ci: gate releases on reproducible builds

Author: SysAdminDoc

.github/workflows/release.yml

@@ -1,10 +1,11 @@
 name: Release
 
 # ROADMAP §6 N6.2 — manual-trigger release workflow:
-#   1. Builds the release variant.
-#   2. Signs with the keystore stored as an encrypted secret.
-#   3. Uploads the signed APK + SHA-256 manifest to a GitHub Release.
-#   4. NOTICE / LICENSES attribution check (Apache-2.0 + SCOWL + LDNOOBW + FlorisBoard upstream).
+#   1. Requires the reproducible-build verifier to pass for the same commit.
+#   2. Builds the release variant.
+#   3. Signs with the keystore stored as an encrypted secret.
+#   4. Uploads the signed APK + SHA-256 manifest to a GitHub Release.
+#   5. NOTICE / LICENSES attribution check (Apache-2.0 + SCOWL + LDNOOBW + FlorisBoard upstream).
 #
 # Required repo secrets (set up under Settings → Secrets and variables → Actions):
 #   SIGNING_KEYSTORE_BASE64   — base64-encoded contents of the .jks file
@@ -33,7 +34,14 @@ permissions:
   contents: write
 
 jobs:
+  reproducible:
+    name: Reproducible APK verification
+    uses: ./.github/workflows/reproducible-build.yml
+    permissions:
+      contents: read
+
   build:
+    needs: reproducible
     runs-on: ubuntu-latest
     env:
       SIGNING_KEYSTORE_BASE64: ${{ secrets.SIGNING_KEYSTORE_BASE64 }}

.github/workflows/reproducible-build.yml

@@ -6,6 +6,7 @@ name: Reproducible APK Check
 
 on:
   workflow_dispatch:
+  workflow_call:
   push:
     branches: [ main, master ]
     paths:

CHANGELOG.md

@@ -2,6 +2,43 @@
 
 All SwiftFloris release history is consolidated here. This replaces the former root-level `RELEASE_NOTES_v*.md` file-per-release pattern.
 
+<a id="v1.8.212"></a>
+## v1.8.212
+
+Released: 2026-06-04
+
+### Release reproducibility gate
+
+F23 makes release publication depend on the existing reproducible-build verifier. The build-twice APK workflow is now reusable via `workflow_call`, and the manual Release workflow has a required `reproducible` job before the signing/build/publish job. If the reproducibility check fails for the selected commit, the signed APK and GitHub Release creation steps never run.
+
+This keeps the existing standalone reproducible-build triggers intact (`workflow_dispatch`, push, and pull request path filters) while closing the release-flow gap where a maintainer could publish before the matching reproducibility signal completed.
+
+### Changes
+
+- **`reproducible-build.yml`** - added `workflow_call` so the verifier can be used as a required job by other workflows.
+- **`release.yml`** - added a `Reproducible APK verification` reusable-workflow job and made the release build job depend on it.
+- **`REPRODUCIBLE_BUILDS.md`** - documented that release dispatches are now blocked by the build-twice verifier.
+- **`ROADMAP.md` / `COMPLETED.md`** - moved F23 out of active work and into shipped state.
+
+### Verification
+
+- `python -c "import yaml, pathlib; [yaml.safe_load(p.read_text(encoding='utf-8')) for p in pathlib.Path('.github/workflows').glob('*.yml')]; print('pyyaml ok')"` -> green.
+- `./gradlew.bat :app:verifyNoInternetPermission :app:testDebugUnitTest :app:lintDebug :app:assembleDebug` -> green with `JAVA_HOME=C:\Program Files\Eclipse Adoptium\jdk-21.0.11.10-hotspot`.
+- `./gradlew.bat :app:verifyRoborazziDebug` -> green with `JAVA_HOME=C:\Program Files\Eclipse Adoptium\jdk-21.0.11.10-hotspot`.
+- `git diff --check` -> green; CRLF normalization warnings only.
+- `bash scripts/check-fastlane-metadata.sh` -> green for versionCode 2012.
+- `bash scripts/check-repo-hygiene.sh` -> green.
+
+### Files Touched
+
+- `.github/workflows/release.yml`
+- `.github/workflows/reproducible-build.yml`
+- `docs/REPRODUCIBLE_BUILDS.md`
+- `fastlane/metadata/android/en-US/changelogs/2012.txt` (new)
+- `gradle.properties` (versionCode 2011->2012, versionName 1.8.211->1.8.212)
+- `README.md` (version badge/current release/highlights)
+- `ROADMAP.md` / `COMPLETED.md` (F23 moved to shipped work)
+
 <a id="v1.8.211"></a>
 ## v1.8.211
 

