ci(android): publish release test APK artifact

.github/workflows/android-test-apk.yml

@@ -21,7 +21,7 @@ env:
   ANDROID_NDK_VERSION: "27.0.12077973"
 
 jobs:
-  build:
+  build-debug:
     name: Build manual-test APK
     runs-on: ubuntu-latest
     steps:
@@ -68,6 +68,12 @@ jobs:
           grep -q "android.permission.VIBRATE" target/debug/apk/permissions.txt
           grep -q "android.permission.POST_NOTIFICATIONS" target/debug/apk/permissions.txt
           sha256sum "$APK" > target/debug/apk/vimit.apk.sha256
+          {
+            echo "artifact=vimit-android-test-apk"
+            echo "profile=debug"
+            stat -c "bytes=%s" "$APK"
+            du -h "$APK"
+          } > target/debug/apk/size.txt
 
       - name: Upload APK artifact
         uses: actions/upload-artifact@v4
@@ -77,4 +83,86 @@ jobs:
             target/debug/apk/vimit.apk
             target/debug/apk/vimit.apk.sha256
             target/debug/apk/permissions.txt
+            target/debug/apk/size.txt
+          if-no-files-found: error
+
+  build-release-test:
+    name: Build lightweight release-test APK
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Linux GUI dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libfontconfig1-dev libxkbcommon-dev
+
+      - uses: android-actions/setup-android@v3
+
+      - name: Install Android SDK packages
+        run: |
+          sdkmanager \
+            "build-tools;${ANDROID_BUILD_TOOLS_VERSION}" \
+            "platforms;android-30" \
+            "platforms;android-35" \
+            "ndk;${ANDROID_NDK_VERSION}"
+          echo "ANDROID_NDK_HOME=${ANDROID_HOME}/ndk/${ANDROID_NDK_VERSION}" >> "$GITHUB_ENV"
+          echo "ANDROID_NDK_ROOT=${ANDROID_HOME}/ndk/${ANDROID_NDK_VERSION}" >> "$GITHUB_ENV"
+
+      - name: Install Rust Android target and cargo-apk
+        run: |
+          rustup target add aarch64-linux-android
+          cargo install cargo-apk --locked
+
+      - name: Build guarded runner
+        run: |
+          mkdir -p target
+          rustc tools/guarded-run.rs -O -o target/guarded-run
+
+      - name: Generate release-test signing key
+        run: |
+          mkdir -p target/android-signing
+          keytool -genkeypair \
+            -keystore target/android-signing/release-test.keystore \
+            -storepass android \
+            -keypass android \
+            -alias androiddebugkey \
+            -keyalg RSA \
+            -keysize 2048 \
+            -validity 10000 \
+            -dname "CN=Vimit Release Test, O=Vimit, C=US"
+
+      - name: Build lightweight release APK
+        env:
+          CARGO_APK_RELEASE_KEYSTORE: ${{ github.workspace }}/target/android-signing/release-test.keystore
+          CARGO_APK_RELEASE_KEYSTORE_PASSWORD: android
+        run: |
+          ./target/guarded-run --timeout-secs 2400 --heartbeat-secs 30 -- \
+            cargo apk build --release --features android-gui --target aarch64-linux-android --lib
+
+      - name: Verify lightweight release manifest permissions
+        run: |
+          AAPT="${ANDROID_HOME}/build-tools/${ANDROID_BUILD_TOOLS_VERSION}/aapt"
+          APK="target/release/apk/vimit.apk"
+          "$AAPT" dump permissions "$APK" | tee target/release/apk/permissions.txt
+          grep -q "android.permission.INTERNET" target/release/apk/permissions.txt
+          grep -q "android.permission.VIBRATE" target/release/apk/permissions.txt
+          grep -q "android.permission.POST_NOTIFICATIONS" target/release/apk/permissions.txt
+          sha256sum "$APK" > target/release/apk/vimit.apk.sha256
+          {
+            echo "artifact=vimit-android-release-test-apk"
+            echo "profile=release"
+            stat -c "bytes=%s" "$APK"
+            du -h "$APK"
+          } > target/release/apk/size.txt
+
+      - name: Upload lightweight release APK artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: vimit-android-release-test-apk
+          path: |
+            target/release/apk/vimit.apk
+            target/release/apk/vimit.apk.sha256
+            target/release/apk/permissions.txt
+            target/release/apk/size.txt
           if-no-files-found: error

docs/android.md

@@ -190,16 +190,25 @@ production release:
 1. Open GitHub Actions.
 2. Select `Android Test APK`.
 3. Click `Run workflow` on the branch you want to test.
-4. Download the `vimit-android-test-apk` artifact.
-5. Install `vimit.apk` on a device or emulator.
+4. Download `vimit-android-release-test-apk` for the lightweight test APK.
+5. Install `vimit.apk` from that artifact on a device or emulator.
 
-The artifact also contains `permissions.txt`, produced from the APK manifest.
-It must include:
+The workflow also publishes `vimit-android-test-apk`, which is the larger debug
+fallback artifact. Prefer the release-test artifact for normal phone testing;
+use the debug artifact only when diagnosing build/runtime problems. The
+release-test APK is signed with a temporary CI-generated test keystore; it is
+not the production release signing key.
+
+Each artifact contains `permissions.txt`, produced from the APK manifest. It
+must include:
 
 - `android.permission.INTERNET`
 - `android.permission.VIBRATE`
 - `android.permission.POST_NOTIFICATIONS`
 
+Each artifact also contains `vimit.apk.sha256` and `size.txt` so the downloaded
+APK can be checked before installation.
+
 Local build and manifest verification:
 
 ```bash
@@ -211,6 +220,26 @@ rustc tools/guarded-run.rs -O -o target/guarded-run
 aapt dump permissions target/debug/apk/vimit.apk
 ```
 
+Local lightweight release-test build:
+
+```bash
+mkdir -p target/android-signing
+keytool -genkeypair \
+  -keystore target/android-signing/release-test.keystore \
+  -storepass android \
+  -keypass android \
+  -alias androiddebugkey \
+  -keyalg RSA \
+  -keysize 2048 \
+  -validity 10000 \
+  -dname "CN=Vimit Release Test, O=Vimit, C=US"
+CARGO_APK_RELEASE_KEYSTORE="$PWD/target/android-signing/release-test.keystore" \
+CARGO_APK_RELEASE_KEYSTORE_PASSWORD=android \
+./target/guarded-run --timeout-secs 2400 --heartbeat-secs 30 -- \
+  cargo apk build --release --features android-gui --target aarch64-linux-android --lib
+aapt dump permissions target/release/apk/vimit.apk
+```
+
 `tools/guarded-run.rs` is a tiny Rust wrapper for long-running commands. It
 prints heartbeat messages and exits with code `124` if the command exceeds the
 timeout, which helps distinguish a real build hang from normal Android build