fix(android): serve icons locally during bubblewrap project generation

[izzywdev]

Summary

• bubblewrap update downloads icon URLs when scaffolding the Android Gradle project
• https://app.fuzefront.com/icons/pwa-512x512.png returns 404 (production PWA not yet deployed), causing build run feat(build): Implement comprehensive security scanning with GitHub Advanced Security #3 to fail with cli ERROR Failed to download icon ... Responded with status 404
• Fix: patch the icon URLs in twa-manifest.json to http://localhost:8080/icons/... and start a Python HTTP server serving frontend/public (which contains the committed PNG files) for the duration of the bubblewrap update call

What changed

.github/workflows/build-android-apk.yml — "Scaffold Android project from TWA manifest" step:

• Before calling bubblewrap update, patch iconUrl, maskableIconUrl, and monochromeIconUrl in twa-manifest.json to localhost:8080
• Start python3 -m http.server 8080 --directory ../frontend/public in the background
• Sleep 1 s for the server to be ready
• Run bubblewrap update --skipPwaValidation (which now downloads icons from localhost)
• Kill the HTTP server

The committed icons in frontend/public/icons/ (pwa-512x512.png, pwa-maskable-512x512.png) are the same files that will eventually be served at the production URL, so the APK icons are correct.

Test plan

• Merge to master triggers build-android-apk.yml run Rename repository from FrontFuse to FuzeFront #4
• "Scaffold Android project from TWA manifest" step completes without icon 404 error
• "Build APK" step produces a signed APK
• APK artifact fuzefront-android-vN is uploaded (90-day retention)
• GitHub Release android-vN is created with the APK attached

---

Generated by Claude Code

[github-actions]

CI failure: Playwright sign-in flow — root cause & fix

Root cause

The "Build, serve & register clock-app" step in .github/workflows/e2e.yml calls POST /api/apps/register without authentication:

curl -fsS -X POST http://localhost:3001/api/apps/register \
  -H 'Content-Type: application/json' \
  -d '{...}'

The /api/apps/register endpoint now requires a valid JWT (authenticateToken + requireAppPermission('create')). The unauthenticated request returns HTTP 401, which makes curl -f exit with code 22, failing the step before any Playwright test runs.

Fix

After the admin user is seeded (the preceding step), log in to obtain a JWT and pass it in the Authorization header:

# Obtain a JWT token — /api/apps/register requires authentication.
TOKEN=$(curl -fsS -X POST http://localhost:3001/api/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"admin@fuzefront.dev","password":"admin123"}' \
  | jq -r '.token')
# url = backend-reachable (drives the health check); remoteUrl = browser-reachable.
curl -fsS -X POST http://localhost:3001/api/apps/register \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"name":"FuzeClock",...}'

Why this is blocked

I prepared this exact fix on branch claude-auto-fix-ci-claude/fuzefront-pwa-android-apk-0cj8ql-28623775934 (commit 15b01f5) but the GitHub App token used by the auto-fix bot lacks the workflows permission, so the push was rejected. A human with the workflows scope (or the contents + workflows permission granted to the App) needs to apply this one-line change to .github/workflows/e2e.yml.

Note: this failure is unrelated to the Android APK changes in PR #144 — it was a pre-existing breakage caused by the security hardening of the apps registration endpoint.

[github-actions]

CI Fix — Email Integration (MailHog) failure

Root cause: The Email Integration (MailHog) CI job runs cd services/email-service && npm ci. npm ci requires a package-lock.json, which was never committed to the repo. Additionally, services/email-service/package.json declared "@fuzefront/shared": "1.0.0" — an unpublished registry specifier — instead of the correct local file reference "file:../../shared".

Fix applied on branch claude-auto-fix-ci-claude/fuzefront-pwa-android-apk-0cj8ql-28623826809:

1. Changed @fuzefront/shared from "1.0.0" → "file:../../shared" in services/email-service/package.json
2. Generated and committed services/email-service/package-lock.json so npm ci has the lockfile it requires

The Notify Team job failure was a downstream consequence of the email-integration job failing.

Note: GitHub Actions is not permitted to create PRs in this repo, so the fix has been pushed to branch claude-auto-fix-ci-claude/fuzefront-pwa-android-apk-0cj8ql-28623826809 targeting claude/fuzefront-pwa-android-apk-0cj8ql.

🤖 Generated with Claude Code