ci: add release roborazzi gate

Author: SysAdminDoc

.github/workflows/release.yml

@@ -2,10 +2,11 @@ name: Release
 
 # ROADMAP §6 N6.2 — manual-trigger release workflow:
 #   1. Requires the reproducible-build verifier to pass for the same commit.
-#   2. Builds the release variant.
-#   3. Signs with the keystore stored as an encrypted secret.
-#   4. Uploads the signed APK + SHA-256 manifest to a GitHub Release.
-#   5. NOTICE / LICENSES attribution check (Apache-2.0 + SCOWL + LDNOOBW + FlorisBoard upstream).
+#   2. Runs release-variant Roborazzi screenshot verification.
+#   3. Builds the release variant.
+#   4. Signs with the keystore stored as an encrypted secret.
+#   5. Uploads the signed APK + SHA-256 manifest to a GitHub Release.
+#   6. NOTICE / LICENSES attribution check (Apache-2.0 + SCOWL + LDNOOBW + FlorisBoard upstream).
 #
 # Required repo secrets (set up under Settings → Secrets and variables → Actions):
 #   SIGNING_KEYSTORE_BASE64   — base64-encoded contents of the .jks file
@@ -91,6 +92,15 @@ jobs:
       - name: Run unit tests
         run: ./gradlew :app:testDebugUnitTest
 
+      # F24 — release resources / BuildConfig can drift from the debug visual
+      # gate. The app module exposes :app:verifyRoborazziRelease as a stable
+      # alias backed by the non-shipping releaseRoborazzi variant, which
+      # initWith(release) but carries only the screenshot host overlay. Keep
+      # this before APK signing/publication so a release-only screenshot
+      # regression blocks the dispatch.
+      - name: Roborazzi visual-regression verify (release variant)
+        run: ./gradlew :app:verifyRoborazziRelease
+
       - name: Lint debug
         run: ./gradlew :app:lintDebug
 

CHANGELOG.md

@@ -2,6 +2,51 @@
 
 All SwiftFloris release history is consolidated here. This replaces the former root-level `RELEASE_NOTES_v*.md` file-per-release pattern.
 
+<a id="v1.8.213"></a>
+## v1.8.213
+
+Released: 2026-06-04
+
+### Release Roborazzi gate
+
+F24 adds a non-shipping `releaseRoborazzi` build type that `initWith(release)` and carries only the Robolectric screenshot-host manifest overlay. A stable `:app:verifyRoborazziRelease` alias runs Roborazzi against that release-equivalent variant, and the manual Release workflow now runs the alias before lint, APK assembly, signing, artifact upload, or GitHub Release creation.
+
+This gives release dispatches their own screenshot-baseline check against release resources and build flags, closing the gap where the PR/push gate only exercised `debug`.
+
+### Changes
+
+- **`app/build.gradle.kts`** - adds the non-shipping `releaseRoborazzi` build type, enables its UnitTest component, and exposes a stable `verifyRoborazziRelease` alias.
+- **`app/src/releaseRoborazzi/AndroidManifest.xml`** - declares the screenshot host only for the release-equivalent Roborazzi variant, keeping the real release manifest unchanged.
+- **`release.yml`** - adds a required release-variant Roborazzi step before signing/publication.
+- **`README.md` / `LOCAL_VERIFICATION.md`** - document the release visual gate next to the existing debug gate.
+- **`ROADMAP.md` / `COMPLETED.md`** - moved F24 out of active work and into shipped state.
+
+### Verification
+
+- `./gradlew.bat :app:tasks --all` -> exposes `verifyRoborazziRelease` with `JAVA_HOME=C:\Program Files\Eclipse Adoptium\jdk-21.0.11.10-hotspot`.
+- `./gradlew.bat :app:verifyRoborazziRelease` -> green with the same `JAVA_HOME`.
+- `./gradlew.bat :app:verifyNoInternetPermission :app:testDebugUnitTest :app:lintDebug :app:assembleDebug` -> green with the same `JAVA_HOME`.
+- `./gradlew.bat :app:verifyRoborazziDebug` -> green with the same `JAVA_HOME`.
+- `./gradlew.bat :app:assembleRelease` -> green with the same `JAVA_HOME`.
+- `aapt2 dump xmltree --file AndroidManifest.xml app/build/outputs/apk/release/app-release.apk` -> confirms the real release manifest excludes `RoborazziHostActivity`.
+- `git diff --check` -> green; CRLF normalization warnings only.
+- `bash scripts/check-fastlane-metadata.sh` -> green for versionCode 2013.
+- `bash scripts/check-repo-hygiene.sh` -> green.
+
+### Files Touched
+
+- `.github/workflows/release.yml`
+- `app/build.gradle.kts`
+- `app/src/releaseRoborazzi/AndroidManifest.xml` (new)
+- `app/src/main/kotlin/dev/patrickgold/florisboard/screenshot/RoborazziHostActivity.kt`
+- `app/src/test/AndroidManifest.xml`
+- `app/src/test/kotlin/dev/patrickgold/florisboard/screenshot/ExtensionMaintainerChipScreenshotTest.kt`
+- `docs/LOCAL_VERIFICATION.md`
+- `fastlane/metadata/android/en-US/changelogs/2013.txt` (new)
+- `gradle.properties` (versionCode 2012->2013, versionName 1.8.212->1.8.213)
+- `README.md` (version badge/current release/verification docs)
+- `ROADMAP.md` / `COMPLETED.md` (F24 moved to shipped work)
+
 <a id="v1.8.212"></a>
 ## v1.8.212
 

