release-desktop-multi-os.yml

name: Release Desktop Multi-OS

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to build and upload (for example: v1.6.1)"
        required: true
        type: string
      source_ref:
        description: "Optional build source ref (branch/commit/tag). Defaults to the release tag when omitted."
        required: false
        type: string
      allow_godot_upstream_fallback:
        description: "Allow desktop release jobs to fall back to the upstream Godot release when the project mirror is unavailable."
        required: false
        default: true
        type: boolean
      run_android_device_evidence:
        description: "Run the native Android RSS/SAF evidence gate on a self-hosted arm64 device before publishing mobile release assets."
        required: false
        default: false
        type: boolean
      android_workload_spec:
        description: "Repository-relative schema-1 Android workload spec used by the self-hosted evidence runner."
        required: false
        default: ""
        type: string

permissions:
  contents: write

env:
  GODOT_ALLOW_UPSTREAM_FALLBACK: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.allow_godot_upstream_fallback != 'false' }}
  GODOT_MIRROR_TAG: "godot-mirror-v4.3-stable"
  GODOT_UPSTREAM_BASE_URL: "https://github.com/godotengine/godot/releases/download/4.3-stable"
  GODOT_WINDOWS_ARCHIVE_NAME: "Godot_v4.3-stable_win64.exe.zip"
  GODOT_WINDOWS_ARCHIVE_SHA256: "8f2c75b734bd956027ae3ca92c41f78b5d5a255dacc0f20e4e3c523c545ad410"
  GODOT_LINUX_ARCHIVE_NAME: "Godot_v4.3-stable_linux.x86_64.zip"
  GODOT_LINUX_ARCHIVE_SHA256: "7de56444b130b10af84d19c7e0cf63cf9e9937ee4ba94364c3b7dd114253ca21"
  GODOT_MACOS_ARCHIVE_NAME: "Godot_v4.3-stable_macos.universal.zip"
  GODOT_MACOS_ARCHIVE_SHA256: "d17940b913b3f3bf54c941eeb09042099d93865c6e2638e09e20f7c649aa474a"

jobs:
  ensure-release:
    name: Ensure GitHub Release Exists
    runs-on: ubuntu-latest
    outputs:
      tag_name: ${{ steps.tag.outputs.tag_name }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Resolve tag name
        id: tag
        shell: bash
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            TAG_NAME="${{ github.event.inputs.tag }}"
          else
            TAG_NAME="${GITHUB_REF#refs/tags/}"
          fi
          if [ -z "$TAG_NAME" ]; then
            echo "::error::Unable to resolve release tag."
            exit 1
          fi
          echo "tag_name=$TAG_NAME" >> "$GITHUB_OUTPUT"
          echo "Resolved tag: $TAG_NAME"

      - name: Ensure release record exists
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          TAG_NAME="${{ steps.tag.outputs.tag_name }}"
          if gh release view "$TAG_NAME" >/dev/null 2>&1; then
            echo "Release already exists for $TAG_NAME."
          else
            gh release create "$TAG_NAME" --title "$TAG_NAME" --notes "Automated desktop multi-OS release assets."
          fi

  ensure-godot-mirror-assets:
    name: Ensure Godot Mirror Assets
    needs: ensure-release
    runs-on: ubuntu-latest

    steps:
      - name: Ensure Godot mirror release exists
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          if gh release view "$GODOT_MIRROR_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "Godot mirror release already exists: $GODOT_MIRROR_TAG"
          else
            gh release create "$GODOT_MIRROR_TAG" \
              --repo "$GITHUB_REPOSITORY" \
              --target "$GITHUB_SHA" \
              --title "$GODOT_MIRROR_TAG" \
              --notes "Project-controlled mirror for Godot desktop bootstrap archives."
          fi

      - name: Seed Godot mirror assets from upstream when missing
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p build/godot-mirror
          mapfile -t EXISTING_ASSETS < <(gh release view "$GODOT_MIRROR_TAG" --repo "$GITHUB_REPOSITORY" --json assets --jq '.assets[].name')

          has_asset() {
            local needle="$1"
            local asset
            for asset in "${EXISTING_ASSETS[@]}"; do
              if [ "$asset" = "$needle" ]; then
                return 0
              fi
            done
            return 1
          }

          expected_sha256_for_asset() {
            case "$1" in
              "$GODOT_WINDOWS_ARCHIVE_NAME")
                echo "$GODOT_WINDOWS_ARCHIVE_SHA256"
                ;;
              "$GODOT_LINUX_ARCHIVE_NAME")
                echo "$GODOT_LINUX_ARCHIVE_SHA256"
                ;;
              "$GODOT_MACOS_ARCHIVE_NAME")
                echo "$GODOT_MACOS_ARCHIVE_SHA256"
                ;;
              *)
                return 1
                ;;
            esac
          }

          for ASSET_NAME in \
            "$GODOT_WINDOWS_ARCHIVE_NAME" \
            "$GODOT_LINUX_ARCHIVE_NAME" \
            "$GODOT_MACOS_ARCHIVE_NAME"
          do
            if has_asset "$ASSET_NAME"; then
              echo "Mirror asset already present: $ASSET_NAME"
              continue
            fi

