Add deterministic Android build, dependency and release verification.
The build should compile from reviewed inputs without silently mutating dependencies or accepting unverified artifacts.
Changes
Add the Gradle wrapper to the repository
Pin the Gradle distribution checksum
Add Gradle dependency verification metadata
Verify the production app-config SHA-256
Keep release signing fail closed
Run Flutter analyze and tests
Run Android lint
Perform cold and warm APK builds
Verify the vendored Android runtime remains unchanged during builds
Run an R8 release smoke build
Verify tracked build inputs remain unchanged
Add focused runtime and security regression checks
This PR changes build and verification behavior only.
## Summary
Add deterministic Android build, dependency and release verification.
The build should compile from reviewed inputs without silently mutating dependencies or accepting unverified artifacts.
## Changes
- Add the Gradle wrapper to the repository
- Pin the Gradle distribution checksum
- Add Gradle dependency verification metadata
- Verify the production app-config SHA-256
- Keep release signing fail closed
- Run Flutter analyze and tests
- Run Android lint
- Perform cold and warm APK builds
- Verify the vendored Android runtime remains unchanged during builds
- Run an R8 release smoke build
- Verify tracked build inputs remain unchanged
- Add focused runtime and security regression checks
This PR changes build and verification behavior only.
Pull request closed
This pull request cannot be reopened because the branch was deleted.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Add deterministic Android build, dependency and release verification.
The build should compile from reviewed inputs without silently mutating dependencies or accepting unverified artifacts.
Changes
This PR changes build and verification behavior only.
Pull request closed