COMPLETED.md

@@ -51,6 +51,7 @@ Consolidated from the archived open-work checklist (closed items). Full per-rele
 - [x] F6 (P2) — Per-app accent opt-in discovery hint and Settings preview, with process-local three-app threshold tracking, persisted hint state only, Settings search coverage, and privacy docs. Shipped v1.8.210. — *Source: TODO_2026-06-03.md*
 - [x] EI2 (P3, reframed) — Settings home regrouped into Typing experience, Personalization, Privacy & data, Advanced, and About buckets, with Physical keyboard surfaced directly under Advanced while preserving existing deep links. Shipped v1.8.211. — *Source: TODO_2026-06-03.md*
 - [x] F23 (P1) — Release workflow now depends on the reusable reproducible-build verifier before signing or GitHub Release publication, blocking release dispatches when the build-twice APK check fails. Shipped v1.8.212. — *Source: TODO_2026-06-03.md*
+- [x] F24 (P1) — Non-shipping `releaseRoborazzi` variant mirrors release build flags for Roborazzi, exposed through `:app:verifyRoborazziRelease`; the release workflow runs it before APK signing/publication. Shipped v1.8.213. — *Source: TODO_2026-06-03.md*
 - [x] F1, F2, F15, F16, F17, F19, F20, F25, F26, F32, F34, F35, F36, F41, F42, EI8, EI11, EI4 (doc) — Closed across v1.8.174 -> v1.8.187. — *Source: TODO_2026-06-03.md*
 - [x] IMPROVEMENT_PLAN Workstreams 1, 3, 4, 5, 6 complete; Workstream 2 (lint) monotonically decreasing. — *Source: IMPROVEMENT_PLAN_2026-05-18.md*
 

README.md

@@ -1,6 +1,6 @@
 # SwiftFloris
 
-![Version](https://img.shields.io/badge/version-v1.8.212-blue) ![License](https://img.shields.io/badge/license-Apache%202.0-green) ![Platform](https://img.shields.io/badge/platform-Android%208.0+-orange) ![Network](https://img.shields.io/badge/network-none-lightgrey) ![Dictionary imports](https://img.shields.io/badge/dictionary%20imports-local%20files-green)
+![Version](https://img.shields.io/badge/version-v1.8.213-blue) ![License](https://img.shields.io/badge/license-Apache%202.0-green) ![Platform](https://img.shields.io/badge/platform-Android%208.0+-orange) ![Network](https://img.shields.io/badge/network-none-lightgrey) ![Dictionary imports](https://img.shields.io/badge/dictionary%20imports-local%20files-green)
 
 **SwiftFloris** is a privacy-first Android keyboard, forked from FlorisBoard and pushed toward SwiftKey-class multilingual typing without the cloud. It ships under Apache-2.0, holds no `INTERNET` permission, and binds zero accounts.
 
