fix(android): bundle Discord SDK in local and CI releases

.github/workflows/ci.yml

@@ -65,6 +65,11 @@ jobs:
               - 'scripts/build_android.sh'
               - 'scripts/build_rust_backend.sh'
               - 'scripts/check_backend_apk.py'
+              - 'scripts/test_check_backend_apk.py'
+              - 'scripts/prepare_discord_sdk.py'
+              - 'scripts/test_prepare_discord_sdk.py'
+              - '.github/actions/discord-sdk/**'
+              - 'third_party/discord/**'
               - 'lib/**'
               - 'assets/**'
               - 'pubspec.yaml'
@@ -211,16 +216,35 @@ jobs:
         uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
         with:
           gradle-version: "9.7.1"
+          # Cache public dependencies, not transforms of the decrypted SDK.
+          gradle-home-cache-includes: |
+            caches/modules-2
+            notifications
 
       - name: Install Android SDK & NDK
         run: |
-          yes | $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager --licenses || true
-          $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager \
+          yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses || true
+          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" \
             "ndk;29.0.14206865" \
             "platforms;android-37.0" \
-            "build-tools;37.0.0"
+            "build-tools;37.0.0" \
+            "cmake;3.22.1"
           echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/29.0.14206865" >> "$GITHUB_ENV"
 
+      - name: Test Discord SDK preparation and APK audits
+        run: |
+          python3 -m unittest discover -s scripts -p 'test_prepare_discord_sdk.py'
+          python3 -m unittest discover -s scripts -p 'test_check_backend_apk.py'
+
+      # Fork PRs do not receive SDK decryption secrets. They still compile the
+      # optional debug bridge and run native tests, but never produce a release
+      # APK with the advertised Discord feature silently missing.
+      - name: Prepare pinned Discord SDK
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: ./.github/actions/discord-sdk
+        with:
+          passphrase: ${{ secrets.DISCORD_SDK_PASSPHRASE }}
+
       - name: Get Flutter dependencies
         run: flutter pub get
 
@@ -240,16 +264,18 @@ jobs:
         run: gradle -p android :app:assembleDebug :app:testDebugUnitTest
 
       - name: Build Rust release application
+        if: env.SPOTIFLAC_DISCORD_SDK_DIR != ''
         run: bash scripts/build_android.sh --target lib/main.dart
 
       - name: Verify Rust release APK payloads
+        if: env.SPOTIFLAC_DISCORD_SDK_DIR != ''
         run: |
           python3 scripts/check_backend_apk.py \
             build/app/outputs/flutter-apk/app-arm64-v8a-release.apk \
-            --backend rust --abis arm64-v8a
+            --backend rust --abis arm64-v8a --require-discord
           python3 scripts/check_backend_apk.py \
             build/app/outputs/flutter-apk/app-armeabi-v7a-release.apk \
-            --backend rust --abis armeabi-v7a
+            --backend rust --abis armeabi-v7a --require-discord
           # PR builds use Gradle's test key; production signing stays in Release.
           for abi in arm64-v8a armeabi-v7a; do
             "$ANDROID_HOME/build-tools/37.0.0/apksigner" verify --verbose \

.github/workflows/release.yml

@@ -88,10 +88,11 @@ jobs:
         uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: |
-            ~/.gradle/caches
+            ~/.gradle/caches/modules-2
             ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
-          restore-keys: gradle-${{ runner.os }}-
+          # Do not publish transforms of the decrypted SDK in shared caches.
+          key: gradle-public-dependencies-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: gradle-public-dependencies-${{ runner.os }}-
 
       - name: Cache Android NDK
         uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
@@ -106,14 +107,23 @@ jobs:
           echo "ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT"
 
           # Accept licenses
-          yes | $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager --licenses || true
+          yes | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" --licenses || true
 
           # Install NDK r29 (supports 16KB page size for Android 15+)
           # Keep the installed platform aligned with compileSdk/targetSdk.
-          $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager "ndk;29.0.14206865" "platforms;android-37.0" "build-tools;37.0.0"
+          "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" \
+            "ndk;29.0.14206865" \
+            "platforms;android-37.0" \
+            "build-tools;37.0.0" \
+            "cmake;3.22.1"
 
           # Set NDK path
-          echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/29.0.14206865" >> $GITHUB_ENV
+          echo "ANDROID_NDK_HOME=$ANDROID_HOME/ndk/29.0.14206865" >> "$GITHUB_ENV"
+
+      - name: Prepare pinned Discord SDK
+        uses: ./.github/actions/discord-sdk
+        with:
+          passphrase: ${{ secrets.DISCORD_SDK_PASSPHRASE }}
 
       - name: Setup Flutter
         uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
@@ -199,9 +209,9 @@ jobs:
         run: |
           apk_dir=build/app/outputs/flutter-apk
           python3 scripts/check_backend_apk.py "$apk_dir/SpotiFLAC-${VERSION}-arm64.apk" \
-            --backend rust --abis arm64-v8a
+            --backend rust --abis arm64-v8a --require-discord
           python3 scripts/check_backend_apk.py "$apk_dir/SpotiFLAC-${VERSION}-arm32.apk" \
-            --backend rust --abis armeabi-v7a
+            --backend rust --abis armeabi-v7a --require-discord
           for abi in arm64 arm32; do
             "$ANDROID_HOME/build-tools/37.0.0/zipalign" -c -P 16 4 \
               "$apk_dir/SpotiFLAC-${VERSION}-${abi}.apk"