fix release script

.autorc

@@ -5,8 +5,6 @@
   "noVersionPrefix": true,
   "owner": "player-ui",
   "repo": "devtools",
-  "githubApi": "https://github.com/api/v3",
-  "githubGraphqlApi": "https://github.com/api",
   "plugins": [
     [
       "version-file",

.circleci/config.yml

@@ -54,14 +54,13 @@ commands:
             - v1-bazel-cache-core-{{ .Branch }}-{{ .Revision }}
             - v1-bazel-cache-core-{{ .Branch }}
             - v1-bazel-cache-core-main
-            - gem-v1-{{ arch }}-{{ .Branch }}-{{ checksum "Gemfile.lock" }}
-            - gem-v1-{{ arch }}-main-{{ checksum "Gemfile.lock" }}
 
+      # SPM Publishing deploy key
       - add_ssh_keys:
           fingerprints:
-            - "SHA256:hUAWVYdfSW5ml6ufbfyEHUcuPwUJ88xVhsZc21b2lA8"
+            - "SHA256:RhnscAi+Ary3YJrwH2O44cTFkszCXAsx8YLECueVzIA"
 
-      - run: mkdir -p ~/.ssh/ && echo -e "Host github.com\n\tStrictHostKeyChecking no\n" > ~/.ssh/config
+      - run: mkdir -p ~/.ssh/ && echo -e "Host github.com\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
       - run: echo "//registry.npmjs.com/:_authToken=$NPM_TOKEN" >> ~/.npmrc
       - run: git config --global user.name "Intuit Service"
       - run: git config --global user.email "opensource-svc@intuit.com"
@@ -70,7 +69,6 @@ commands:
           echo -e "pinentry-mode loopback\npassphrase $DEPLOY_MAVEN_GPG_PASSPHRASE" > ~/.gnupg/gpg.conf
       - run: |
           source ~/.bashrc
-          bundle install
           npx auto shipit --only-graduate-with-release-label -vv
 
 jobs:
@@ -298,16 +296,16 @@ jobs:
       - codecov/upload:
           files: ./bazel-out/_coverage/_coverage_report.dat,./_ios_coverage/lcov/_coverage_report.dat
 
-  # maybe_release:
-  #   executor: base
-  #   steps:
-  #     - attach_workspace:
-  #         at: ~/devtools
-  #     - run: echo "Should I release? (<< pipeline.parameters.should_release >>)"
-  #     - when:
-  #         condition: << pipeline.parameters.should_release >>
-  #         steps:
-  #           - auto_shipit
+  maybe_release:
+    executor: base
+    steps:
+      - attach_workspace:
+          at: ~/devtools
+      - run: echo "Should I release? (<< pipeline.parameters.should_release >>)"
+      - when:
+          condition: << pipeline.parameters.should_release >>
+          steps:
+            - auto_shipit
 
   release:
     executor: base
@@ -384,16 +382,16 @@ workflows:
             - build-fork
             - bazelrc_fork
 
-      # - maybe_release:
-      #     filters:
-      #       branches:
-      #         ignore:
-      #           - /pull\/.*/
-      #     context:
-      #       - Publish
-      #     requires:
-      #       - build-trunk
-      #       - build-ios-trunk
+      - maybe_release:
+          filters:
+            branches:
+              ignore:
+                - /pull\/.*/
+          context:
+            - Publish
+          requires:
+            - build-trunk
+            - build-ios-trunk
 
       - test:
           name: test-trunk

.gitignore

@@ -31,6 +31,7 @@ core.*
 .eslintcache
 tsconfig.tsbuildinfo
 /.build
+.gitconfig
 
 # AI
 .augment
@@ -58,4 +59,4 @@ test-results
 /.swiftpm
 # DO NOT commit your provisioning profile. It's a secret.
 /ios/demo/ProvisioningProfile 
-.gitconfig
+_ios_coverage/

.npmrc

@@ -1 +1 @@
-registry=https://registry.npmjs.org/
+registry=https://registry.npmjs.com

BUILD

@@ -1,9 +1,7 @@
 load("@aspect_rules_js//js:defs.bzl", "js_library")
 load("@aspect_rules_ts//ts:defs.bzl", "ts_config")
 load("@npm//:defs.bzl", "npm_link_all_packages")
-load("@rules_player//internal:defs.bzl", "stamp")
 load("@rules_player//ios:defs.bzl", "assemble_ios_release", "spm_publish")
-load("//helpers:defs.bzl", "as_target")
 
 package(default_visibility = ["//visibility:public"])
 