@@ -37,7 +37,7 @@
 
 ## Highlights
 
-| Area | What's in v1.8.212 | Privacy posture |
+| Area | What's in v1.8.213 | Privacy posture |
 |------|-------------------|-----------------|
 | **Autocorrect / prediction** | SCOWL 117k English dictionary, SymSpell d1+d2, bigram + trigram next-word, capitalization-aware completions, contraction handling, instant-remember user-dictionary overlay | On-device |
 | **Multilingual typing** | Bilingual subtype presets (EN+ES / EN+FR / EN+DE), per-token Latin language identification, top-two straddle guard, sentence-local context scoring, and opt-in remembered keyboard language per app | On-device |
@@ -185,6 +185,9 @@ The IME's main work lives under `app/src/main/kotlin/dev/patrickgold/florisboard
 
 # Roborazzi screenshot verify (visual-regression CI)
 ./gradlew :app:verifyRoborazziDebug
+
+# Release-variant Roborazzi gate (run before publishing)
+./gradlew :app:verifyRoborazziRelease
 ```
 
 **Signed release build**
@@ -269,7 +272,7 @@ Real device-number collection is tracked in [`docs/BENCHMARKS.md`](docs/BENCHMAR
 ## Testing
 
 - **Unit tests:** Kotest, run with `./gradlew test`. Last reported HEAD: 998+ tests (post-v1.8.40), expanding with each release. The v1.8.47 hardening pass added defensive tests around dictionary import limits, voice-model atomic install, theme asset traversal, and quick-action serializer fallback.
-- **Visual regression:** Roborazzi 1.60.0, plugin alias active. CI runs `:app:verifyRoborazziDebug` on every push / PR as a hard gate, backed by committed baselines for the maintainer chip, SwiftKey High Contrast, Aurora Animated, and Settings -> Addons surfaces.
+- **Visual regression:** Roborazzi 1.60.0, plugin alias active. CI runs `:app:verifyRoborazziDebug` on every push / PR as a hard gate, and the release workflow runs `:app:verifyRoborazziRelease` before APK publication. Baselines cover the maintainer chip, SwiftKey High Contrast, Aurora Animated, and Settings -> Addons surfaces.
 - **Macrobenchmark:** `:benchmark` is wired for AndroidX trace/frame runs, and the adb harness scripts record repeatable IME first-render, first-suggestion, dictionary-load, candidate-row recomposition, theme-switch, and backup/restore baselines.
 - **No-network gate:** CI verifies the absence of `INTERNET` permission on every build.
 - **Lint drift:** CI lint runs through `scripts/run-lint-debug-with-baseline-check.sh`, which fails stale baseline entries instead of leaving them as console-only noise.
@@ -442,7 +445,7 @@ limitations under the License.
 
 ## Status
 
-🚀 **Active development.** Current release: **v1.8.212** (2026-06-04). The SwiftKey account export window closed on **2026-05-31**; local/on-device migration paths remain documented above.
+🚀 **Active development.** Current release: **v1.8.213** (2026-06-04). The SwiftKey account export window closed on **2026-05-31**; local/on-device migration paths remain documented above.
 
 ---
 

ROADMAP.md

@@ -2,7 +2,7 @@
 
 > Single source of truth for all planned work. Items above the --- are existing plans; items below are research conducted 2026-06-03.
 
-**Current release:** v1.8.212 (versionCode 2012). **Baseline green:** `:app:verifyNoInternetPermission :app:testDebugUnitTest :app:lintDebug :app:assembleDebug`.
+**Current release:** v1.8.213 (versionCode 2013). **Baseline green:** `:app:verifyNoInternetPermission :app:testDebugUnitTest :app:lintDebug :app:assembleDebug`.
 
 Hard rules still apply (see `AGENTS.md`): no `INTERNET` permission in `:app`; Apache-2.0 ceiling on `:app`; no closed-source blobs; one logical change per commit; every shipped release bumps `gradle.properties` version, writes a `CHANGELOG.md` section, and adds a `fastlane/metadata/android/en-US/changelogs/<versionCode>.txt` (draft <=480 chars for headroom).
 
@@ -62,11 +62,6 @@ Item IDs trace to their origin research: `F#`/`EI#` from the archived 2026-05-25
 