COMPLETED.md

@@ -50,6 +50,7 @@ Consolidated from the archived open-work checklist (closed items). Full per-rele
 - [x] EI3 (P2) — Personal dictionary bulk-import preview for modular imports, with first-50-row review, row exclusion before commit, excluded-row summary counts, and persisted skip-preview opt-out. Shipped v1.8.209. — *Source: TODO_2026-06-03.md*
 - [x] F6 (P2) — Per-app accent opt-in discovery hint and Settings preview, with process-local three-app threshold tracking, persisted hint state only, Settings search coverage, and privacy docs. Shipped v1.8.210. — *Source: TODO_2026-06-03.md*
 - [x] EI2 (P3, reframed) — Settings home regrouped into Typing experience, Personalization, Privacy & data, Advanced, and About buckets, with Physical keyboard surfaced directly under Advanced while preserving existing deep links. Shipped v1.8.211. — *Source: TODO_2026-06-03.md*
+- [x] F23 (P1) — Release workflow now depends on the reusable reproducible-build verifier before signing or GitHub Release publication, blocking release dispatches when the build-twice APK check fails. Shipped v1.8.212. — *Source: TODO_2026-06-03.md*
 - [x] F1, F2, F15, F16, F17, F19, F20, F25, F26, F32, F34, F35, F36, F41, F42, EI8, EI11, EI4 (doc) — Closed across v1.8.174 -> v1.8.187. — *Source: TODO_2026-06-03.md*
 - [x] IMPROVEMENT_PLAN Workstreams 1, 3, 4, 5, 6 complete; Workstream 2 (lint) monotonically decreasing. — *Source: IMPROVEMENT_PLAN_2026-05-18.md*
 

README.md

@@ -1,6 +1,6 @@
 # SwiftFloris
 
-![Version](https://img.shields.io/badge/version-v1.8.211-blue) ![License](https://img.shields.io/badge/license-Apache%202.0-green) ![Platform](https://img.shields.io/badge/platform-Android%208.0+-orange) ![Network](https://img.shields.io/badge/network-none-lightgrey) ![Dictionary imports](https://img.shields.io/badge/dictionary%20imports-local%20files-green)
+![Version](https://img.shields.io/badge/version-v1.8.212-blue) ![License](https://img.shields.io/badge/license-Apache%202.0-green) ![Platform](https://img.shields.io/badge/platform-Android%208.0+-orange) ![Network](https://img.shields.io/badge/network-none-lightgrey) ![Dictionary imports](https://img.shields.io/badge/dictionary%20imports-local%20files-green)
 
 **SwiftFloris** is a privacy-first Android keyboard, forked from FlorisBoard and pushed toward SwiftKey-class multilingual typing without the cloud. It ships under Apache-2.0, holds no `INTERNET` permission, and binds zero accounts.
 
@@ -37,7 +37,7 @@
 
 ## Highlights
 
-| Area | What's in v1.8.211 | Privacy posture |
+| Area | What's in v1.8.212 | Privacy posture |
 |------|-------------------|-----------------|
 | **Autocorrect / prediction** | SCOWL 117k English dictionary, SymSpell d1+d2, bigram + trigram next-word, capitalization-aware completions, contraction handling, instant-remember user-dictionary overlay | On-device |
 | **Multilingual typing** | Bilingual subtype presets (EN+ES / EN+FR / EN+DE), per-token Latin language identification, top-two straddle guard, sentence-local context scoring, and opt-in remembered keyboard language per app | On-device |
@@ -54,7 +54,7 @@
 | **Migration** | First-run local dictionary import hint; preview-before-save personal dictionary imports with row exclusion; Gboard / FlorisBoard / SwiftKey JSON export importer; passphrase-encrypted SwiftFloris dictionary export/import; Settings-based Keyman LDML / `.kmp` metadata + Windows KLC + macOS hardware-keyboard imports | All file-system based |
 | **Alternative layouts** | Colemak / Dvorak / Workman from the FlorisBoard layout pack, plus selectable honeycomb hex layout with clipped hex keys and hex-aware hit testing (only FOSS Android keyboard shipping this — Typewise vacated the consumer market early 2026; see [docs/HONEYCOMB_LAYOUT.md](docs/HONEYCOMB_LAYOUT.md)) | On-device |
 | **AI transparency** | First-run AI/ML explainer plus Settings → About → AI features screen covering next-word, glide, voice, translation, and smart compose | On-device, no account, no telemetry |
-| **CI / build** | No-network gate, repo-hygiene gate, OSV dep scan, Dependabot version review, lint baseline-drift wrapper, manual emulator settings smoke, reproducible-build toolchain pins + build-twice APK self-check, Roborazzi visual-regression hard gate with committed theme/Addons baselines, Macrobenchmark trace sections in 6 hot paths | Audit-friendly |
+| **CI / build** | No-network gate, repo-hygiene gate, OSV dep scan, Dependabot version review, lint baseline-drift wrapper, manual emulator settings smoke, reproducible-build toolchain pins + build-twice APK self-check chained into release publication, Roborazzi visual-regression hard gate with committed theme/Addons baselines, Macrobenchmark trace sections in 6 hot paths | Audit-friendly |
 
