chore(release): prepare v0.0.1

android/.github/workflows/release.yml

@@ -4,6 +4,9 @@ on:
   push:
     tags: ['v*.*.*']
 
+permissions:
+  contents: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -12,6 +15,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Set up Node 22
         uses: actions/setup-node@v7
@@ -36,19 +40,21 @@ jobs:
         run: npm run build
 
       - name: Decode keystore
-        run: echo "${{ secrets.KEYSTORE_BASE64 }}" | base64 -d > keystore.jks
+        env:
+          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
+        run: printf '%s' "$KEYSTORE_BASE64" | base64 --decode > keystore.p12
 
       - name: Build signed AAB + APK
         working-directory: android
         env:
-          LOTO_KEYSTORE_PATH: ${{ github.workspace }}/keystore.jks
+          LOTO_KEYSTORE_PATH: ${{ github.workspace }}/keystore.p12
           LOTO_KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
           LOTO_KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
           LOTO_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
         run: ./gradlew :app:bundleRelease :app:assembleRelease
 
       - name: Upload to GitHub Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           files: |
             android/app/build/outputs/apk/release/*.apk
@@ -61,8 +67,10 @@ jobs:
       # once you trust the pipeline.
       - name: Check Play Store config
         id: play
+        env:
+          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
         run: |
-          if [ -n "${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}" ]; then
+          if [ -n "$PLAY_SERVICE_ACCOUNT_JSON" ]; then
             echo "configured=true" >> "$GITHUB_OUTPUT"
           else
             echo "configured=false" >> "$GITHUB_OUTPUT"
@@ -71,12 +79,12 @@ jobs:
 
       - name: Upload to Google Play (internal track)
         if: steps.play.outputs.configured == 'true'
-        uses: r0adkll/upload-google-play@v1
+        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
         with:
           serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
           packageName: com.miti99.loto
           releaseFiles: android/app/build/outputs/bundle/release/*.aab
-          track: internal
+          tracks: internal
           status: completed
           # Bumps versionCode automatically? No — must be incremented
           # manually in android/app/build.gradle before tagging.

android/.gitignore

@@ -27,6 +27,8 @@ android/app/src/main/assets/capacitor.plugins.json
 *.aab
 *.keystore
 *.jks
+*.p12
+service-account*.json
 google-services.json
 
 # Editor / OS

android/android/app/build.gradle

@@ -8,7 +8,7 @@ android {
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
         versionCode 1
-        versionName "1.0"
+        versionName "0.0.1"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.
@@ -23,6 +23,7 @@ android {
             def keystorePath = System.getenv('LOTO_KEYSTORE_PATH')
             if (keystorePath) {
                 storeFile file(keystorePath)
+                storeType "pkcs12"
                 storePassword System.getenv('LOTO_KEYSTORE_PASSWORD')
                 keyAlias System.getenv('LOTO_KEY_ALIAS')
                 keyPassword System.getenv('LOTO_KEY_PASSWORD')