 ### CI, build & release hardening
 
-- [ ] P1 — `:app:verifyRoborazziRelease` gate (F24)
-  - Why: R8/minify can rename Compose semantics nodes and nothing catches it today.
-  - Touches: add a release-variant Roborazzi verification task.
-  - Acceptance: release-variant screenshot gate runs and catches minify-induced semantics drift.
-  - Source: TODO.md A4 / research feature plan F24.
 - [ ] P2 — Macrobenchmark trend-regression job (EI9)
   - Why: No automated regression check against benchmark baselines.
   - Touches: `workflow_dispatch` job diffing against `docs/benchmark-results/baseline-*.json`; floor/target ranges documented in `docs/BENCHMARKS.md`.

app/build.gradle.kts

@@ -28,9 +28,12 @@ plugins {
     alias(libs.plugins.kotlinx.kover)
     // Roborazzi 1.55.0 (Jan 2026 line) ships AGP-9 support via PR #782,
     // so the Gradle plugin is now applied. This lights up the
-    // `:app:recordRoborazziDebug` (baseline capture) and
-    // `:app:verifyRoborazziDebug` (regression verify) tasks so CI can
-    // gate every PR on a visual diff. Baseline images live under
+    // `:app:recordRoborazziDebug` (baseline capture),
+    // `:app:verifyRoborazziDebug` (PR/push regression verify), and the
+    // `:app:verifyRoborazziRelease` alias backed by the non-shipping
+    // releaseRoborazzi variant so the release workflow can run the same
+    // baselines against release resources/build flags before publishing.
+    // Baseline images live under
     // `app/src/test/snapshots/images/` per Roborazzi convention.
     alias(libs.plugins.roborazzi)
 }
@@ -166,6 +169,16 @@ configure<ApplicationExtension> {
             signingConfig = signingConfigs.findByName("release") ?: signingConfigs.getByName("debug")
         }
 
+        create("releaseRoborazzi") {
+            initWith(getByName("release"))
+            matchingFallbacks += listOf("release")
+
+            // F24: non-shipping release-equivalent variant used only by
+            // :app:verifyRoborazziRelease. Its source-set overlay declares the
+            // screenshot host activity that Robolectric needs; the real release
+            // APK manifest stays untouched.
+        }
+
         create("benchmark") {
             initWith(getByName("release"))
 
@@ -317,6 +330,15 @@ afterEvaluate {
 // is caught. Wired against AGP's SingleArtifact.MERGED_MANIFEST so the task
 // runs after the manifest merger and before assemble.
 androidComponents {
+    beforeVariants(selector().withBuildType("releaseRoborazzi")) { variantBuilder ->
+        // F24: AGP only creates the debug unit-test component by default for
+        // application modules. Roborazzi wires tasks from AGP UnitTest
+        // components, so explicitly enable unit tests on the non-shipping
+        // releaseRoborazzi variant and expose it through the stable
+        // :app:verifyRoborazziRelease alias below.
+        (variantBuilder as com.android.build.api.variant.HasUnitTestBuilder).enableUnitTest = true
+    }
+
     onVariants { variant ->
         val verifyMerged = tasks.register("verifyNoInternetPermissionMerged${variant.name.replaceFirstChar { it.uppercase() }}") {
             group = "verification"
@@ -358,6 +380,12 @@ androidComponents {
     }
 }
 
+tasks.register("verifyRoborazziRelease") {
+    group = "verification"
+    description = "Runs Roborazzi against the non-shipping releaseRoborazzi variant, which mirrors release build flags and carries only the test host overlay (F24)."
+    dependsOn("verifyRoborazziReleaseRoborazzi")
+}
+
 // ROADMAP §6 N7.4 — pin the load-bearing excludes in
 // `app/src/main/res/xml/data_extraction_rules.xml` against accidental
 // rewrite. Android Lint validates the XML against the data-extraction-rules

app/src/main/kotlin/dev/patrickgold/florisboard/screenshot/RoborazziHostActivity.kt

@@ -29,9 +29,8 @@ import androidx.activity.ComponentActivity