            ARCHIVE_PATH="build/godot-mirror/$ASSET_NAME"
            EXPECTED_SHA256="$(expected_sha256_for_asset "$ASSET_NAME")"
            curl -fsSL "${GODOT_UPSTREAM_BASE_URL}/${ASSET_NAME}" -o "$ARCHIVE_PATH"
            ACTUAL_SHA256="$(sha256sum "$ARCHIVE_PATH" | awk '{print $1}')"
            if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
              echo "::error::Archive digest mismatch for $ASSET_NAME (expected $EXPECTED_SHA256, got $ACTUAL_SHA256)."
              exit 1
            fi
            gh release upload "$GODOT_MIRROR_TAG" "$ARCHIVE_PATH" --repo "$GITHUB_REPOSITORY" --clobber
            echo "Uploaded mirror asset: $ASSET_NAME"
          done

  build-and-upload:
    name: Build and Upload (${{ matrix.platform_label }})
    needs: [ensure-release, ensure-godot-mirror-assets]
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: windows-latest
            platform_label: windows
            files: |
              src-tauri/target/release/bundle/**/*.exe
              src-tauri/target/release/bundle/**/*.msi
          - runner: ubuntu-latest
            platform_label: linux
            files: |
              src-tauri/target/release/bundle/**/*.AppImage
              src-tauri/target/release/bundle/**/*.deb
          - runner: macos-latest
            platform_label: macos
            files: |
              src-tauri/target/release/bundle/**/*.dmg

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref != '' && github.event.inputs.source_ref || github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}
          fetch-depth: 0
          lfs: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "24"
          cache: "npm"

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install Linux native dependencies
        if: runner.os == 'Linux'
        shell: bash
        run: |
          set -euo pipefail
          sudo apt-get update
          if apt-cache show libwebkit2gtk-4.1-dev >/dev/null 2>&1; then
            WEBKIT_PKG="libwebkit2gtk-4.1-dev"
          else
            WEBKIT_PKG="libwebkit2gtk-4.0-dev"
          fi
          if apt-cache show libayatana-appindicator3-dev >/dev/null 2>&1; then
            APPINDICATOR_PKG="libayatana-appindicator3-dev"
          else
            APPINDICATOR_PKG="libappindicator3-dev"
          fi
          sudo apt-get install -y \
            "${WEBKIT_PKG}" \
            libgtk-3-dev \
            librsvg2-dev \
            patchelf \
            "${APPINDICATOR_PKG}"
          echo "Installed Linux native dependencies with ${WEBKIT_PKG} and ${APPINDICATOR_PKG}."

      - name: Install dependencies
        run: npm ci

      - name: Prepare Godot sidecar binary (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $allowUpstreamFallback = "$env:GODOT_ALLOW_UPSTREAM_FALLBACK".ToLower() -eq "true"
          New-Item -ItemType Directory -Path "build\godot" -Force | Out-Null
          $archive = "build\godot\godot-win64.zip"
          $mirrorBaseUrl = "https://github.com/Jacobinwwey/NoteConnection/releases/download/$env:GODOT_MIRROR_TAG"
          $mirrorUrl = "$mirrorBaseUrl/$env:GODOT_WINDOWS_ARCHIVE_NAME"
          $upstreamUrl = "$env:GODOT_UPSTREAM_BASE_URL/$env:GODOT_WINDOWS_ARCHIVE_NAME"
          try {
            Invoke-WebRequest -Uri $mirrorUrl -OutFile $archive
            Write-Host "Downloaded Godot archive from project mirror: $mirrorUrl"
          } catch {
            if (-not $allowUpstreamFallback) {
              throw "Project mirror download failed and upstream fallback is disabled: $mirrorUrl"
            }
            Write-Warning "Project mirror download failed, falling back to upstream: $upstreamUrl"
            Invoke-WebRequest -Uri $upstreamUrl -OutFile $archive
          }
          $actualSha256 = (Get-FileHash -Path $archive -Algorithm SHA256).Hash.ToLower()
          if ($actualSha256 -ne $env:GODOT_WINDOWS_ARCHIVE_SHA256.ToLower()) {
            throw "Downloaded Godot archive digest mismatch (expected $($env:GODOT_WINDOWS_ARCHIVE_SHA256.ToLower()), got $actualSha256)."
          }
          Expand-Archive -Path $archive -DestinationPath "build\godot\extract" -Force
          $godotExe = Get-ChildItem -Path "build\godot\extract" -Filter "Godot_v4.3-stable_win64.exe" -Recurse | Select-Object -First 1
          if (-not $godotExe) {
            $godotExe = Get-ChildItem -Path "build\godot\extract" -Filter "*.exe" -Recurse | Where-Object { $_.Name -notmatch "_console\.exe$" } | Sort-Object Length -Descending | Select-Object -First 1
          }
          if (-not $godotExe) {
            throw "Failed to locate extracted Godot Windows executable."
          }
          if ($godotExe.Length -lt 1048576) {
            throw "Resolved Godot executable is too small ($($godotExe.Length) bytes): $($godotExe.FullName)"
          }
          Copy-Item -Path $godotExe.FullName -Destination "src-tauri\bin\godot-x86_64-pc-windows-msvc.exe" -Force

