SIGN the apk

.github/workflows/release-apk.yml

@@ -1,4 +1,5 @@
 name: Build APK and Create GitHub Release
+
 on:
   workflow_dispatch:
     inputs:
@@ -6,28 +7,35 @@ on:
         description: "Release version without leading v. Example: 1.0.0. Leave empty to read the top CHANGELOG heading."
         required: false
         type: string
+
 permissions:
   contents: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+
       - name: Set up Java 17
         uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: "17"
+
       - name: Set up Android SDK
         uses: android-actions/setup-android@v4
+
       - name: Set up Flutter
         uses: subosito/flutter-action@v2
         with:
           channel: stable
           cache: true
+
       - name: Install required Android SDK packages
         shell: bash
         run: |
@@ -36,9 +44,11 @@ jobs:
             "platform-tools" \
             "platforms;android-35" \
             "build-tools;34.0.0" \
-            "build-tools;35.0.0" \
+            "build-tools;35.0.0"
+
       - name: Get dependencies
         run: flutter pub get
+
       - name: Resolve version and tag
         id: meta
         shell: bash
@@ -53,21 +63,45 @@ jobs:
           TAG="v${VERSION}"
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
           echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+
       - name: Extract release notes from CHANGELOG.md
         shell: bash
         env:
           VERSION: ${{ steps.meta.outputs.version }}
         run: python3 .github/scripts/get_notes.py
+
+      - name: Decode Android keystore
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p android/app
+          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 --decode > android/app/upload-keystore.jks
+          chmod 600 android/app/upload-keystore.jks
+
+      - name: Create Android key.properties
+        shell: bash
+        run: |
+          set -euo pipefail
+          cat > android/key.properties <<EOF
+          storePassword=${{ secrets.KEYSTORE_PASSWORD }}
+          keyPassword=${{ secrets.KEY_PASSWORD }}
+          keyAlias=${{ secrets.KEY_ALIAS }}
+          storeFile=upload-keystore.jks
+          EOF
+
       - name: Build release APK
         run: flutter build apk --release
+
       - name: Rename APK
         run: mv build/app/outputs/flutter-apk/app-release.apk build/app/outputs/flutter-apk/focusgram-release.apk
+
       - name: Upload APK artifact
         uses: actions/upload-artifact@v4
         with:
           name: focusgram-apk-${{ steps.meta.outputs.tag }}
           path: build/app/outputs/flutter-apk/focusgram-release.apk
           if-no-files-found: error
+
       - name: Create Git tag
         shell: bash
         env:
@@ -82,6 +116,7 @@ jobs:
           fi
           git tag -a "${TAG}" -m "Release ${TAG}"
           git push origin "${TAG}"
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v3
         with:
@@ -92,4 +127,4 @@ jobs:
           draft: false
           prerelease: false
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}