  * Activity carries the full nav graph). This shim exists purely so
  * the screenshot tests can launch an empty `ComponentActivity` host.
  *
- * Declared only under the **debug** manifest overlay
- * (`app/src/debug/AndroidManifest.xml`), so it never ships in release
- * builds and never widens the production attack surface. Set
- * `exported=false` so no external app can launch it even on debug.
+ * Declared only under the **debug** and **releaseRoborazzi** manifest overlays,
+ * so it never ships in release builds and never widens the production attack
+ * surface. Set `exported=false` so no external app can launch it even on debug.
  */
 class RoborazziHostActivity : ComponentActivity()

app/src/releaseRoborazzi/AndroidManifest.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    F24 — non-shipping release-equivalent Roborazzi overlay.
+
+    The real release APK must not expose the screenshot host activity. The
+    releaseRoborazzi build type initWith(release) for release resources/build
+    flags but adds this test host so Robolectric can resolve
+    createAndroidComposeRule<RoborazziHostActivity>().
+-->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <application>
+        <activity
+            android:name="dev.patrickgold.florisboard.screenshot.RoborazziHostActivity"
+            android:exported="false"/>
+    </application>
+</manifest>

app/src/test/AndroidManifest.xml

@@ -2,12 +2,12 @@
 <!--
     ROADMAP §7 Next-12.2a — Test-only AndroidManifest overlay.
 
-    Robolectric's `createComposeRule()` is internally backed by
-    `ActivityScenario.launch(ComponentActivity::class)`, which itself
-    needs the activity declared in the merged manifest. The :app
-    module's production manifest only declares the IME service, so
-    ComponentActivity is "unresolvable" — the same failure shape
-    documented in https://github.com/robolectric/robolectric/pull/4736.
+    Robolectric's `createAndroidComposeRule<RoborazziHostActivity>()` is
+    internally backed by ActivityScenario, which needs the activity declared in
+    the merged unit-test manifest. The :app module's production manifest only
+    declares the IME service, so the screenshot host is "unresolvable" unless
+    this test-only overlay declares it — the same failure shape documented in
+    https://github.com/robolectric/robolectric/pull/4736.
 
     This test-tier manifest adds a stub declaration so Roborazzi
     captures work. The file is *only* picked up by the unit-test
@@ -18,7 +18,7 @@
     xmlns:tools="http://schemas.android.com/tools">
     <application>
         <activity
-            android:name="androidx.activity.ComponentActivity"
+            android:name="dev.patrickgold.florisboard.screenshot.RoborazziHostActivity"
             android:exported="false"
             tools:node="merge">
             <intent-filter>

app/src/test/kotlin/dev/patrickgold/florisboard/screenshot/ExtensionMaintainerChipScreenshotTest.kt

@@ -60,10 +60,11 @@ import org.robolectric.annotation.GraphicsMode
 // still representative because Roborazzi snapshots are layout-driven
 // rather than API-level-dependent.
 //
-// Next-12.2a fix: the test-only AndroidManifest at app/src/test/AndroidManifest.xml
-// declares the androidx.activity.ComponentActivity launcher Robolectric
-// needs to back createComposeRule(). The activity never lands in any
-// shipped APK — Robolectric reads it via the test classpath only.
+// Next-12.2a/F24 fix: the test-only AndroidManifest at
+// app/src/test/AndroidManifest.xml declares RoborazziHostActivity so
+// Robolectric can resolve createAndroidComposeRule() for both debug and
+// release unit-test variants. The activity never lands in any shipped APK;
+// Robolectric reads it via the unit-test classpath only.
 @RunWith(AndroidJUnit4::class)
 @Config(qualifiers = "w360dp-h640dp-xxhdpi", sdk = [35])
 @GraphicsMode(GraphicsMode.Mode.NATIVE)