      - name: Prepare Godot sidecar binary (Linux)
        if: runner.os == 'Linux'
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p build/godot
          MIRROR_BASE_URL="https://github.com/Jacobinwwey/NoteConnection/releases/download/${GODOT_MIRROR_TAG}"
          if ! curl -fsSL "${MIRROR_BASE_URL}/${GODOT_LINUX_ARCHIVE_NAME}" -o build/godot/godot-linux.zip; then
            if [ "${GODOT_ALLOW_UPSTREAM_FALLBACK}" != "true" ]; then
              echo "::error::Project mirror download failed and upstream fallback is disabled."
              exit 1
            fi
            echo "Project mirror download failed, falling back to upstream."
            curl -fsSL "${GODOT_UPSTREAM_BASE_URL}/${GODOT_LINUX_ARCHIVE_NAME}" -o build/godot/godot-linux.zip
          fi
          ACTUAL_SHA256="$(sha256sum build/godot/godot-linux.zip | awk '{print $1}')"
          if [ "$ACTUAL_SHA256" != "$GODOT_LINUX_ARCHIVE_SHA256" ]; then
            echo "::error::Downloaded Godot archive digest mismatch (expected $GODOT_LINUX_ARCHIVE_SHA256, got $ACTUAL_SHA256)."
            exit 1
          fi
          unzip -q -o build/godot/godot-linux.zip -d build/godot/extract
          GODOT_BIN="$(find build/godot/extract -maxdepth 2 -type f -name 'Godot_v4.3-stable_linux.x86_64' | head -n 1)"
          if [ -z "${GODOT_BIN}" ]; then
            echo "Failed to locate extracted Godot Linux executable."
            exit 1
          fi
          cp "${GODOT_BIN}" src-tauri/bin/godot-x86_64-unknown-linux-gnu
          chmod +x src-tauri/bin/godot-x86_64-unknown-linux-gnu

      - name: Prepare Godot sidecar binary (macOS)
        if: runner.os == 'macOS'
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p build/godot
          MIRROR_BASE_URL="https://github.com/Jacobinwwey/NoteConnection/releases/download/${GODOT_MIRROR_TAG}"
          if ! curl -fsSL "${MIRROR_BASE_URL}/${GODOT_MACOS_ARCHIVE_NAME}" -o build/godot/godot-macos.zip; then
            if [ "${GODOT_ALLOW_UPSTREAM_FALLBACK}" != "true" ]; then
              echo "::error::Project mirror download failed and upstream fallback is disabled."
              exit 1
            fi
            echo "Project mirror download failed, falling back to upstream."
            curl -fsSL "${GODOT_UPSTREAM_BASE_URL}/${GODOT_MACOS_ARCHIVE_NAME}" -o build/godot/godot-macos.zip
          fi
          ACTUAL_SHA256="$(sha256sum build/godot/godot-macos.zip | awk '{print $1}')"
          if [ "$ACTUAL_SHA256" != "$GODOT_MACOS_ARCHIVE_SHA256" ]; then
            echo "::error::Downloaded Godot archive digest mismatch (expected $GODOT_MACOS_ARCHIVE_SHA256, got $ACTUAL_SHA256)."
            exit 1
          fi
          unzip -q -o build/godot/godot-macos.zip -d build/godot/extract
          GODOT_BIN="$(find build/godot/extract -type f -path '*Godot.app/Contents/MacOS/Godot' | head -n 1)"
          if [ -z "${GODOT_BIN}" ]; then
            echo "Failed to locate extracted Godot macOS executable."
            exit 1
          fi
          ARCH="$(uname -m)"
          if [ "${ARCH}" = "arm64" ] || [ "${ARCH}" = "aarch64" ]; then
            TARGET_BIN="src-tauri/bin/godot-aarch64-apple-darwin"
          else
            TARGET_BIN="src-tauri/bin/godot-x86_64-apple-darwin"
          fi
          cp "${GODOT_BIN}" "${TARGET_BIN}"
          chmod +x "${TARGET_BIN}"