 ## Distribution
 
@@ -442,7 +442,7 @@ limitations under the License.
 
 ## Status
 
-🚀 **Active development.** Current release: **v1.8.211** (2026-06-04). The SwiftKey account export window closed on **2026-05-31**; local/on-device migration paths remain documented above.
+🚀 **Active development.** Current release: **v1.8.212** (2026-06-04). The SwiftKey account export window closed on **2026-05-31**; local/on-device migration paths remain documented above.
 
 ---
 

ROADMAP.md

@@ -2,7 +2,7 @@
 
 > Single source of truth for all planned work. Items above the --- are existing plans; items below are research conducted 2026-06-03.
 
-**Current release:** v1.8.211 (versionCode 2011). **Baseline green:** `:app:verifyNoInternetPermission :app:testDebugUnitTest :app:lintDebug :app:assembleDebug`.
+**Current release:** v1.8.212 (versionCode 2012). **Baseline green:** `:app:verifyNoInternetPermission :app:testDebugUnitTest :app:lintDebug :app:assembleDebug`.
 
 Hard rules still apply (see `AGENTS.md`): no `INTERNET` permission in `:app`; Apache-2.0 ceiling on `:app`; no closed-source blobs; one logical change per commit; every shipped release bumps `gradle.properties` version, writes a `CHANGELOG.md` section, and adds a `fastlane/metadata/android/en-US/changelogs/<versionCode>.txt` (draft <=480 chars for headroom).
 
@@ -43,11 +43,6 @@ Item IDs trace to their origin research: `F#`/`EI#` from the archived 2026-05-25
 
 ### CI, build & release hardening
 
-- [ ] P1 — Chain reproducible-build verification to release-tag flow (F23)
-  - Why: Reproducible-build verification is not gated on release.
-  - Touches: `workflow_call` from `release.yml`, or block tag publish until repro is green.
-  - Acceptance: a tag cannot publish unless reproducible-build verification passes.
-  - Source: TODO.md A4 / research feature plan F23.
 - [ ] P1 — `:app:verifyRoborazziRelease` gate (F24)
   - Why: R8/minify can rename Compose semantics nodes and nothing catches it today.
   - Touches: add a release-variant Roborazzi verification task.

docs/REPRODUCIBLE_BUILDS.md

@@ -43,10 +43,14 @@ Gradle build cache disabled and tasks re-run, then compares the two APKs
 byte-for-byte.
 
 `.github/workflows/reproducible-build.yml` runs this verifier on
-`workflow_dispatch`, and on pushes / pull requests that touch app, Gradle,
-workflow, or reproducible-build documentation surfaces. On mismatch, the
-script writes per-entry SHA-256 manifests excluding `META-INF/` so maintainers
-can tell whether the drift is payload content or signing / ZIP metadata.
+`workflow_dispatch`, as a reusable `workflow_call` from the release workflow,
+and on pushes / pull requests that touch app, Gradle, workflow, or
+reproducible-build documentation surfaces. On mismatch, the script writes
+per-entry SHA-256 manifests excluding `META-INF/` so maintainers can tell
+whether the drift is payload content or signing / ZIP metadata. The release
+workflow's signing and GitHub Release publication job depends on this reusable
+verifier, so a release dispatch cannot publish a tag unless the build-twice
+reproducibility check has passed for the same commit.
 
 ## What can still drift?
 

fastlane/metadata/android/en-US/changelogs/2012.txt

@@ -0,0 +1 @@
+Release publication now waits for SwiftFloris's reproducible-build verifier. The build-twice APK check is reusable from the Release workflow, and signing/GitHub Release creation cannot run unless that check passes for the same commit. No app behavior, permission, network, or telemetry changes.

gradle.properties

@@ -15,5 +15,5 @@ projectMinSdk=26
 projectTargetSdk=36
 projectCompileSdk=36
 
-projectVersionCode=2011
-projectVersionName=1.8.211
+projectVersionCode=2012
+projectVersionName=1.8.212