|
|
@@ -131,3 +131,11 @@ Release checklist:
|
|
|
`/raw/main/releases/cardash-android-<version>.apk`. No app-side release configuration is needed.
|
|
|
7. The current release build uses the project debug signing config. Reuse the existing debug keystore (certificate SHA-256 `C2:8E:5B:0B:E0:F8:27:EE:12:22:B0:62:9F:EE:1C:F2:7E:14:3F:78:95:86:1E:3F:34:15:A6:E5:3A:06:BE:ED`). It is stored locally at `android/keystore/debug.keystore`; that path is gitignored and must never be committed. The Gradle config uses it for debug and release when present, falling back to the default debug key otherwise. Never let Gradle generate a fresh key for a release, or in-place updates will fail. Android still requires the user to confirm installation and allow unknown-app installs once; never attempt silent installation.
|
|
|
8. After the release APK is built, check whether the remote ADB server at `100.101.102.21:5037` is reachable (`adb -H 100.101.102.21 -P 5037 devices`). If `emulator-5554` is listed as `device`, install the release APK with `adb -H 100.101.102.21 -P 5037 -s emulator-5554 install -r releases/cardash-android-<version>.apk`, following the two-attempt ADB rule. If it is unreachable or offline, skip it silently; this step is optional and must never fail the release. Note that `100.101.102.21:5037` is the ADB *server* port; `adb connect` expects the device port (normally `5555`), so use `-H`/`-P` as above.
|
|
|
+
|
|
|
+## 8. Gogs credentials
|
|
|
+
|
|
|
+- Never commit, print, or paste the Gogs token into chat, commit messages, logs, release bodies, or shell history. It is not part of the repository.
|
|
|
+- Read it from the `GOGS_TOKEN` environment variable, or from `$HOME/.config/cardash/gogs_token` (mode `600`). The token belongs to `kkazakov`.
|
|
|
+- Authenticate API calls with `Authorization: token $GOGS_TOKEN`. The token can list releases and read repository data.
|
|
|
+- This Gogs build exposes only `GET /repos/:owner/:repo/releases`; `POST /api/v1/repos/.../releases` returns an HTML 404. Create and publish releases in the web UI at `/releases/new`; do not block a release, or claim it is published, just because the API cannot create one.
|
|
|
+- Use the token only for API operations this Gogs version actually supports.
|