      - name: Build desktop bundle
        run: npm run tauri:build:mini

      - name: Upload workflow artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-${{ needs.ensure-release.outputs.tag_name }}-${{ matrix.platform_label }}
          if-no-files-found: error
          path: ${{ matrix.files }}

      - name: Upload assets to GitHub release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.ensure-release.outputs.tag_name }}
          files: ${{ matrix.files }}
          fail_on_unmatched_files: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-and-upload-android:
    name: Build and Upload (android-apk)
    needs: ensure-release
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref != '' && github.event.inputs.source_ref || github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}
          fetch-depth: 0
          lfs: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "24"
          cache: "npm"

      - name: Setup Java 23.0.1
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "23.0.1"

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3

      - name: Install Android SDK dependencies
        shell: bash
        run: |
          set -euo pipefail
          yes | sdkmanager --licenses >/dev/null 2>&1 || true
          sdkmanager \
            "platform-tools" \
            "platforms;android-36" \
            "ndk;27.2.12479018"

      - name: Install dependencies
        run: npm ci

      - name: Materialize Android release signing key
        shell: bash
        env:
          ANDROID_KEYSTORE_BASE64: ${{ secrets.NOTE_CONNECTION_ANDROID_KEYSTORE_BASE64 }}
          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.NOTE_CONNECTION_ANDROID_KEYSTORE_PASSWORD }}
          ANDROID_KEY_ALIAS: ${{ secrets.NOTE_CONNECTION_ANDROID_KEY_ALIAS }}
          ANDROID_KEY_PASSWORD: ${{ secrets.NOTE_CONNECTION_ANDROID_KEY_PASSWORD }}
        run: |
          set -euo pipefail
          if [ -z "${ANDROID_KEYSTORE_BASE64}" ] || [ -z "${ANDROID_KEYSTORE_PASSWORD}" ] || [ -z "${ANDROID_KEY_ALIAS}" ] || [ -z "${ANDROID_KEY_PASSWORD}" ]; then
            echo "Android release signing secrets are incomplete; refusing to publish unsigned mobile artifacts." >&2
            exit 1
          fi
          mkdir -p build/android-signing
          printf '%s' "${ANDROID_KEYSTORE_BASE64}" | base64 --decode > build/android-signing/release.jks
          chmod 600 build/android-signing/release.jks
          test -s build/android-signing/release.jks

      - name: Build Android arm64 APK
        shell: bash
        env:
          NOTE_CONNECTION_ANDROID_REQUIRE_SIGNING: "1"
          NOTE_CONNECTION_ANDROID_KEYSTORE_FILE: ${{ github.workspace }}/build/android-signing/release.jks
          NOTE_CONNECTION_ANDROID_KEYSTORE_PASSWORD: ${{ secrets.NOTE_CONNECTION_ANDROID_KEYSTORE_PASSWORD }}
          NOTE_CONNECTION_ANDROID_KEY_ALIAS: ${{ secrets.NOTE_CONNECTION_ANDROID_KEY_ALIAS }}
          NOTE_CONNECTION_ANDROID_KEY_PASSWORD: ${{ secrets.NOTE_CONNECTION_ANDROID_KEY_PASSWORD }}
        run: |
          set -euo pipefail
          NOTE_CONNECTION_TAURI_ANDROID_TARGET=aarch64 npm run tauri:android:build

