }} \
-            android/app/build/outputs/apk/debug/app-debug.apk#SheetHappens-${{ github.ref_name }}.apk \
-            --title "SheetHappens ${{ github.ref_name }}" \
-            --generate-notes
+        uses: softprops/action-gh-release@v2
+        with:
+          name: "SheetHappens ${{ github.ref_name }}"
+          body: |
+            ## SheetHappens ${{ github.ref_name }}
+
+            ${{ steps.changelog.outputs.changelog }}
+            ### Installation
+            1. Enable "Unknown sources" on the device
+            2. Transfer the APK to the device and open it to install
+          files: ${{ steps.apk.outputs.path }}
+          draft: false
+          prerelease: ${{ contains(github.ref_name, '-') }}