From e357861fb1ebc74cdeceea3182bc4a31ca5c3b2e Mon Sep 17 00:00:00 2001
From: Cobb <cobb@sulkta.com>
Date: Sat, 20 Jun 2026 13:20:34 -0700
Subject: [PATCH] ci: put java on PATH for the apksigner verify step
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gradle build is green (uses JAVA_HOME directly), but the signer-verify
step calls apksigner — a shell wrapper that needs 'java' on PATH. The
straw-build image sets JAVA_HOME without adding its bin to PATH for run
steps, so apksigner died with 'exec: java: not found'. Export it.
---
 .forgejo/workflows/build.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index ea4dfbd96..78dadc53c 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -86,6 +86,10 @@ jobs:
           # The whole series is signed with SHA-1 bb9ca96b...; fail loudly if a
           # build ever produces a different signer (would break in-place updates).
           # Pick whatever build-tools the image actually ships (36 today, not 34).
+          # apksigner is a shell wrapper that needs `java` on PATH; the image
+          # sets JAVA_HOME but doesn't put its bin on PATH for run steps (gradle
+          # uses JAVA_HOME directly, so the build itself is fine).
+          export PATH="$JAVA_HOME/bin:$PATH"
           APKSIGNER=$(ls "$ANDROID_HOME"/build-tools/*/apksigner | sort -V | tail -1)
           FP=$("$APKSIGNER" verify --print-certs "$APK" | grep -i 'SHA-1' | grep -o '[0-9a-f]\{40\}')
           echo "signer SHA-1: $FP"