      - name: Verify signed arm64 Android artifacts
        shell: bash
        env:
          NOTE_CONNECTION_ANDROID_REQUIRE_SIGNING: "1"
        run: |
          set -euo pipefail
          mkdir -p build/release/mobile
          mapfile -t artifacts < <(find src-tauri/gen/android/app/build/outputs -type f \( -name '*.apk' -o -name '*.aab' \) ! -name '*unsigned*' | sort)
          apk_count=0
          aab_count=0
          for artifact in "${artifacts[@]}"; do
            case "$artifact" in
              *.apk) apk_count=$((apk_count + 1)) ;;
              *.aab) aab_count=$((aab_count + 1)) ;;
            esac
          done
          if [ "$apk_count" -ne 1 ] || [ "$aab_count" -ne 1 ]; then
            echo "Expected exactly one signed APK and one signed AAB; found ${apk_count} APK and ${aab_count} AAB." >&2
            exit 1
          fi
          for artifact in "${artifacts[@]}"; do
            node scripts/verify-mobile-artifact.js \
              --artifact "${artifact}" \
              --profile mobile-low \
              --require-arm64 \
              --require-arm64-only \
              --require-signed
            case "$artifact" in
              *.apk) publish_name="noteconnection-arm64-release.apk" ;;
              *.aab) publish_name="noteconnection-arm64-release.aab" ;;
              *) echo "Unsupported Android artifact: ${artifact}" >&2; exit 1 ;;
            esac
            cp "${artifact}" "build/release/mobile/${publish_name}"
          done
          rm -f build/android-signing/release.jks

      - name: Upload signed Android workflow artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-${{ needs.ensure-release.outputs.tag_name }}-android-mobile
          if-no-files-found: error
          path: build/release/mobile/*

  verify-android-device-evidence:
    name: Verify Android device evidence (arm64)
    needs:
      - ensure-release
      - build-and-upload-android
    if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.run_android_device_evidence == 'true' }}
    runs-on: [self-hosted, android-arm64]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref != '' && github.event.inputs.source_ref || github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}
          fetch-depth: 0
          lfs: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "24"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Download signed Android artifacts
        uses: actions/download-artifact@v4
        with:
          name: release-${{ needs.ensure-release.outputs.tag_name }}-android-mobile
          path: build/release/mobile

      - name: Run native Android workload and RSS evidence
        shell: bash
        env:
          WORKLOAD_SPEC: ${{ github.event.inputs.android_workload_spec }}
        run: |
          set -euo pipefail
          if [ -z "${WORKLOAD_SPEC}" ]; then
            echo "android_workload_spec is required when native Android evidence is enabled." >&2
            exit 1
          fi
          test -f "${WORKLOAD_SPEC}"
          apk_path="$(find build/release/mobile -type f -name '*.apk' -print -quit)"
          if [ -z "${apk_path}" ]; then
            echo "Signed arm64 APK was not downloaded." >&2
            exit 1
          fi
          node scripts/capture-tauri-android-rss-evidence.js \
            --artifact "${apk_path}" \
            --workload-spec "${WORKLOAD_SPEC}" \
            --output output/verification/mobile-android

      - name: Upload native Android evidence
        uses: actions/upload-artifact@v4
        with:
          name: release-${{ needs.ensure-release.outputs.tag_name }}-android-evidence
          if-no-files-found: error
          path: output/verification/mobile-android/**

  publish-android-release-assets:
    name: Publish Android release assets after native evidence
    needs:
      - ensure-release
      - build-and-upload-android
      - verify-android-device-evidence
    if: ${{ needs.verify-android-device-evidence.result == 'success' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref != '' && github.event.inputs.source_ref || github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}
          fetch-depth: 0
          lfs: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "24"

      - name: Download signed Android artifacts
        uses: actions/download-artifact@v4
        with:
          name: release-${{ needs.ensure-release.outputs.tag_name }}-android-mobile
          path: build/release/mobile

      - name: Download native Android evidence
        uses: actions/download-artifact@v4
        with:
          name: release-${{ needs.ensure-release.outputs.tag_name }}-android-evidence
          path: build/release/mobile-evidence

      - name: Re-verify artifacts against RSS evidence
        shell: bash
        run: |
          set -euo pipefail
          rss_path="$(find build/release/mobile-evidence -type f -name 'rss.json' -print -quit)"
          manifest_path="$(find build/release/mobile-evidence -type f -name 'tauri_android_rss_evidence.json' -print -quit)"
          if [ -z "${rss_path}" ] || [ -z "${manifest_path}" ]; then
            echo "Native Android evidence must contain rss.json and tauri_android_rss_evidence.json." >&2
            exit 1
          fi
          for artifact in build/release/mobile/*.apk build/release/mobile/*.aab; do
            node scripts/verify-mobile-artifact.js \
              --artifact "${artifact}" \
              --profile mobile-low \
              --rss-evidence "${rss_path}" \
              --require-rss \
              --require-arm64 \
              --require-arm64-only \
              --require-signed
          done

      - name: Upload signed Android assets to GitHub release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ needs.ensure-release.outputs.tag_name }}
          files: build/release/mobile/*
          fail_on_unmatched_files: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}