ci: speed up and harden the Android store build (#7389)

Author: diegolmello

.github/actions/build-android/action.yml

@@ -36,16 +36,6 @@ runs:
     - name: Set up Gradle
       uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
 
-    - name: Cache Gradle
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-      with:
-        path: |
-          ~/.gradle
-          android/.gradle
-        key: gradle-${{ hashFiles('android/**.gradle*', 'android/**/gradle-wrapper.properties') }}
-        restore-keys: |
-          gradle-
-
     - name: Decode Keystore
       working-directory: android/app
       run: |
@@ -81,7 +71,82 @@ runs:
 
     - name: Build Android Release AAB
       working-directory: android
-      run: ./gradlew bundleRelease
+      run: |
+        build_start=$(date +%s)
+        ./gradlew bundleRelease --build-cache --parallel --max-workers=4
+        build_end=$(date +%s)
+        echo "BUILD_DURATION_SECONDS=$((build_end - build_start))" >> "$GITHUB_ENV"
+      shell: bash
+
+    # Fail loudly if a cache/packaging bug dropped an ABI, instead of shipping an incomplete bundle.
+    - name: Verify AAB contains all target ABIs
+      working-directory: android
+      run: |
+        AAB=app/build/outputs/bundle/release/app-release.aab
+        libs=$(unzip -l "$AAB")
+        missing=0
+        for abi in armeabi-v7a arm64-v8a x86 x86_64; do
+          if grep -q "base/lib/$abi/" <<< "$libs"; then
+            echo "  found: $abi"
+          else
+            echo "  MISSING: $abi"
+            missing=1
+          fi
+        done
+        if [ "$missing" -ne 0 ]; then
+          echo "::error::AAB is missing one or more target ABIs."
+          exit 1
+        fi
+      shell: bash
+
+    # Fail unless the AAB is signed by the official upload cert. Reads the keystore password
+    # via `-storepass:env` (not a shell-quoted arg) since the secret has shell-special chars;
+    # captures use `|| true` so an empty read can't trip `set -e -o pipefail`.
+    - name: Verify AAB signing certificate
+      working-directory: android
+      env:
+        KS_FILE: ${{ inputs.KEYSTORE_OFFICIAL }}
+        KS_ALIAS: ${{ inputs.KEYSTORE_OFFICIAL_ALIAS }}
+        KS_PASS: ${{ inputs.KEYSTORE_OFFICIAL_PASSWORD }}
+      run: |
+        AAB=app/build/outputs/bundle/release/app-release.aab
+
+        aab_out=$(keytool -printcert -jarfile "$AAB" 2>&1 || true)
+        ks_out=$(keytool -list -v -keystore "app/$KS_FILE" -alias "$KS_ALIAS" -storepass:env KS_PASS 2>&1 || true)
+
+        aab_fp=$(printf '%s\n' "$aab_out" | grep -m1 'SHA256:' | tr -d '[:space:]' || true)
+        ks_fp=$(printf '%s\n' "$ks_out" | grep -m1 'SHA256:' | tr -d '[:space:]' || true)
+
+        echo "AAB signer SHA-256:    ${aab_fp:-<none>}"
+        echo "Keystore cert SHA-256: ${ks_fp:-<none>}"
+
+        if [ -z "$aab_fp" ]; then
+          printf '%s\n' "$aab_out"
+          echo "::error::AAB is not signed (no SHA-256 readable) — refusing to ship an unsigned release bundle."
+          exit 1
+        fi
+        if [ -z "$ks_fp" ]; then
+          printf '%s\n' "$ks_out"
+          echo "::error::Could not read the official keystore certificate (keytool output above)."
+          exit 1
+        fi
+        if [ "$aab_fp" != "$ks_fp" ]; then
+          echo "::error::AAB signing certificate ($aab_fp) does not match the official keystore ($ks_fp)."
+          exit 1
+        fi
+        echo "Signing certificate verified against the official keystore ($aab_fp)."
+      shell: bash
+
+    - name: Report build time
+      if: ${{ always() && env.BUILD_DURATION_SECONDS != '' }}
+      run: |
+        mins=$((BUILD_DURATION_SECONDS / 60))
+        secs=$((BUILD_DURATION_SECONDS % 60))
+        {
+          echo "### Android store build (bundleRelease)"
+          echo ""
+          echo "- Wall time: **${mins}m ${secs}s**"
+        } >> "$GITHUB_STEP_SUMMARY"
       shell: bash
 
     - name: Upload sourcemaps/NDK symbols to Bugsnag

.github/workflows/build-android.yml

@@ -44,7 +44,7 @@ jobs:
 
       - name: Build Android
         uses: ./.github/actions/build-android
-        timeout-minutes: 40
+        timeout-minutes: 60
         with:
           GOOGLE_SERVICES_ANDROID: ${{ secrets.GOOGLE_SERVICES_ANDROID }}
           KEYSTORE_OFFICIAL_BASE64: ${{ secrets.KEYSTORE_OFFICIAL_BASE64 }}