MODULE.bazel

@@ -159,6 +159,13 @@ bazel_dep(name = "rules_kotlin", version = "2.1.8")
 register_toolchains("//helpers:kotlin_toolchain")
 
 bazel_dep(name = "rules_android", version = "0.6.5")
+archive_override(
+    module_name = "rules_android", 
+    urls = ["https://github.com/bazelbuild/rules_android/releases/download/v0.6.5/rules_android-v0.6.5.tar.gz"],
+    integrity = "sha256-WlGCx0go2lMWUiGYc5UmTUpc7owQwXF4oNXhI7vRYjw=",
+    strip_prefix = "rules_android-0.6.5",
+    patches = ["//patches:rules_android.mirror.patch"],
+)
 bazel_dep(name = "rules_android_ndk", version = "0.1.3")
 
 # Overridden for https://github.com/bazelbuild/rules_android_ndk/pull/63

VERSION

@@ -1 +1 @@
-0.0.6
+0.12.0

helpers/release/release.sh

@@ -1,6 +1,9 @@
 
 #!/usr/bin/env bash
-# See https://github.com/bazelbuild/rules_nodejs/blob/stable/scripts/publish_release.sh 
+# See https://github.com/bazelbuild/rules_nodejs/blob/stable/scripts/publish_release.sh
+
+# Re-exec under bash if running under sh (e.g. when invoked via Node's execPromise)
+if [ -z "${BASH_VERSION:-}" ]; then exec bash "$0" "$@"; fi
 
 set -u -o pipefail
 

patches/rules_android.mirror.patch

@@ -0,0 +1,51 @@
+From a1d72ab513531a736369c432f81e06c15b33b550 Mon Sep 17 00:00:00 2001
+From: Ted Xie <tedx@google.com>
+Date: Mon, 2 Mar 2026 15:58:40 -0800
+Subject: [PATCH] Add mirror for googlesource tarballs
+
+#465
+
+PiperOrigin-RevId: 877618118
+Change-Id: I89abc54a3299437dc605f034928eecb6f4540887
+---
+ bzlmod_extensions/apksig.bzl          | 7 ++++++-
+ bzlmod_extensions/com_android_dex.bzl | 7 ++++++-
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git bzlmod_extensions/apksig.bzl bzlmod_extensions/apksig.bzl
+index 10299fdcb..39babbdd9 100644
+--- bzlmod_extensions/apksig.bzl
++++ bzlmod_extensions/apksig.bzl
+@@ -24,7 +24,12 @@ def apksig(_ctx = None):
+     # NOTE(b/317109605): Cannot depend on a stable sha256 hash for googlesource repositories.
+     http_archive(
+         name = "apksig",
+-        url = "https://android.googlesource.com/platform/tools/apksig/+archive/%s.tar.gz" % APKSIG_COMMIT,
++        urls = [
++            # Original download URL. Does not always return stable sha256sums, and can flake out.
++            # "https://android.googlesource.com/platform/tools/apksig/+archive/%s.tar.gz" % APKSIG_COMMIT,
++            "https://mirror.bazel.build/android.googlesource.com/platform/tools/apksig/+archive/%s.tar.gz" % APKSIG_COMMIT,
++        ],
++        sha256 = "12e44fdbd219c5e1cc62099c2a01d775957603d2d4f693f8285f9d95d9a04e77",
+         build_file = Label("//bzlmod_extensions:apksig.BUILD"),
+     )
+
+diff --git bzlmod_extensions/com_android_dex.bzl bzlmod_extensions/com_android_dex.bzl
+index 6469f51be..0c052dba6 100644
+--- bzlmod_extensions/com_android_dex.bzl
++++ bzlmod_extensions/com_android_dex.bzl
+@@ -22,8 +22,13 @@ def com_android_dex(_ctx = None):
+     # NOTE(b/317109605): Cannot depend on a stable sha256 hash for googlesource repositories.
+     http_archive(
+         name = "com_android_dex",
+-        url = "https://android.googlesource.com/platform/dalvik/+archive/5a81c499a569731e2395f7c8d13c0e0d4e17a2b6.tar.gz",
++        urls = [
++            # Original download URL. Does not always return stable sha256sums, and can flake out.
++            # "https://android.googlesource.com/platform/dalvik/+archive/5a81c499a569731e2395f7c8d13c0e0d4e17a2b6.tar.gz",
++            "https://mirror.bazel.build/android.googlesource.com/platform/dalvik/+archive/5a81c499a569731e2395f7c8d13c0e0d4e17a2b6.tar.gz",
++        ],
+         build_file = Label("//bzlmod_extensions:com_android_dex.BUILD"),
++        sha256 = "86b4848c038bf687fadc812239cb01fb8d1d15cef3125b480a0448360992b95d",
+     )
+
+ com_android_dex_extension = module_extension(