Building and Releasing

Building and Releasing

Flavours and build types

Variant	Use
githubDebug	Development; installs as …bookstorebd.debug next to the release app
githubRelease	The APK published on GitHub Releases, with the in-app updater
playRelease	Prepared for the Play Store: no install permission, updates come from Play

Release builds are minified and shrunk with R8.

Versions

The version is set once, in app/build.gradle.kts:

val appVersionName = "0.7.0"

The version code is derived from it (major * 10000 + minor * 100 + patch), so it always increases with the version name.

Signing

The release keystore never enters the repository. Signing reads, in order:

1. environment variables (RELEASE_KEYSTORE_PATH, RELEASE_KEYSTORE_PASSWORD, RELEASE_KEY_ALIAS, RELEASE_KEY_PASSWORD), as GitHub Actions provides them from encrypted repository secrets; or
2. a local keystore.properties file, which is git-ignored.

Without either, release builds are produced unsigned, which is how CI checks them on every push. Debug builds use the shared debug key in keystore/, which is public by design.

Publishing a release

1. Set the new appVersionName in app/build.gradle.kts.

2. Add release notes at docs/release-notes/<version>.md.

3. Commit, then tag and push:

   git tag v0.2.0
   git push origin v0.2.0

The release workflow then checks that the tag matches the version, builds and signs the github release, verifies the signing certificate's fingerprint, and publishes the APK with its SHA-256 checksum and the release notes.

In-app updates

The website's /api/v1/app/config reports the latest release, read from this repository's GitHub Releases and cached for 15 minutes. The github build:

1. checks at most once a day, or when Account → Updates → Check is tapped;
2. offers a newer release once, with its notes;
3. downloads the APK and verifies its SHA-256 against the published checksum;
4. hands it to Android's PackageInstaller, which asks the person to confirm and accepts only an APK signed with the same certificate.

The server can also set a minimum supported version. A build below it shows an update screen, with the website as a way to keep shopping in the meantime.